Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > SY0-701: 3.0 (Security Architecture) > Flashcards

SY0-701: 3.0 (Security Architecture) Flashcards

1
Q

Data Classifications (Companies) (3.3)

A

Sensitive
Confidential
Public
Restricted
Private
Critical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Sensitive Data (3.3)

A

Has minimal impact if released (e.g. organizations financial data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidential Data (3.3)

A

Contains items such as trade secrets, intellectual property data, and source code that affect the business if disclosed (only viewed by approved personnel)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Public Data (3.3)

A

Has no impact on the company if released and is often posted in an open-source environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Restricted Data (3.3)

A

Proprietary data including trade secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Private Data (3.3)

A

Contains data that should only be used within the organization (e.g. personnel records, salaries. etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Critical Data (3.3)

A

Contains valuable data (e.g. credit card #’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data Classifications (Government) (3.3)

A

Unclassified
Sensitive but Unclassified
Confidential
Secret
Top Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Unclassified data (3.3)

A

Data that can be released to the public or under the Freedom of Information Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Sensitive but Unclassified (3.3)

A

Data that would not hurt national security if released but could impact those whose data was being used (e.g. medical records)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Confidential Data (3.3)

A

Data that could seriously affect the government if unauthorized disclosures happen

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Secret Data (3.3)

A

Data that could seriously damage national security if disclosed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Top Secret (3.3)

A

Data that would gravely damage national security if disclosed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data at Rest (3.3)

A

Refers to any data stored in databases, file systems, or other storage systems (prime target for threat actors)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Methods to secure data at rest (3.3)

A

Full disk encryption- Encrypts entire hard drive
Partition encryption- Encrypts specific partition of drive
File encryption- Encrypts individual files
Volume encryption- Encrypts a set of selected files/directories
Database encryption- Encrypts data stored in database (table, row, column)
Record encryption- Encrypts specific record in database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data in Transit/Data in Motion (3.3)

A

Data that is actively moving from one location to another, such as across the Internet or through a private network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Methods to secure data in transit/motion (3.3)

A

SSL (Secure Socket Layer) and TLS (Transport Layer Security)
VPNs (Virtual Private Networks)
IPSec (Internet Protocal Security)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SSL/TLS (3.3)

A

Secure Socket Layer/Transport Layer Security
Cryptographic protocols designed to provide secure communication over a computer network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

VPN (3.3)

A

Virtual Private Network
Technology that creates a secure connection over a less secure network (e.g. over the Internet)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

IPSec (3.3)

A

Internet Protocal Security
Protocol suite used to secure IP communications by authenticating and encrypting each IP packet in a data stream

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data in Use (3.3)

A

Data that is in the process of being created, retrieved, updated, or deleted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Methods of securing data in use (3.3)

A

Encryption at application level
Access controls
Secure Enclave (dedicated secure subsystem integrated into Apple System on Chip- SoC)
Intel software guard (encrypts data in memory)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Data Types (3.3)

A

Regulated Data
Trade Secrets
Intellectual Property
Legal Information
Financial Information
Human Readable vs Non-Human Readable Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Regulated Data (3.3)

A

Information controlled by laws, regulations, or industry standards (e.g. GDPR- General Data Protection Regulation, HIPAA- Health Insurance Portability and Accountability Act)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Trade Secrets (3.3)

A

Type of confidential business information that provides a company with a competitive edge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Intellectual Property (IP) (3.3)

A

Creations of the mind, such as inventions, literary and artistic works, designs, and symbols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Legal Information (3.3)

A

Includes and data related to legal proceedings, contracts, or regulatory compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Financial Information (3.3)

A

Data that is related to an organizations financial transactions, such as sales records, invoices, tax documents, and bank statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Human Readable and Non-Human Readable Data (3.3)

A

Information that a human can read and information a human cannot read (e.g. encrypted, ciphertext, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Data Sovereignty (3.3)

A

The concept that digital information is subject to the laws of the country in which it is stored, collected, or processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Data Geolocation Considerations (3.3)

A

If data is stored in another county the organization must abide by those laws (e.g. Europe’s GDPR has strict laws granting individuals rights over their personal data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Methods for Securing Data- General (3.3)

A

Geographic restrictions
Encryption
Hashing
Masking
Tokenization
Obfuscation
Segmentation
Permission restrictions / Access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Geographic restrictions (Securing Data) (3.3)

A

Involves setting up virtual boundaries to restrict data access based on geographic location (geofencing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Encryption (Securing Data) (3.3)

A

Fundamental data security method that transforms readable data (plaintext) into unreadable data (ciphertext) using an algorithm and an encryption key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Hashing (Securing Data) (3.3)

A

Technique that convert data into a fixed size of numerical or alphanumeric characters, known as a hash value or hash digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Masking (Securing Data) (3.3)

A

Involves replacing some or all of the data in a field with a placeholder, such as “x” to conceal original content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Tokenization (Securing Data) (3.3)

A

Replaces sensitive data with non-sensitive substitutes, known as tokens (e.g. payment processing to protect credit card information)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Obfuscation (Securing Data) (3.3)

A

Involves making data unclear or unintelligible, making it difficult for unauthorized users to understand (e.g. encryption, masking, pseudonyms)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Segmentation (Securing Data) (3.3)

A

Involves dividing a network into separate segments, each with its own security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Permission Restrictions (Securing Data) (3.3)

A

Involves defining who has access to specific data and what they can do with it (e.g. RBAC- Role Based Access Control)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

High Availability (3.4)

A

The ability of a service to be continuously available by minimizing the downtime to the lowest amount possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Uptime (3.4)

A

The number of minutes or hours that the system remains online over a given period, and the uptime is usually expressed as a percentage (9’s of availability, e.g. 99.999% = five nines)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Load Balancing (3.4)

A

The process of distributing workloads across multiple computing resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Clustering (3.4)

A

The use of multiple computers, multiple storage devices, and redundant network connections that all work together as a single system to provide high levels of availability, reliability, and scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Redundancy (3.4)

A

The duplication of critical components or functions of a system with the intention of increasing the reliability of the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

RAID 0 (3.4)

A

Provides data striping across multiple disks to increase performance; used for performance as opposed to data protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

RAID 1 (3.4)

A

Mirrors data for redundancy across two drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

RAID 5 (3.4)

A

Stripes data with parity, using at least three storage devices (can lose 1 disk w/o data loss)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

RAID 6 (3.4)

A

Uses data striping across multiple devices with two pieces of parity data (can lose 2 disks w/o data loss)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

RAID 10 (3.4)

A

Combines RAID 1 and RAID 0 featuring mirrored array in a striped setup (can lose 1 disk per mirrored array)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Failure-Resistant (3.4)

A

Use of redundant storage to withstand hardware malfunctions (RAID 1 or RAID 10)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Fault-Tolerant (3.4)

A

Use of RAID 1, 5, 6, and 10 for uninterrupted operation during hardware failures (no downtime)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Disaster-Tolerant (3.4)

A

Protects data from catastrophic events (RAID 1 and RAID 10 due to having full mirrors)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Capacity Planning (3.4)

A

Crucial strategic planning to meet future demands cost-effectively

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

People (Capacity Planning) (3.4)

A

Involves analyzing current skills and forecasting future needs for hiring or training (e.g. seasonal positions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Technology (Capacity Planning) (3.4)

A

Involves assessing current resources, utilization, and anticipating future technological needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Infrastructure (Capacity planning) (3.4)

A

Involves considering physical space and utilities to support organizational operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Process (Capacity Planning) (3.4)

A

Aims to optimize business processes to handle demand fluctuations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Surge (Power) (3.4)

A

A small and unexpected increase in the amount of voltage that is being provided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Spike (Power) (3.4)

A

A short transient voltage that is usually caused by a short circuit, a tripped circuit breaker, a power outage, or a lightning strike

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Sag (Power) (3.4)

A

A small and unexpected decrease in the amount of voltage that is being provided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Undervoltage Event (Power) (3.4)

A

Occurs when the voltage is reduced to lower levels and usually occur for a longer period of time than a sag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Power Loss Event (3.4)

A

Occurs when there is a total loss of power for a given period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Line Conditioner (3.4)

A

Used to overcome any minor fluctuations in the power being received by the given system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

UPS (3.4)

A

Uninterruptible Power Supply- A device that provides emergency power to a system when the normal input power source has failed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

PDC (3.4)

A

Power Distribution Center- Acts as a central hub where power is received and then distributed to all systems in the data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Data Backup (3.4)

A

The process of creating duplicate copies of digital information to protect against data loss, corruption, or unavailability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Data Backup considerations (3.4)

A

Onsite / Offsite
Frequency
Encryption
Snapshots
Recovery
Replication
Journaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Frequency (Data Backup) (3.4)

A

How much data are you willing to lose?
How frequently does the data change?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Encryption (Data Backup) (3.4)

A

Data-at-rest encryption as well as data-in-transit encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Snapshots (3.4)

A

Point-in-time copies of the data that capture a consistent state that is essentially a frozen in time copy of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Journaling (3.4)

A

Maintaining a meticulous record of every change made to an organizations data over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Data Recovery Process (3.4)

A

Selection of the backup
Initiating the recovery process
Data validation
Testing and validation
Documentation and reporting
Notification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Continuity of Operations Plan (3.4)

A

Ensures an organizations ability to recover from disruptive events or disasters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

BCP (3.4)

A

Business Continuity Plan- Addresses responses to disruptive events; 2 parts
1. BCP (Deals w/ incidents)
2. DRP (Deals w/ disasters)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

DRP (3.4)

A

Disaster Recovery Plan- Considered as a subset of the BCP, it focuses on how to resume operations swiftly after a disaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Site Considerations (3.4)

A

Hot Site- Fully equipped backup facility
Warm Site- Partially equipped, operational w/i days
Cold Site- No immediate equipment
Mobile Site- Can be hot, warm, or cold; independent mobile site; self sufficient
Virtual Site- Utilizes cloud-based environments and is highly flexible; hot, warm, and cold
Hybrid Model- Critical staff=hot, the rest=warm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Platform Diversity (3.4)

A

A vital aspect in redundant site design that uses different platforms to prevent single points of failure in disaster recovery (e.g. cloud provider platform diversity = spreading resources across multiple cloud providers reducing the risk of a single platform outage)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Recovery Testing (3.4)

A

Evaluates the systems ability to return to regular functioning following a disruptive incident; Tests efficiency to recover from multiple failure points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Tabletop Exercise (3.4)

A

A simulated discussion to improve crisis readiness without deploying resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Failover Test (3.4)

A

Verifies seamless system transition to a backup for uninterrupted functionality during disasters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Simulation (3.4)

A

Computer-generated representations of real-world scenarios

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Resilience Testing (3.4)

A

Assesses the systems capacity to endure and adjust to disruptive occurrences; Tests ability to handle multiple failure scenarios

84
Q

Parallel Processing (3.4)

A

Replicates data and processes onto a secondary system, running both in parallel

85
Q

Cloud Computing (3.1)

A

Offering computing services over the Internet, such as..
Servers
Storage
Databases
Networking
Software Analytics
Intelligence

86
Q

Responsibility Matrix (3.1)

A

Outlines the division of responsibilities between the cloud service provider and the customer

87
Q

Third-Party Vendors (3.1)

A

Provide specialized services that enhance the functionality, security, and efficiency of cloud solutions

88
Q

Hybrid Solutions (3.1)

A

Combine on-premise infrastructure, private cloud services, and public cloud services

89
Q

On-Premise Solutions (3.1)

A

Computing infrastructure that’s physically located on-site at a business

90
Q

Shared Physical Server Vulnerabilities (3.1)

A

Can lead to vulnerabilities if one users data is compromised

91
Q

Virtualization (3.1)

A

Technology that allows for the emulation of servers

92
Q

Containerization (3.1)

A

Lightweight alternative to full machine virtualization; Entails encapsulating an application in a container within its own operating environment (e.g. Docker, Kubernetes, Red Hat OpenShift)

93
Q

Type 1 Hypervisor (3.1)

A

aka bare metal or native hypervisor; runs directly on the host hardware and functions similarly to an operating system (e.g. Hyper-V, XenServer, ESXi, VSphere); Generally faster and more efficient than a type 2 hypervisor

94
Q

Type 2 Hypervisor (3.1)

A

Operates within a standard operating system, such as Windows, Mac, or Linux (e.g. Virtualbox)

95
Q

Virtual Machine Escape (3.1)

A

Occurs when an attacker is able to break out of a normally isolated virtual machine

96
Q

Privilege Elevation (3.1)

A

Occurs when a user is able to gain the ability to run functions as a higher level user

97
Q

Live Migration of Virtual Machines (3.1)

A

When a virtual machine needs to move from one physical host to another

98
Q

Resource Reuse (3.1)

A

Concept in computing where system resources like memory or processing power are reused

99
Q

Serverless Computing (3.1)

A

Model where the responsibility of managing servers, databases, and some application logic is shifted away from developers (AWS Lambda, Google Cloud Functions)

100
Q

Vendor Lock-in (3.1)

A

One of the most significant risks of serverless computing; it is difficult to switch service providers

101
Q

Microservices (3.1)

A

A software architecture where large applications are broken down into smaller and independent services (e.g. Netflix has microservices which handle recommendations, user signups, video encoding, etc.)

102
Q

Microservices Advantages (3.1)

A

Scalability- Each service can be scaled individually based on demand
Flexibility- Each can be run in different programming languages and managed by different teams
Resilience- If one service fails it does not affect the entire system
Faster deployment/Updates- Each can be deployed and updated independently

103
Q

Microservices Disadvantages (3.1)

A

Complexity
Data Management
Network Latency
Security

104
Q

Physical Separation / Air Gapping (3.1)

A

Isolation of a network by removing any direct or indirect connections from other networks

105
Q

Logical Separation (3.1)

A

Creates boundaries within a network, restricting access to certain areas (e.g. VLANs); not as secure as air gapping but is more flexible

106
Q

SDN (3.1)

A

Software defined network; Enables efficient network configuration to improve performance and monitoring

107
Q

Data Plane (SDN) (3.1)

A

aka Forwarding Plane; Responsible for handling packets and makes decisions based on protocols (when sending an email the data plane carries that email from one device to the other)

108
Q

Control Plane (SDN) (3.1)

A

The brain of the network that decides where traffic is sent and is centralized in SDN (dictates traffic flow)

109
Q

Application Plane (SDN) (3.1)

A

The plane where all network applications interacting with the SDN controller reside

110
Q

IaC (3.1)

A

Infrastructure as Code; a method in which IT infrastructures are defined in code files that can be versioned, tested, and audited; uses YAML, JSON, or HashiCorp Configuration Language (HCL)

111
Q

Snowflake System (3.1)

A

A configuration that lacks consistency and might introduce risks, so it has to be eliminated

112
Q

Idempotence (3.1)

A

Fundamental to IaC; the ability of an operation to produce the same results as many times as it is executed

113
Q

IaC Advantages (3.1)

A

Speed and Efficiency
Consistency and Standardization
Scalability
Cost Savings
Auditability and Compliance

114
Q

IaC Disadvantages (3.1)

A

Learning Curve
Complexity
Security Risks

115
Q

Centralized Architecture (3.1)

A

All the computing functions are coordinated and managed from a single location or authority

116
Q

Centralized Architecture Advantages (3.1)

A

Efficiency and control
Consistency
Cost Effectiveness

117
Q

Centralized Architecture Disadvantages (3.1)

A

Single point of failure
Scalability Issues
Security Risks

118
Q

Decentralized Architecture (3.1)

A

Computing functions are distributed across multiple systems or locations

119
Q

Decentralized Architecture Advantages (3.1)

A

Resiliency
Scalability
Flexibility

120
Q

Decentralized Architecture Disadvantages (3.1)

A

Security Risks
Management Challenges
Data Inconsistency

121
Q

IoT (3.1)

A

Internet of Things; Refers to the network of physical items with embedded systems that enables connection and data exchange

122
Q

Hub (IoT) (3.1)

A

The central point connecting all IoT devices and sends commands to them

123
Q

Smart Devices (3.1)

A

Everyday objects enhanced with computing capabilities and Internet connectivity

124
Q

Wearables (3.1)

A

Subset of smart devices designed to be worn on the body

125
Q

Sensors (3.1)

A

Detect changes in the environment and transform them into analyzable data

126
Q

IoT Disadvantages (3.1)

A

Weak Defaults
Poorly configured network services

127
Q

ICS (3.1)

A

Industrial Control Systems- Control systems used to monitor and control industrial processes ranging from simple systems to complex systems

128
Q

SCADA (3.1)

A

Supervisory Control and Data Acquisition- A type of ICS used to monitor and control geographically dispersed industrial processes

129
Q

DCS (3.1)

A

Distributed Control Systems- Used to control production systems within a single location

130
Q

PLC (3.1)

A

Programmable Logic Controllers- Used to control specific processes such as assembly lines

131
Q

Embedded System (3.1)

A

Specialized computing component designed to perform dedicated functions within a larger structure

132
Q

RTOS (3.1)

A

Real-Time Operating System- Ensures data processing in real-time and is crucial for time-sensitive applications

133
Q

Securing embedded systems (4 key strategies) (3.1)

A

Network Segmentation
Wrappers
Firmware Code Control
Inability to Patch

134
Q

Network Segmentation (Securing embedded systems) (3.1)

A

Divides a network into multiple segments or subnets, limiting potential damage in case of a breach

135
Q

Wrappers (Securing embedded systems) (3.1)

A

Show only the entry and exit points of the data when travelling between networks (IPSec)

136
Q

Firmware Code Control (Securing embedded systems) (3.1)

A

This can be achieved through secure coding practices, code reviews, and automated testing

137
Q

Inability to Patch (Securing embedded systems) (3.1)

A

Strategies like over-the-air (OTA) updates, where patches are delivered and installed remotely, can be applied

138
Q

Firewall (3.2)

A

Safeguards networks by monitoring and controlling traffic based on predefined security rules

139
Q

Screened Subnet

A

aka Dual-Homed Host; Acts as a security barrier between external untrusted networks and internal trusted networks, using a protected host with security measures like a packet-filtering firewall

140
Q

Packet Filtering Firewall (3.2)

A

aka Layer 4 Firewall; Checks packet headers for traffic allowance based on IP addresses and port numbers; most efficient but least secure

141
Q

Stateful Furewall (3.2)

A

Monitors all inbound and outbound network connections and requests

142
Q

Proxy Firewall (3.2)

A

Acts as an intermediary between internal and external connections, making connections on behalf of other endpoints

143
Q

Circuit Level Proxy Firewall (3.2)

A

Operates at the layer 5 of the OSI model (e.g. SOCKS firewall)

144
Q

Application Level Proxy Firewall (3.2)

A

aka Layer 7 Firewall; Conducts various proxy functions for each type of application at the layer 7 of the OSI model

145
Q

Kernel Proxy Firewall (3.2)

A

aka 5th Generation Firewall; Has minimal impact on network performance while thoroughly inspecting packets across all layers

146
Q

NGFW (3.2)

A

Next-Generation Firewall; Aims to address the limitations of traditional firewalls by being more aware of applications and their behaviors
1. Conducts deep packet inspection for traffic
2. Operates fast with minimal network performance
3. Offers full-stack traffic visibility
4. Integrates with various security products

147
Q

UTM (3.2)

A

Unified Threat Management Firewall; Provides the ability to conduct multiple security functions in a single appliance…
1. Network firewalls
2. Network intrusion prevention systems
3. Gateway antivirus and antispam
4. Virtual private network concentration
5. Content filtering
6. Load Balancing
7. Data loss prevention

148
Q

UTM Disadvantage (3.2)

A
  1. Single point of failure
  2. Lacks the breadth of tools offered by more specialized equipment
  3. Sometimes they are less efficient than specialized tools
149
Q

UTM Advantages (3.2)

A
  1. Lower upfront costs, maintenance, and power consumption
  2. Simplified installation and configuration
  3. Full integration with multiple benefits
150
Q

WAF (3.2)

A

Web Application Firewall; Focuses on the inspection of the HTTP traffic
1. Inline Configuration- Device sits between the network firewall and the web servers
2. Out-of-Band Configuration- Device receives a mirrored copy of web server traffic

151
Q

IDS (3.2)

A

Intrusion Detection System- Responsible for detecting unauthorized network access or attacks; detects, reports, logs, and/or alerts; Provides passive detection; Types:
1. NIDS- Network Intrusion Detection System
2. HIDS- Host Intrusion Detection System
3. WIDS- Wireless Intrusion Detection System

152
Q

IPS (3.2)

A

Intrusion Prevention System- Scans traffic to look for malicious activity and takes action to stop it; installed right behind firewall on edge of network so it can block traffic when needed; provides active protection

153
Q

NIDS (3.2)

A

Network Intrusion Detection Systems- Monitors the traffic coming in and out of a network; Installed on a mirrored port off backbone switch so it can analyze all traffic

154
Q

HIDS (3.2)

A

Host-based Intrusion Detection System- Looks at suspicious network traffic going to or from a single server or endpoint

155
Q

WIDS (3.2)

A

Wireless-based Intrusion Detection System- Detects attempts to cause a denial of service attack on a wireless network

156
Q

Signature-based IDS (3.2)

A

Signature-based Intrusion Detection System- Analyzes traffic based on defined signatures and can only recognize attacks based on previously identified attacks in its database

157
Q

Pattern-Matching (Signature-based Intrusion Detection System) (3.2)

A

Looks for a specific pattern of steps; Common in NIDS and WIDS

158
Q

Stateful-Matching (Signature-based Intrusion Detection System) (3.2)

A

Compares against a known system baseline; Common in HIDS

159
Q

Anomaly-Based IDS (3.2)

A

Anomaly-Based Intrusion Detection System (aka Behavioral-Based)- Analyzes traffic and compares it to a normal baseline of traffic to determine whether a threat is occurring

160
Q

Anomaly-Based IDS Types (3.2)

A

Statistical
Protocol
Traffic
Rule / Heuristic
Application-Based

161
Q

HIPS / WIPS (3.2)

A

Work the same way as HIDS / WIDS but also responds to threat as opposed to just detecting it

162
Q

Network Appliance (3.2)

A

Dedicated hardware device with pre-installed software that is designed to provide specific networking services

163
Q

Load Balancer (3.2)

A

Crucial component in any high-availability network or system that is designed to distribute network or application traffic across multiple servers

164
Q

ADC (3.2)

A

Application Delivery Controller- Special type of load balancer which provides additional services such as:
SSL Termination
HTTP Compression
Content Caching

165
Q

Proxy Server (3.2)

A

Intermediary between a client and a server to provide various functions like content caching, request filtering, and login management

166
Q

Network Sensor (3.2)

A

Designed to monitor, detect, and analyze traffic and data flow across a network in order to identify any unusual activities, potential security breaches, or performance issues

167
Q

Jump Server / Jump Box (3.2)

A

Dedicated gateway used by system administrators to securely access devices located in different security zones within the network; they restrict direct access to protected devices or servers

168
Q

Port Security (3.2)

A

Common security feature found on network switches that allows administrators to restrict which devices can connect to a specific port based on the network interface cards MAC address

169
Q

CAM Table (3.2)

A

Content Addressable Memory Table- Used to store information about the MAC addresses that are available on any given port of the switch

170
Q

Persistent MAC Learning (3.2)

A

aka Sticky MAC- Feature in network port security where the switch automatically learns and associates MAC addresses with specific interfaces

171
Q

802.1x Protocol (3.2)

A

Standardized framework that is used for port-based authentication for both wired and wireless networks; uses RADIUS or TACACS+

172
Q

EAP (3.2)

A

Extensible Authentication Protocol (it is a framework)

173
Q

EAP-MD5 (3.2)

A

Variant of EAP that utilizes simple passwords and the challenge handshake authentication process to provide remote access authentication

174
Q

EAP-TLS (3.2)

A

Form of EAP that uses public key infrastructure with a digital certificate being installed on both the client and the server as the method of authentication

175
Q

EAP-TTLS (3.2)

A

Variant of EAP that requires a digital certificate on the server, but not on the client

176
Q

EAP-FAST (3.2)

A

FAST = Flexible Authentication via Secure Tunneling; Variant of EAP that uses a protected access credential, instead of a certificate, to establish mutual authentication between devices

177
Q

PEAP (3.2)

A

Protected EAP- Variant of EAP that supports mutual authentication by using server certificates and the Microsoft Active Directory databases for it to authenticate a password from the client

178
Q

LEAP (3.2)

A

Variant of EAP that only works on Cisco-based devices

179
Q

VPN (3.2)

A

Virtual Private Network- Extends a private network over a public one, enabling users to securely send and receive data

180
Q

Site-to-site VPN (3.2)

A

Establishes secure tunnels over the public Internet for interconnecting remote sites; secure but slows transmission speeds since data is detoured through VPN

181
Q

Client-to-Site VPN (3.2)

A

Connects individual devices directly to the organizations headquarters, enabling remote users to access the network

182
Q

Full Tunnel VPN (3.2)

A

Maximizes security by encrypting all traffic to the headquarters while integrating clients with the network; more secure than split tunnel but slower speeds

183
Q

Split Tunnel VPN (3.2)

A

Divides traffic and network requests and then routes them to the appropriate network; Only VPN traffic goes over the VPN; less secure than full tunnel but faster since not all traffic is going over the VPN

184
Q

Clientless VPN (3.2)

A

Secures remote access through browser-based VPN tunnels without needing client software or hardware configuration

185
Q

TLS (3.2)

A

Transport Layer Security- A protocol that provides cryptographic security for secure connections and is used for secure web browsing and data transfer

186
Q

TCP (3.2)

A

Transmission Control Protocol- Used by TLS to establish secure connections between a client and a server, but it may slow down the connection

187
Q

DTLS (3.2)

A

Datagram Transport Layer Security- A UDP-based version of TLS protocol that offers the same security level as TLS while maintaining faster operations

188
Q

IPSec (3.2)

A

A protocol suite for secure communication through authentication and data encryption in IP networks; most popular for VPNs because it provides:
Confidentiality
Integrity
Authentication
Anti-Replay

189
Q

IKE (3.2)

A

Internet Key Exchange

190
Q

VPN Connection Creation Steps (3.2)

A
  1. Request to start Internet Key Exchange
    -PC1 initiates traffic to PC2, triggering IPSec tunnel creation by router 1
  2. IKE Phase 1
    -Routers 1 and 2 negotiate security associations for the IPSec IKE Phase 1 tunnel, aka ISAKMP
  3. IKE Phase 2
    -Establishes a tunnel within the tunnel
  4. Data transfer
    -Data transfer between PCs 1 and 2 takes place securely
  5. Tunnel termination
    -Tunnel termination, including the deletion of IPSec security associations
191
Q

Transport Mode (IPSec) (3.2)

A

Employs the original IP header, ideal for client-to-site VPNs, and is advantageous when dealing with MTU constraints

192
Q

Tunnel Mode (IPSec) (3.2)

A

Employed for site-to-site VPNs and adds an extra header that can increase packet size and exceed the MTU

193
Q

MTU (3.2)

A

Maximum Transmission Unit- Set only at 1500 bytes and may cause fragmentation an VPN problems

194
Q

AH (3.2)

A

Authentication Header- Offers connectionless data integrity and data origin authentication for IP datagrams using cryptographic hash as identification information

195
Q

ESP (3.2)

A

Encapsulating Security Payload- Employed for providing authentication, integrity, replay protection, and data confidentiality by encrypting the packets payload

196
Q

SD-WAN (3.2)

A

Virtualized approach to managing and optimizing wide area network connections to efficiently route traffic between remote sites, data centers, and cloud environments

197
Q

SASE (3.2)

A

Secure Access Service Edge- Used to consolidate numerous networking and security functions into a single cloud-native service to ensure that secure and access for end-users can be achieved

198
Q

Security Zone (3.2)

A

Distinct segment within a network, often created by logically isolating the segment using a firewall or other security device

199
Q

Screened Subnet (3.2)

A

Used to be referred to as De-Militarized Zone or DMZ- Hosts public facing services such as web servers, email servers, and DNS servers and safeguards against security breaches by preventing attackers from gaining direct access to the sensitive core internal network

200
Q

Attack Surface of a Network (3.2)

A

Refers to all the points where an unauthorized user can try to enter data to or extract data from an environment

201
Q

Connectivity (3.2)

A

Refers to hw different components of a network communicate with each other and with other external networks

202
Q

Control (3.2)

A

A protective measure put in place to reduce potential risks and safeguard an organizations assets

203
Q

Least Privilege (3.2)

A

Users or systems are granted only the necessary access rights to perform their duties, reducing the attack surface

204
Q

Defense in depth (3.2)

A

Emphasizes the use of multiple layers of security to mitigate threats even if one control fails

205
Q

Risk-Based Approach (3.2)

A

Prioritizing controls based on potential risks and vulnerabilities specific to the infrastructure to make efficient use of resources

206
Q

Lifecycle Management (3.2)

A

Regularly reviewing, updating, and retiring controls to adapt to evolving threat landscapes

207
Q

Open Design Principle (3.2)

A

Ensuring transparency and accountability through rigorous testing and scrutiny of infrastructure and controls

Security+ (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions