Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ > Security Overview > Flashcards

Security Overview Flashcards

1
Q

Information Security

A

Act of protecting data and info from unauthorized access, unlawful modification, and disruption, disclosure, corruption, and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information Security Systems

A

Protecting the systems that hold the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CIA Triad

A

confidentiality, integrity, availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Confidentiality (CIA Triad)

A

Info has not been disclosed to unauthorized ppl (encryption)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrity (CIA triad)

A

info hasn’t been altered or modified without proper authorization (hashes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Availability (CIA Triad)

A

Info is able to be accessed, stored, and protected at all times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

AAAs of Security

A

Authentication, Authorization, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Authentication (AAA of security)

A

persons identity is established with proof and confirmed by a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

5 Methods of Authentication

A
  1. Something you know (user/pass)
  2. Something you are (retina scan/fingerprint)
  3. Something you have (token, drivers license)
  4. Something you do (speak, signature)
  5. location
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Authorization (AAA of security)

A

occurs when a user is given access to certain part of something

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Accounting (AAA of security)

A

tracking of data, computer usage, network resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Non-repudiation

A

Proof that someone has taken action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security threats

A

Malware, unauthorized access, system failure, social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Malware

A

malicious software (worms, virus, trojan horse, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Unauthorized access

A

occurs when access to computer resources and data happens without consent of the owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

System Failure

A

BSOD - blue screen of death

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Social engineering

A

act of manipulating a user into revealing confidential info performing other detrimental actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Mitigating Threats

A

Physical Controls
Technical Controls
Admin Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Physical Controls

A

alarm systems, locks, fences, doors, badges/id cards, security guards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Technical Controls

A

smart cards, encryption, access control lists (ACLs), intrusion detection systems (IDS), network authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Admin Controls (Managerial Controls)

A

policies, procedures, security awareness, contingency, disaster recovery plans (user training is most cost effective)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

2 Categories of Admin Controls

A

User procedural controls - org choses to do on its own

Legal/Regulatory - required by law (HIPAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

White Hat

A

non-malicious hackers who attempt to break into a company’s system at their request (internal/contractors) - penetration testers/ethical hackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Black Hat

A

People that break into computer systems and networks without authorization or permissions (bad guys)

25
Q

Blue Hat

A

People who attempt to hack into a network with the permission of a company but are not employed by the company

26
Q

Gray Hat

A

Hacker without affiliation to a company that attempts to break into a company’s network but risks the law. Doesn’t necessarily have bad intention, just wants to break in

27
Q

Elite Hacker

A

find and exploit vulnerabilities before anyone else does (1 in 10,000)

28
Q

Script Kiddie

A

limited skill and only run other people’s exploits and tools

29
Q

Hacktivist

A

Hackers who are driven by a cause like social change, political agendas, terrorism

30
Q

Organized Crime

A

hackers who are part of a crime group that is well funded and highly sophisticated

31
Q

Advanced Persistent Threats (APTs)

A

highly trained and highly funded groups of hackers, funded by nation states with covert and open source intelligence at their disposal (russia/china)

32
Q

Threat Intelligence Sources

A 
Timeliness
Relevancy
Accuracy
Confidence Level
Open Source
Proprietary 
Open Source Intelligence (OSINT)
Threat Hunting
33
Q

Timeliness

A

property of intelligence source that ensures it is up to date

34
Q

relevancy

A

property of an intelligence source that ensures it matches the use cases intended

35
Q

Accuracy

A

property of an intelligence source that ensures it produces effective results

36
Q

Confidence Levels

A

property of an intelligence source that ensures it produces qualified statements about reliability

37
Q

MISP Project

A

codifies the use of the admirability scale for grading data and estimate langugae

confirmed
probably true
possibly true
doubtfully true
improbable 
cannot be judged
38
Q

Proprietary

A

threat intelligence is very widely provided as a commercial service offering, where acess to updates and research is subject to a subscription fee

39
Q

Closed Source

A

data derived from the provider’s own research and analysis efforts, such as data from honenets that they operate, plus info mined from it’s customers systems suitably anonymized

40
Q

honeynet

A

network setup with intentional vulnerabilities hosted on a decoy server to attract hackers

41
Q

open source

A

data that is available to use without subscription, whi may include threat feeds similar to the commercial providers, and may contain reputation lists and malware signature dbs

42
Q

Open source intelligence (OSINT)

A

methods of obtaining info about a person or org through public records, websites, social media (talos, virustotal, whois)

43
Q

Threat hunting

A

cyber security technique designed to detect presence of threat that have not been discovered by a normal security monitoring

44
Q

Benefits of Threat Hunting

A 
improves detection capabilities
integrate intelligence
reduces attack surface
block attack vectors
identify critical access
45
Q

Kill Chain

A

model developed by lockeed martin that describes the stages by which a threat actor progresses a network intrusion

46
Q

Kill Chain Stages

A 
Reconaissance
Weaponization
Delivery
Exploitation
Installation
Command and control (C2)
Actions on Objectives
47
Q

Reconaissance

A

the attacker determines what methods to use to complete the phases of attack (should have a good idea of what software and network looks like when completed)

48
Q

Weaponization

A

attacker couples payload code that will enable access with exploit code that will use vulnerability to execute on the target system

49
Q

Delivery

A

attacker identifies a vector by which to transmit the weaponized code to target environment

50
Q

Exploitation

A

weaponized code is executed on the target system by this mechanism

51
Q

installation

A

mechanism enables weaponized code to run a remote access tool and achieve persistence on the target system

52
Q

Command and Control (C2)

A

weaponzed code establishes an outbound channel to a remote server that can then be used to control the remote access tool and possibly download additional tools to progress the attack

53
Q

Actions on Objections

A

use access they’ve achieved to do what they want to. covertly collect info and transfer to remote system (data exfiltration)

54
Q

MITRE ATT&CK Framework

A

knowledge base maintained by the MITRE corp for listting and explaining specific adversary tactics, techniques, and common knowledge or procedures

55
Q

Diamond Model of intrusion analysis

A

framework for analyzing cybersecurity incidents and intrusion by exploring the relationship between 4 core features

56
Q

4 core features of Diamond Model of Intrustion Analysis

A

Adversary
Capability
infrastructure
victim

57
Q

You are at the doctor’s office and waiting for the physician to enter the room to examine you. You look across the room and see a pile of patient records on the physician’s desk. There is no one in the room and your curiosity has gotten the better of you, so you walk across the room and start reading through the other patient records on the desk. Which tenent of security have you just violated?

  1. Confidentiality
  2. Authentication
  3. Integrity
  4. Availability
A

Confidentiality

58
Q

You have just walked up to the bank teller and requested to withdraw $100 from checking account #7654123 (your account). The teller asks for your name and driver’s license before conducting this transaction. After she looks at your driver’s license, she thanks you for your business, pulls out $100 from the cash drawer, and hands you back the license and the $100 bill. What category best describes what the bank teller just did?

  1. Accounting
  2. Authorization
  3. Authentication
  4. availability
A

Authentication

59
Q

You are in the kitchen cooking dinner while your spouse is in the other room watching the news on the television. The top story is about how hackers have been able to gain access to one of the state’s election systems and tamper with the results. Unfortunately, you only heard a fraction of the story, but your spouse knows that you have been learning about hackers in your Security+ course and asks you, “Which type of hacker do you think would be able to do this?”

  1. Hackitivists
  2. Organized crime group
  3. Apts
  4. Script kiddies
A

APTs

CompTIA Security+ (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions