Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Security/Network Basics (Ch. 1,2) > Flashcards

Security/Network Basics (Ch. 1,2) Flashcards

1
Q

CIA triad

A

_ confidentiality
_ integrity
_ availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

User identification

A

_ Claiming an identity prior to authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Integrity

A

_ Ensures data has not changed.
_ Can uses hashes to verify integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Redundancy

A

_ Provides fault tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SPOF

A

_ Single point of failure
_ If it fails, the entire system “can” fail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Scalability vs. elasticity

A

Scalability:
_ long-term strategy for being able to scale
_ done manually
Elasticity:
_ ability to dynamically scale up or out as needed
_ scales back down when not needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

TCO

A

_ total cost of ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

resiliency

A

_ ability to self-heal or recover from faults with minimal downtime
_ e.g. performing and testing backups
_ e.g. UPS or generators
_ e.g. NIC teaming
_ e.g. redundant disk subsystems
_ e.g. retrying failed processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Space needed for encryption

A

_ typically about a 40% increase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

risk

A

_ the possibility or likelihood of a threat exploiting a vulnerability and resulting in a loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

threat

A

_ a circumstance or event that has the potential to compromise confidentiality, integrity, or availability
_ can be natural or man-made
_ can be intentional or accidental

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Risk mitigation

A

_ reducing the chances that a threat will exploit a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Categories of security controls

A

_ managerial controls
_ operational controls
_ technical controls
_ (classification alternative to “control types”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Managerial controls

A

_ administrative controls
_ document policy
_ regular reviews, such as risk assessments and vulnerability assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Operational controls

A

_ ensure day-to-day ops comply with security plan
_ primarily implemented by people rather than systems
_ e.g. awareness and training
_ e.g. configuration management (such as secure baselines and change management)
_ e.g. media protection
_ e.g. physical and environmental protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Technical controls

A

_ technological controls, whether software or hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Control types

A

_ preventative
_ detective
_ corrective
_ deterrent
_ compensating
_ physical
_ (classification alternative to “control categories”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Preventative controls

A

_ hardening (making more secure than default config, using defense-in-depth)
_ training
_ security guards
_ change management (a change process helps catch configuration problems before they occur)
_ account disablement policy
_ intrusion prevention system (IPS)
_ and others (not listed)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SEM

A

_ security event management
_ real-time monitoring and analysis of security events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SIM

A

_ security information management
_ long-term storage of security data
_ used for analyzing trends and creating reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SIEM

A

_ security information and event management system
_ collects, analyzes, manages data from multiple sources
_ detects trends
_ raises alerts
_ combines SEM and SIM functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

IDS

A

_ intrusion detection system
_ monitors network and sends alerts
_ out-of-band with traffic (can’t block traffic)
_ may modify ACLs, terminate processes, or redirect traffic in response to detections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Detective controls

A

_ post-exploit
_ log monitoring
_ SIEM systems
_ security audit of organization
_ video surveillance
_ motion dection
_ intrusion detection system (IDS)
_ and others (not listed)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Corrective and recovery controls

A

_ backups and system recovery
_ incident handling process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Deterrent controls

A

_ discourage hackers from attacking or employees from violating security policies
_ often also preventative
_ e.g. cable locks (for laptops)
_ e.g. physical locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

TOTP

A

_ time-based one-time password
_ example of a compensating control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Compensating controls

A

_ controls that are alternatives to the primary control
_ usually for handling special situations
_ e.g. TOTP access until user receives a security card

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Response controls

A

_ aka incident response controls
_ prepare for security incidents
_ respond to security incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Network discovery

A

_ devices on a network discovering other devices on the same network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Network reconnaissance

A

_ acquiring details about a network and its devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

ICMP

A

_ Internet Control Message Protocol
_ often used in DoS attacks
_ used by ping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

ping (e.g count)

A

_ sends an ICMP echo request packet
_ can limit counts on Linux with “-c count”
_ can loop pings on Windows with “-t”
_ firewall may block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

hping

A

_ only on Linux
_ sends pings to TCP, UDP, and ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

NIC

A

_ network interface card
_ wired or wireless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

ifconfig

A

Often first step in troubleshooting network problems. Can show:
_ IP address
_ subnet mask
_ default gateway
_ MAC address
_ DNS address
_ config info for NICs
_ deprecated but still useful
_ ipconfig on Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Use ifconfig to get basic network info

A

_ ifconfig

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Use ifconfig to show TCP/IP config for each NIC

A

_ ifconfig -a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Show local DNS cache

A

_ displaydns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Flush the local DNS cache

A

_ flushdns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Ip command

A

_ recommended over ifconfig, but not as functional
_ show details on interfaces: ip link show
_ enable a network interface: ip link set eth0 up
_ show stats on network interface: ip -s link

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

netstat

A

_ shows TPC/IP stats
_ shows active TCP/IP connections
_ switches can be combined

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Display list of all open connections

A

_ netstat

43
Q

Display list of all TCP and UDP ports being listened to, plus display all open connections

A

_ netstat -a

44
Q

Display network statistics details, including bytes sent/received

A

_ netstat -e

45
Q

traceroute

A

_ lists all routers between two systems (each is a hop)
_ provides IP, hostname, and round-trip times (RTTs)
_ useful for identifying faulty routers (e.g. where traffic stops)
_ often used after ping fails to reach an IP
_ can find an unauthorized router monitoring packets
_ on windows: tracert

46
Q

ARP

A

_ Address Resolution Protocol
_ resolves IPv4 addresses to MAC addresses
_ caches resolved mappings
_ required when packet reaches destination subnet

47
Q

arp

A

_ command to show/manipulate the ARP cache
_ can be used to find MAC addresses of other systems on local network (after getting their IPs)

48
Q

Show the entire ARP cache

A

_ arp

49
Q

Show the ARP cache for a single IP address

A

_ arp -a 192.168.1.1

50
Q

logger command

A

_ adds a log entry to “/var/log/syslog”

51
Q

Linux permission groups

A

_ 1st: owner
_ 2nd: owner’s group
_ 3rd: everyone else

52
Q

Give owner’s group only write permission to a file

A

_ chmod g=w filename

53
Q

Remove owner’s execute permission from file

A

_ chmod u-x filename

54
Q

Add read permission to file for everyone

A

_ chmod o+r filename

55
Q

Windows logs

A

_ security log (audit and access)
_ system log
_ app log

56
Q

Network logs

A

_ found on a variety of devices

57
Q

UBA

A

_ user behavior analysis

58
Q

NTP

A

_ network time protocol
_ for syncing time across a network

59
Q

SIEM capabilities

A

_ log collection - keeps logs in a searchable DB
_ log aggregation - storing varying log data in same format
_ correlation - looks for patterns, raises alerts
_ reporting
_ packet capture
_ user behavior analysis (UBA)
_ sentiment analysis - detects unwanted behavior
_ security monitoring - predefined alerts
_ automated triggers - actions to perform after detecting a predetermined number of repeated events
_ time sync across servers providing source data using NTP (or converting time to a common format)
_ event deduplication - same data only stored once
_ WORM logs - write-once read-many log archiving

60
Q

Elements of a SIEM dashboard

A

_ sensor logs
_ alerts
_ sensitivity levels
_ correlation
_ trends

61
Q

Syslog protocol

A

_ specifies a general entry format
_ specifies a protocol for transporting log entries
_ can collect log entries from many devices (like SIEM)
_ syslogd collects syslog messages on Linux
_ log format in /etc/syslog.conf
_ logs in /var/syslog
_ formerly used UDP, now uses TCP

62
Q

Linux logs

A

_ in /var/log/
_ /var/log/auth.log - user login attempts (debian/ubuntu)
_ /var/log/secure - user login attempts (red hat/centos)
_ /var/log/syslog/ - general system messages (debian/ubuntu)
_ /var/log/messages/ - general system messages (red hat/centos)

63
Q

U.S. DHS password recommendations

A

_ hash all passwords
_ require MFA
_ don’t require mandatory password resets
_ requires passwords to be 8+ chars
_ prevent use of common passwords
_ tell users not to share passwords across sites
_ allow all special chars but don’t require any

64
Q

Password history

A

_ prevents users from reusing old passwords

65
Q

Four security factors

A

_ Something you know
_ Something you have (other than biometrics)
_ Something you are (including biometrics)
_ Somewhere you are

66
Q

KBA

A

_ knowledge-based authentication
_ static KBA
_ dynamic KBA

67
Q

Static KBA

A

_ static knowledge-based authentication
_ authentication information that doesn’t change
_ e.g. personal security questions

68
Q

Dynamic KBA

A

_ authenticates individuals not already having an account
_ retrieves from other sources information that only the individual should know, verifies that
_ time limit answering questions to reduce risk of someone looking them up on the Internet

69
Q

Smart card

A

_ card with microchip and certificated
_ embedded cert holds user’s private key
_ requires PKI (public key infrastructure)

70
Q

Hard token

A

_ aka hardware token
_ device with a one-time password (OTP)
_ password (usually a number) changes over time

71
Q

Soft token

A

_ aka software token
_ app running on smartphone generating the OTP
_ e.g. Google Authenticator

72
Q

HOTP

A

_ HMAC-based One-Time-Password
_ token and server apply an algorithm to a shared secret key
_ each time token is used, both advance to the next token
_ device usually has a button for displaying the token

73
Q

TOTP

A

_ Time-based One-Time Password
_ select token as a function of the time

74
Q

Retina vs iris scanners

A

_ Retinal scanners ID the pattern of blood vessels at the back of the eye - requires physical contact
_ Iris canners use IR to capture the unique patterns of the iris around the pupil - no physical contact required

75
Q

Strongest authentication factor

A

_ biometrics (“something you are”)
_ aka “third factor”
_ retina and iris scans are strongest

76
Q

Four biometric acceptance possibilities

A

_ false acceptance (incorrectly identifies unknown user as known)
_ false rejection (incorrectly rejects a known user)
_ true acceptance
_ true rejection

77
Q

FAR and FRR

A

_ false acceptance rate
_ false rejection rate

78
Q

CER

A

_ crossover error rate
_ point at which FAR crosses with FRR on a graph as system increases with sensitivity
_ low CER indicates greater accuracy

79
Q

2FA combos

A

_ something you have and something you know
_ something you know and something you are
_ (excludes something you have and something you are)
_ (can’t both use the same class of factor)
_ (“something you have” often verified by push notification to smartphone)

80
Q

Account types and their credential policies

A

_ personnel or end-user accounts
_ admin and root accounts
_ service accounts (user account under which a server runs – credentials don’t expire)
_ device accounts
_ third-party accounts (used by external entities)
_ guest accounts
_ shared and generic account/credentials (when user varies)

81
Q

PAM

A

_ privileged access management
_ can be just-in-time permissions (given as needed, usually auto-revoked after a period of time)
_ can be temporal accounts (temporary grants)
_ often used for admin or root accounts
_ prevents exposure of a root password

82
Q

PAM capabilities

A

_ allow users access to privileged account without giving them the password
_ automatically change privileged account passwords periodically
_ limit time users can use the privileged account
_ allow users to check out credentials
_ log all access of credentials

83
Q

deprovisioning

A

_ process of disabling a user account

84
Q

attestation

A

_ formal process of reviewing user permissions

85
Q

SSO

A

_ single-sign on
_ login once to access multiple systems
_ increases security because user need only remember one password, reducing likelihood they write it down
_ may generate a unique secure token per sign-in
_ often provided by LDAP

86
Q

Federated system

A

_ aka federated identity management system
_ provides central authentication in a non-homogeneous environment
_ associates varied credentials with a single identity
_ single sign-on across disparate servers

87
Q

SAML

A

_ security assertion markup language
_ provides federated identity management across different websites
_ e.g. a frontend provides auth before redirecting user to a backend system without requiring re-auth
_ does not provide authorization, but may support transfer of authorization info between systems

88
Q

SAML roles

A

_ principal - typical user
_ identity provider (IdP) - maintains the auth system
_ service provider - provides services to the user

89
Q

OAuth

A

_ open standard for authorization (not authentication)

90
Q

Authorization models

A

_ role-based access control
_ rule-based access control
_ discretionary access control (DAC)
_ mandatory access control (MAC)
_ attribute-based access control (ABAC)

91
Q

Role-BAC

A

_ role-based access control
_ aka group-based access control
_ can be hierarchy based, mimicking heirarching of org
_ can be job/task/function-based
_ assigns permissions to groups (windows calls roles “security groups”)

92
Q

Rule-BAC

A

_ rule-based access control
_ usually in routers and firewalls in ACLs, defining what traffic is allowed into the network
_ intrusion detection systems can use dynamic rules to detect and block attacks
_ some rules trigger in response to an event

93
Q

DAC

A

_ discretionary access control
_ owners of objects have full control over permissions to object and establish access to the objects
_ Windows (e.g. NTFS) and most Unix-based systems use DAC (with DAC lists – DACLs)

94
Q

ACE

A

_ access control entry in an ACL

95
Q

NTFS

A

_ Microsoft’s New Technology File System
_ permissions: write, read, read/execute, modify, full-control

96
Q

SID

A

_ security identifier on Windows
_ used in DACLs

97
Q

MAC (authorization)

A

_ mandatory access control
_ assigns labels to both subjects and objects
_ objects are organized into compartments
_ labels define security levels and designate compartments
_ subjects have access to the objects for which the subject’s labels are >= the object’s label and the subject also has the label for the compartment
_ also enforces need-to-know
_ government classification access

98
Q

SELinux

A

_ security-enhanced Linux
_ uses MAC

99
Q

MAC (networks)

A

_ media access control
_ assigns physical/hardware addresses to NICs

100
Q

MAC (authentication)

A

_ message authentication code
_ provides integrity akin to a hash

101
Q

SDN

A

_ software defined network
_ network in which software routes traffic rather than hardware controllers and switches

102
Q

ABAC

A

_ attribute-based access control
_ bases access on attributes of the user, the resource, or the environment
_ rules for access control are called “policies”
_ policies state subject, object, action (what user wants to do), and environment (context of request)
_ commonly used in SDNs
_ can enforce DAC or MAC schemes

103
Q

What to look for when reviewing authentication logs

A

_ account lockouts
_ concurrent session usage
_ impossible travel time
_ blocked content (due to validation)
_ resource consumption (indicating attack)
_ resource inaccessibility
_ log anomalies (e.g. unusual numbers of logs, logs at unusual times, or missing log entries)

Security+ 701 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions