Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SY0-701 Security+ Exam > Security Controls > Flashcards

Security Controls Flashcards

1
Q

A systematic evaluation of an organization’s security practices, policies, and controls to identify vulnerabilities, ensure compliance, and improve overall security posture.

A

Security Audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The process of converting data into a coded format (ciphertext) to prevent unauthorized access. It ensures confidentiality and requires a decryption key to revert to readable form.

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A set of rules and procedures that dictate how an organization protects its assets, data, and systems from security threats. It defines roles, responsibilities, and acceptable use of resources.

A

Organizational Security Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Tools that monitor network or system activity for malicious actions or policy violations. They alert administrators when potential threats are detected.

A

IDS (Intrusion Detection System)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The practice of systematically managing and maintaining the consistency of hardware, software, and network settings. It helps prevent security misconfigurations and ensures systems are secure and up-to-date.

A

Configuration Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A network security device or software that monitors and controls incoming and outgoing traffic based on predefined security rules. It acts as a barrier between a trusted and an untrusted network.

A

Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A security control that acts as a safeguard or countermeasure implemented using technology (hardware or software) to protect systems, networks, and data from security threats.

A

Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Encryption, Intrusion Detection Systems (IDSs), & Firewalls are examples of what type of Security Control?

A

Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A type of Security Control that is:

  1. Sometimes called logical security controls
  2. Executed by Computer Systems
  3. Implemented with Technology?
A

Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A security control that acts as the administrative measures that focus on the planning, implementation, and management of an organization’s security strategy.

A

Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Security policies and procedures, Risk assessments, Security training programs, & Incident response plans are examples of what type of security control?

A

Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A type of Security Control that is:

  1. Also known as administrative controls
  2. Documented in written policies
  3. Focused on protecting material assets
A

Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A security control that has procedures and practices that people perform to ensure day-to-day security. They are implemented to manage and protect an organization’s assets effectively

A

Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Incident response processes, Backup and recovery practices, Patch Management, Configuration Management, & Monitoring and logging are examples of what type of security control?

A

Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A type of Security Control that is:

  1. Focused on the day-to-day procedures of an organization
  2. Used to ensure that the equipment continues to work as specified
  3. Primarily implemented and executed by people (as opposed to computer systems)
A

Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A security control whose measures are designed to protect personnel, hardware, software, and data from physical threats, such as unauthorized access, theft, or natural disasters.

A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Locks and keys, Security cameras (CCTV), Fences and gates, Security guards, Vestibules, Bollards/Barricades, & Security Guards are examples of what type of security control?

A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A security control where measures are implemented to stop security incidents from occurring by proactively protecting systems, networks, and data.

A

Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Firewalls (block unauthorized traffic), Antivirus software (prevents malware infections), Encryption, Security training (educates employees to avoid risks) are examples of what type of security control?

A

Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A security control that is designed to discourage potential attackers or unauthorized actions by making the consequences or difficulty of an attack evident.

A

Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Warning signs (e.g., “This area is under surveillance”), Fencing/Bollards, Guards on patrol, & Alarm systems are examples of what type of security control?

A

Deterrent

22
Q

A security control that is designed to identify and detect security incidents or breaches as they occur, allowing for a timely response and investigation.

A

Detective

23
Q

Intrusion Detection Systems (IDS), Security cameras (for monitoring and reviewing events), Log monitoring and analysis, Motion detectors, and Vulnerability Scanning are examples of what type of security control?

A

Detective

24
Q

A type of security control that is designed to fix or restore systems after a security incident has occurred, minimizing damage and preventing recurrence.

A

Corrective

25
Q

Patching vulnerabilities after an attack, Restoring data from backups, Implementing new security policies after a breach, and Removing malware or unauthorized software are examples of what type of security control?

A

Corrective

26
Q

A type of security control that is implemented to achieve the same security objective when the primary control is not feasible or effective. These are used as substitutes to address gaps or weaknesses.

A

Compensating

27
Q

Backup Power Systems, MFA, Application Sandboxing, & Network Segmentation are examples of what type of security control?

A

Compensating

28
Q

A type of security control that guides or instructs personnel on how to behave, outlining expected security practices and policies to promote compliance and minimize risk.

A

Directive

29
Q

Security policies and procedures, Employee training programs, Access control lists (defining who can access what), & Security awareness campaigns are examples of what type of security control?

A

Directive

30
Q

A set of predefined procedures an organization follows to detect, respond to, and recover from a cybersecurity incident or breach.

A

IRP (Incident Response Plan)

31
Q

A document that outlines the rules and guidelines for using an organization’s network, devices, and systems. It defines what is acceptable and unacceptable usage to ensure security and compliance.

