Security+ Test Study (4.5 - 5.6) Flashcards
What is URL scanning?
Universal Resource Locator Scanning: Allowing or restricting websites based upon the site’s URL. Usually managed by URL category rather than individual URLs.
What is an agent based content filter?
To check if a device is in compliance, a software agent is usually installed onto a device before it is given out. It’s then always on and checking to see if the device is within compliance. Agent devices continuously have to be updated and are usually managed from a single console, but the local agent makes the filtering decisions.
What is a proxy content filter?
A user makes a request for a web page, and the request travels through a proxy. The proxy asks the internet for the web page, and the internet gives the web page to the proxy. The proxy then decides whether or not to give the web page to the user based upon the filtering rules set up inside of it.
What are block rules?
Rules that allow or deny websites or website categories. You can make your block rules be specific (by URL) or by general category (Educational, Gambling, Government, etc).
In terms of web filtering, what is reputation?
Content filters sometimes block or allow URLs based upon the website’s “reputation”, or the perceived risk of what accessing that site would be.
What is DNS filtering?
Allowing or blocking websites based upon their IP address.
What is active directory?
A database of everything on the network. Computers, user accounts, printers, file shares, etc.
What is group policy?
Security policies (what users and computers can and can’t do) set up in Active Directory.
What is SELinux?
Security Enhanced Linux. Allows a Linux administrator to assign least privilege to users.
In terms of securing protocols, what is protocol selection?
Use secure protocols that utilize encryption if at all possible. Don’t compromise on this.
In terms of securing protocols, what is port selection?
Use secure ports for your networking. HTTPS over HTTP, port 443 over port 80, for example.
What is transport method?
You may want to encrypt all of your traffic regardless of whether your ports and protocols are encrypting it or not. You can do this by utilizing a VPN concentrator at your endpoint, or using WPA3 on your wireless network.
What is DMARC?
Domain-Based Message Authentication Reporting and Conformance. An extension of SPF and DKIM. If a message sent to a third-party using DKIM or SPF does not properly validate, DMARC can give the receiver the option of what to do with these invalidated messages (Accept all, send to spam, or reject mail). Also added to DNS as a TXT record. Can be queried and reports can be made to see what type of messages you’re getting.
What is DKIM?
Domain Keys Identified Mail. Allowing your mail server to automatically digitally sign emails going out to a third-party. Validated from a TXT record in your DNS.
What is SPF?
Sender Policy Framework. A protocol that defines which email servers are authorized to send mail on the users behalf. Mail domain is added to your DNS as a TXT record.
What is a mail gateway?
A device within a screened subnet that blocks emails at the gateway and evaluates the source of inbound email messages. Device can be on-site or cloud based.
What is FIM?
File Integrity Monitoring. Some files should never change. FIMs check and make sure the files that shouldn’t be changing aren’t changing. Windows has one built in called SFC (system file checker). Linux has one called Tripwire.
What is DLP?
Data Loss Prevention. Looks for and stops running data you don’t want running on your network. If someone sends their social security number over the network, DLP stops it. Also prohibits USB access and blocks sensitive information in inbound and outbound emails, if you set it up that way.
What is an endpoint?
The device used by the user.
What is the edge?
Where the inside of the network meets the outside (the internet). Where firewalls are usually placed.
What is NAC?
Network Access Control. Rules put in place that limit a device’s access to certain types of data, either someone on the outside trying to get in, or someone inside trying to get out. Rules based on user, group, location, application, etc. Think ACLs.
What is a posture assessment?
An assessment that’s performed on a user’s own personal device and given a health check to see if it’s clean before connecting it to the network.
What is EDR?
Endpoint Detection and Response. A lightweight endpoint agent that’s like an antivirus on steroids. It takes a look at things like behavioral analysis, machine learning, and process monitoring, in addition to bad signatures and analyzes all of these things to see if they’re potential threats. Responses to threats are automated.
What is XDR?
Extended Detection and Response. EDR but it’s an Ascended Sayian.
What are user behavior analytics?
A large amount of correlated user activity data observed by XDR and used to build a baseline for what “normally” happens on the network, so that outlying activity stands out and can be stopped.
What is IAM?
Identity and Access Management. Giving the right permissions to the right people at the right time.
What is provisioning and deprovisioning user accounts?
Creating, moving and disabling (or deleting) an account in either AD or some other Access Control software. Usually happens during onboarding and offboarding.
What are permission assignment and implications?
Making sure everyone in your organization gets just enough to do their job and nothing more. Everyone is limited in some way.
What is identity proofing?
Verifying that a user is who they actually say they are. Putting in a password, answering security questions, etc.
What is SSO?
Single sign-on. The process where you login one time to the network and then you have access from that point forward. No need to login again. Windows and ClassLink is this. Once you login you have access to your stuff.
What is LDAP?
Lightweight Directory Access Protocol. Protocol used for reading and writing directories over an IP network.
What is OAuth?
Open Authorization. Mobile friendly authentication. An authentication framework that determines what resources a user will be able to access once they login (usually with a gmail account or something similar).
What is SAML?
Security Assertions Markup Language. The authentication of a user to a third-party database. You don’t keep track of the users logging in, they do. A user attempts to access a resource server, the server sends a SAML request to the authentication server and redirects the user to the authentication server. The user logs in, and the authentication server sends a SAML token to the user, allowing them access to the resource server.
What is federation?
Allows network access without using a local authentication database, for example, logging into something using your third-party facebook or twitter account instead of making a completely new account to login with.
What is interoperability?
Looking at all of the different login possibilities and deciding which is best and which ones can communicate with your authentication server.
What is authorization?
The process of ensuring only authorized rights are exercised for users.
What is least privilege?
Setting the rights and permissions of users to the bare minimum of what they can do on a device in your network to prevent possible exploits.
What is MAC?
Mandatory Access Control. MAC assigns a label to each resource a user needs access to and the administrator of the MAC gets to decide who gets access to what based on the label.
What is DAC?
Discretionary Access Control. The user who creates the data has control over who can access it. Not based upon a label or an administrator assigning rights, it’s up to the creator of the data.
What is role-based access control?
Access control based upon the role a user has in an organization. A Manager group has different rights and permissions than a Director group or a Team Lead group.
What is rule-based access control?
The System Administrator makes and sets the rules for how each user functions within the organization. Rules are made by the Admin and then assigned to a user or group.
What is attribute-based access control?
Complex rule sets that determine whether certain types of data are accessible or not. Takes into account user IP addresses, time of day, desired action, user’s relationship with data, etc. to determine if access will be granted.
What are time-of-day restrictions?
Access is restricted based upon time of day…duh.
What are biometrics?
Mathematical representation of your fingerprint, voice print, iris scan, etc.
What is a hard authentication token?
A random set of numbers generated on a separate device that allows access.
What is a soft authentication token?
A random set of numbers generated on the software of the device you’re trying to access.
What are security keys?
A USB flash drive that contains login information allowing you access on a device.
What are the four multifactor authentication factors?
Something you know
Something you have
Something you are
Somewhere you are
What is “Something you know”?
Like a password or a secret phrase, PIN number or pattern. Very common.
What is “Something you have”?
Like a smart card, phone, USB security key, or hardware/software token.
What is “Something you are”?
Biometrics.
What is “Somewhere you are”?
A login allowed or denied based upon where the login took place. Could be based on IP address or GPS location services.
What are the password best practices?
Length: The longer your password, the harder it is to brute-force.
Complexity: The more special characters you use, the harder it is to brute-force.
Reuse: Sometimes a password manager will remember that you’ve used a password before, and won’t let you reuse it again until you’ve changed it to something else first.
Expiration: A password has become too old and needs to be recreated into something else.
Age: How long since the password was modified. After it reaches a threshold, it expires, and you have to make a new one.
What are password managers?
Software that keeps track of your current passwords, and old passwords. Built into browsers and OSs.
What does it mean to be passwordless?
Not using a password to login. Instead, using things like security keys and facial recognition.
How do just-in-time permissions work?
Granting admin access for a limited time on a specific set of time sensitive credentials.
What is password vaulting?
Primary credentials are stored in a password vault, and the vault controls who gets access to credentials.
What are ephemeral credentials?
Temporary credentials that allow admin access for only a limited amount of time.
What is scripting?
The automation of functions that would normally have to be performed manually. It’s fast, can do mundane tasks, saves time, and enforces baselines. It can be set up with standard infrastructure configurations that can set up default configurations for routers and switches. Can automatically scale your infrastructure.
What are the seven steps to the incident response process?
Preparation
Detection
Analysis
Containment
Eradication
Recovery
Lessons Learned
In terms of the incident response process, what is preparation?
Having a list of resources, policies and procedures, communication methods and contact information of people who need to know about the incident. Have a “go bag” that contains hardware and software ready to address any type of incident. Have a clean OS image ready to go in case the worst happens.
In terms of the incident response process, what is detection?
Know how to look for incidents when they occur and don’t get distracted by possible false positives.
In terms of the incident response process, what is analysis?
Comparing a baseline of your monitoring logs to the incident when it occurs.
In terms of the incident response process, what is containment?
Stopping the attack as quickly as possible by isolating it.
In terms of the incident response process, what is eradication?
Getting rid of the attack.
In terms of the incident response process, what is recovery?
Getting things back to normal. Replacing software, re-imaging, disabling compromised accounts, fixing vulnerabilities, recovering the OS, etc.
In terms of the incident response process, what are lessons learned?
Understand what happened and make sure it doesn’t happen again. Ask yourself if your plans worked or if they need revision. Did your monitoring systems work?
In terms of incident planning, what is testing?
You can better prepare to handle an incident through a tabletop exercise or running a simulation. Remember to use the well-defined rules of engagement before simulating a test.
In terms of incident planning, what is root cause analysis?
Determining the ultimate cause of an incident. Asking, “Why did this happen?” or “What was the first domino to fall in this chain of incidents?” Gathering of facts to draw a reasonable conclusion.
In terms of incident planning, what is threat hunting?
Finding the attacker before they find you. Upgrading your defenses so that threats can be caught before they get in.
What is digital forensics?
Collecting data when a security event occurs, and using that data for future use.
What is legal hold?
A type of data acquisition request that is usually initiated by a lawyer, informing you of what type of data needs to be stored and how much needs to be available. Usually stored in an ESI (Electronically Stored Information) repository.
What is chain of custody?
Information must maintain its unmodified status for the duration of its necessary use, thus a process is in place to see who has access to the information. Hashes and digital signatures allow us to know how the data has been stored and whether or not it has been tampered with.
In terms of digital forensics, what is acquisition?
The gathering of data and how it is obtained, via disk, RAM, firmware, OS files, etc. Data could be on multiple systems that need to be accessed.
In terms of digital forensics, what is reporting?
Documenting how the data was acquired and stored.
In terms of digital forensics, what is preservation?
How the data acquired is stored, isolated, and protected.
In terms of digital forensics, what is E-Discovery?
Electronic Discovery. The process of collecting, preparing, reviewing, interpreting and producing electronic documents to be utilized by a third-party. Think of the audits for GoGuardian requested at Alvord.
What are security log files?
Detailed security-related information, including blocked and allowed traffic flows, exploit attempts, blocked URL categories, and DNS sinkhole traffic.
What are firewall logs?
Traffic flows through a firewall. Usually contains source and destination IPs, port numbers, and what the firewall does with this traffic. NGFW log the applications used, URL filtering categories, and anomalies and suspicious data.
What are application logs?
Log files specific to an application. You can find this in the application log in Event Viewer in Windows.
What are endpoint logs?
Log files specific to devices that are endpoints, such as phones, laptops, tablets, desktops, and servers.
What are OS-specific security logs?
The log files specific to the OS that are associated with security events. Good at finding disabled services and brute-force attacks. Lots of data here, so be sure to filter it.