A

AUP (Acceptable Use Policy)

32
Q

A tool used to monitor network or system traffic for suspicious activity or potential threats. It alerts administrators when it detects abnormal patterns that might indicate an intrusion.

A

IDS (Intrusion Detection System)

33
Q

A security mechanism that requires users to provide two or more verification factors to gain access to a system, typically combining something the user knows (password), something the user has (phone or token), and something the user is (biometric data).

A

MFA (Multi-Factor Authentication)

34
Q

A security tool designed to detect and actively block or prevent potential threats or attacks in real-time. It works by analyzing traffic for signatures or patterns of known attacks and taking action to stop them.

A

IPS (Intrusion Prevention System)

35
Q

A framework for managing digital keys and certificates used to secure communications and verify identities. It enables encryption, digital signatures, and secure email by utilizing public and private key pairs.

A

PKI (Public Key Infrastructure)

36
Q

The security framework used to manage user access and track activity on a system by:

  1. Verifying the identity of a user or device.
  2. Determining the access rights or permissions of a user.
  3. Tracking user activity and maintaining logs for auditing.
A

AAA (Authentication, Authorization, and Accounting)

37
Q

A regulation in the European Union that governs the collection, storage, and protection of personal data. It aims to enhance privacy rights and give individuals more control over their data.

A

GDPR (General Data Protection Regulation)

38
Q

A model that outlines the basic principles of information security:

  1. Ensuring that information is only accessible to authorized individuals.
  2. Ensuring that data is accurate, complete, and unaltered.
  3. Ensuring that data and systems are accessible and usable when needed.
A

CIA Triad (Confidentiality, Integrity, and Availability)

39
Q

A security principle that ensures that once a transaction or communication has been made, the sender cannot deny or dispute their involvement. It provides proof of the origin and integrity of data, often through digital signatures or logs.

Example: Digital signatures in emails or contracts, Audit trails and logs in systems

A

Non-Repudiation

40
Q

A user account with limited permissions to perform basic tasks, such as running applications and accessing files. It cannot make system-wide changes or modify security settings.

A

Standard User Account

41
Q

An account used by multiple individuals to access a system or service, typically with common credentials. This type of account lacks individual user identification, making it harder to track activities or assign responsibility.

A

Shared Account

42
Q

A limited access account designed for temporary or one-time use. It allows the user to access certain resources but with restricted permissions and no ability to make system changes.

A

Guest User Account

43
Q

A specialized account used by services, applications, or system processes to perform tasks automatically. These accounts usually have elevated permissions but are restricted to specific functions.

A

Service Account

44
Q

An authentication protocol used to verify the identity of a user or device by challenging it with a random value and requiring a hashed response. It operates using periodic challenges to ensure continuous security.

A

CHAP (Challenge Handshake Authentication Protocol)

45
Q

A protocol that provides centralized authentication, authorization, and accounting for network devices. It uses encryption for the entire communication between the client and server.

A

TACACS+ (Terminal Access Controller Access-Control System Plus)

46
Q

A simple, insecure authentication protocol where a password is sent in plaintext during the authentication process. It is rarely used today due to its vulnerability to interception.

A

PAP (Password Authentication Protocol)

47
Q

A protocol used for remote user authentication, authorization, and accounting. It is commonly used in networking to manage access to internet services or network resources, with encryption applied only to the password.

A

RADIUS (Remote Authentication Dial-In User Service)

48
Q

A variant of CHAP developed by Microsoft for Windows networks. It provides stronger encryption and challenge/response authentication, but is still considered less secure than modern alternatives.

A

MS-CHAP (Microsoft Challenge Handshake Authentication Protocol)

49
Q

A unique identifier assigned to each device on a network, allowing it to communicate with other devices. It can either be IPv4 (32-bit) or IPv6 (128-bit).

A

Internet Protocol (IP) address

50
Q

A unique identifier assigned to the network interface card (NIC) of a device. It is used for communication within a local network and is typically a 48-bit hexadecimal address.

A

MAC (Media Access Control address) address

51
Q

The use of unique physical or behavioral characteristics to verify an individual’s identity. Examples include fingerprint scanning, facial recognition, iris scanning, and voice recognition.

A

Biometrics

52
Q

Electronic documents used to prove the ownership of a public key. They are issued by a trusted Certificate Authority (CA) and contain information about the key, the identity of the certificate holder, and the CA’s signature to verify the authenticity of the certificate.

Examples: SSL/TLS certificates for websites and Email encryption certificates

A

Digital Certificate

SY0-701 Security+ Exam (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions