Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > SY0-701: 4.0 (Security Operations) > Flashcards

SY0-701: 4.0 (Security Operations) Flashcards

1
Q

DLP (4.4)

A

Data Loss Prevention- Set up to monitor the data of a system while it’s in use, in transit, or at rest in order to detect any attempts to steal the data (hardware or software)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Endpoint DLP Systems (4.4)

A

a piece of software that’s installed on a workstation or a laptop that monitors the data that’s in use on that computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Network DLP System (4.4)

A

A piece of software or hardware placed at the perimeter of the network to detect data in transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Storage DLP System (4.4)

A

Software installed on a server which inspects the data while it’s at rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Cloud-Based DLP System (4.4)

A

Usually offered as Software as a Service (SaaS) and it’s part of the cloud service and storage system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Acquisition / Procurement (4.2)

A

Acquisition- Process of obtaining goods or services
Procurement- Encompasses the full process of acquiring goods and services, including all preceding steps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

BYOD (4.1)

A

Bring Your Own Device- Permits employees to use personal devices for work
-Employees have control over device security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

COPE (4.1)

A

Corporate-Owned, Personally Enabled- Involves the company providing a mobile device to employees for both work and personal use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

CYOD (4.1)

A

Choose Your Own Device- Offers a middle ground between BYOD and COPE by allowing employees to choose devices from a company-approved list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Asset Management (4.2)

A

Refers to the systematic approach to governing and maximizing the value of items an entity is responsible for throughout their lifecycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Assignment / Allocation of Assets (4.2)

A

Every organization should designate individuals or groups as owners of the assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Asset Classification (4.2)

A

Involves categorizing assets based on criteria like function, value, or other relevant parameters as determined by the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Asset Monitoring (4.2)

A

Maintaining an inventory/record of every asset including specifications, location, assigned users, and other relevant details

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Asset Tracking (4.2)

A

Takes asset monitoring a bit further; Involves maintaining a comprehensive inventory with asset specifications, locations, and assigned users, along with its condition and status using specialized software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Asset Enumeration (4.2)

A

Involves identifying and counting assets, especially in large organizations or during times of asset procurement or retirement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

MDM (4.2)

A

Mobile Device Management- Lets organizations securely oversee employee devices, ensuring policy enforcement, software consistency, and data protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Special Publication 800-88 (4.2)

A

Guidelines for media sanitization- Guidance on media sanitization, destruction, and certification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Media Sanitization (4.2)

A

Thorough process of making data inaccessible and irretrievable from a storage medium using traditional forensic methods
-Overwriting data
-Degaussing
-Encryption Techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CE (Media Sanitization) (4.2)

A

Cryptographic Erase- Faster than deleting data because the cryptographic keys are what gets erased

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Media Destruction (4.2)

A

Ensures the physical device itself is beyond recovery or reuse
-Shredding
-Pulverizing
-Melting
-Incinerating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Certification (Media Sanitization) (4.2)

A

An act of proof that the data or hardware has been securely disposed of

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Port (4.5)

A

Logical communication endpoint that exists on a computer or server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Inbound Port (4.5)

A

Logical communication opening on a server that is listening for a connection from a client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Outbound Port (4.5)

A

Logical communication opening created on a client in order to call out to a server that is listening for a connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Well-Known Ports (4.5)

A

Ports 0 to 1023 are considered well-known and are assigned by the Internet Assigned Numbers Authority (IANA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Registered Ports (4.5)

A

Ports 1024 to 49,151 are considered registered and are usually assigned to proprietary protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Dynamic and Private Ports (4.5)

A

Port 49,152 to 65,535 can be used by any application without being registered with IANA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Protocol (4.5)

A

Rules governing device communication and data exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Port 21 (4.5)

A

Over TCP
FTP: File Transfer Protocol
Used to transfer files from host to host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Port 22 (4.5)

A

Over TCP
SSH: Secure Shell
SCP: Secure Copy Protocol
SFTP: Secure File Transfer Protocol
Provides secure remote terminal access as well as file transfer capabilities (SSH)
Provides secure copy functions (SCP)
Provides secure file transfers (SFTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Port 23 (4.5)

A

Over TCP
Telnet
Provides insecure remote control of another machine using a text-based environment; older version of SSH, unencrypted and therefore unsecure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Port 25 (4.5)

A

Over TCP
SMTP: Simple Mail Transfer Protocol
Provides the ability to send emails over the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Port 53 (4.5)

A

Over TCP and UDP
DNS: Domain Name Server
Translates domain names into IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Port 69 (4.5)

A

Over UDP
TFTP: Trivial File Transfer Protocol
Used as a lightweight file transfer method for sending configuration files or network booting of an operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Port 80 (4.5)

A

Over TCP
HTTP: Hyper-Text Transfer Protocol
Used for unsecured web browsing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Port 88 (4.5)

A

Over UDP
Kerberos
Network authentication protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Port 110 (4.5)

A

Over TCP
POP3: Post Office Protocol version 3
Responsible for retrieving email from a server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Port 119 (4.5)

A

Over TCP
NNTP: Network News Transfer Protocol
Used for accessing newsgroups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Port 135 (4.5)

A

Over TCP and UDP
RPC: Remote Procedure Call
Facilitates communication between different system processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Ports 137, 138, and 139 (4.5)

A

Over TCP and UDP
NetBIOS
Networking protocol suite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Port 143 (4.5)

A

Over TCP
IMAP: Internet Message Access Protocol
Allows access to email messages on a server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Port 161 (4.5)

A

Over UDP
SNMP: Simple Network Management Protocol
Manages network devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Port 162 (4.5)

A

Over UDP
SNMP Trap
Responsible for sending SNMP trap messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Port 389 (4.5)

A

Over TCP
LDAP: Lightweight Directory Access Protocol
Facilitates directory services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Port 443 (4.5)

A

Over TCP
HTTPS: Hyper-Text Transfer Protocol Secure
Provides secure web communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Port 445 (4.5)

A

Over TCP
SMB: Server Message Block
Used for file and printer sharing over a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Ports 465 and 587 (4.5)

A

Over TCP
SMTPS: Simple Mail Transfer Protocol Secure
Provides secure SMTP communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Port 514 (4.5)

A

Over UDP
Syslog
Used for sending log messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Port 636 (4.5)

A

Over TCP
LDAPS: Lightweight Directory Access Protocol Secure
LDAP communication over SSL/TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Port 993 (4.5)

A

Over TCP
IMAPS: Internet Message Access Protocol Secure
Used for secure email retrieval over SSL/TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Port 995 (4.5)

A

Over TCP
POP3S: Post Office Protocol Secure
Used for secure email retrieval over SSL/TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Port 1433 (4.5)

A

Over TCP
Microsoft SQL
Used to facilitate communication with Microsoft SQL Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Ports 1645 and 1646 (4.5)

A

Over TCP
RADIUS TCP
Used for remote authentication, authorization, and accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Ports 1812 and 1813 (4.5)

A

Over UDP
RADIUS UDP
Used for authentication and accounting as defined by the Internet Engineering Task Force (IETF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Port 3389 (4.5)

A

Over TCP
RDP: Remote Desktop Protocol
Enables remote desktop access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Port 6514 (4.5)

A

Over TCP
Syslog TLS
Used in a secure syslog that uses SSL/TLS to encrypt the IP packets using a certificate before sending them across the IP network to the syslog collector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

ACL (4.5)

A

Access Control List- A rule set that is placed on firewalls, routers, and other network infrastructure devices that permit or allow traffic through a particular interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

IAM (4.6)

A

Identity and Access Management- Systems and processes used to manage access to information in an organization to ensure that the right individuals have access to the right resources at the right times for the right reasons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Identification (4.6)

A

Process where a user claims an identity to a system, typically using a unique identifier like a username or an email address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Authentication (4.6)

A

Process of verifying the identity of a user, device, or system and this involves validating the credentials provided by the user against a database of authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Authorization (4.6)

A

Process that determines what permissions or levels of access the user has

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Accounting (4.6)

A

Process of tracking and recording user activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

IAM 4 Steps (4.6)

A

Identification
Authentication
Authorization
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Provisioning (4.6)

A

Process of creating new user accounts, assigning them appropriate permissions, and providing users with access to systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Identity Proofing (4.6)

A

Process of verifying the identity of a user before the account is created

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Interoperability (4.6)

A

The ability of different systems, devices, and applications to work together and share information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Attestation (4.6)

A

Process of validating that user accounts and access rights are correct and up-to-date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

MFA (4.6)

A

Multi-Factor Authentication- Security system that requires more than one method of authentication from independent categories of credentials to verify the users identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Passkeys (4.6)

A

Users can create and access online accounts without needing to input a password; public key is stored on server and private key is stored on users device (therefore if server is compromised the attacker only gets the public key)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Password Security (4.6)

A

Measures the passwords ability to resist guessing and brute-force attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Password Policy Characteristics (4.6)

A

Length- should be 12-16 characters
Complexity- mix case, numbers and symbols
Reuse- using the same password for different accounts increases risk
Expiration- mandates regular password changes (no longer recommended because users are more likely to reuse passwords
Age- length of time password has been in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Password Managers (4.6)

A

Tools that store, generate, share, and autofill passwords to enhance security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Passwordless Authentication (4.6)

A

Provides improved security and a more user-friendly experience
-Biometrics
-Hardware tokens
-One-time passwords (OTP- e.g. code sent to phone or email)
-Magic links (email link automatically logs user into website)
-Passkeys (integrates with browser or operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

SSO (4.6)

A

Single Sign-On- Authentication process that allows a user to access multiple applications or websites by logging in only once with a single set of credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

IdP (4.6)

A

Identity Provider- System that creates, maintains, and manages identity information for principals while providing authentication services to relying applications within a federation or distributed network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Protocols used with single sign-on (SSO) (4.6)

A

LDAP/LDAPS- Lightweight Directory Access Protocol
OAuth- Open Authorization
SAML- Security Assertion Markup Language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

OAuth (4.6)

A

Open standard for token-based authentication and authorization that allows an individuals account information to be used by third-party services without exposing the users password (e.g. when you sign on a website using Google account)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

SAML (4.6)

A

Security Assertion Markup Language- A standard for logging users into applications based on their sessions in another context; allows services to separate from identity providers and removes the need for direct user authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Federation (4.6)

A

Process that allows for the linking of electronic identities and attributes to store information across multiple distinct identity management systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Federation Login Process (4.6)

A

Login Initiation
Redirection to an identity provider
Authenticating the user
Generation of an assertion
Returning to a service provider
Verification and access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

PAM (4.6)

A

Privileged Access Management- Solutions that helps organizations restrict and monitor privileged access within an IT environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

PAM key components (4.6)

A

Just-In-Time Permissions (JIT Permissions)
Password Vaulting
Temporal Accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

JIT Permissions (4.6)

A

Security model where administrative access is granted only when needed for a specific period

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Password Vaulting (4.6)

A

Technique used to store and manage passwords in a secure environment, such as in a digital vault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Temporal Accounts (4.6)

A

Used to provide time-limited access to resources, and they are automatically disabled or deleted after a certain period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

MAC (reference access) (4.6)

A

Mandatory Access Control- Employs security labels to authorize user access to specific resources; used in environments of high data security where users cant modify their own permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

DAC (4.6)

A

Discretionary Access Control- Resources owner determines which users can access each resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

RBAC (Role) (4.6)

A

Role-Based Access Control- Assigns users to roles and uses these roles to grant permissions to resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

RBAC (Rule) (4.6)

A

Rule-Based Access Control- Enables administrators to apply security policies to all users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

ABAC (4.6)

A

Attribute-Based Access Control- Uses object characteristics for access control decisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Resource Attributes (4.6)

A

File creation date, resource owner, file owner, and data sensitivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Time-of-day Restrictions (4.6)

A

Controls restrict resource access based on request times (e.g. don’t allow user logins during midnight hours)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Principle of Least Privilege (4.6)

A

A user should only have the minimum access rights needed to perform their job functions and tasks, and nothing additional or extra

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Permission/Authorization Creep (4.6)

A

Occurs when a user gains excessive rights during their career progression in the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

UAC (4.6)

A

User Access Control- A mechanism designed to ensure that actions requiring administrative rights are explicitly authorized by the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

DAC (SELinux) (4.5)

A

Discretionary Access Control- Each object has a list of entities that are allowed to access it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Context-Based Permission (4.5)

A

Permission schemes that are defined by various properties for a given file or process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Baselining (4.5)

A

Process of measuring changes in the network, hardware, or software environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Security Template (4.5)

A

A group of policies that can be loaded through one procedure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Group Policy Editors (4.5)

A

gpedit (Windows)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Group Policy (4.5)

A

Set of rules or policies that can be applied to a set of users or computer accounts within an operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

SELinux (4.5)

A

Security-Enhanced Linux- Set of controls (default context-based permission scheme) that are installed on top of another Linux distribution like CentOS or Red Hat Linux

defines 3 main contexts for each file and process
1. User- Defines what users can access an object(_u)
2. Role- Defines what roles can access a given object (_r)
3. Type- Groups objects together that have similar security requirements or characteristics
4. Level- Used to describe the sensitivity level of a given file, directory, or process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

SELinux User Types (4.5)

A

Unconfined_u (All Users)
User_u (Unprivileged users)
Sysadmin_u (System Administrators)
Root (Root User)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

SELinux Modes (4.5)

A

Disabled- SELinux is essentially turned off, and so MAC is not going to be implemented

Enforcing- All the SELinux security policies are being enforced

Permissive- SELinux is enabled but the security policies are not enforced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

SELinux Policy Types (4.5)

A

Targeted- Policies are enforced only for specified objects
Strict- Policies are enforced for every object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Secure Baseline (4.1)

A

Standard security configuration applied to guarantee minimum security for a system, network, or application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Secure Baseline Steps (4.1)

A

Establish- Set up a system including security and applications and then create image

Deploy- Apply baseline image to assets

Maintain- Ensure systems are locked down and continually install patches/updates etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

ESS (4.1)

A

Extended Service Set Configuration- Involves multiple wireless access points working together to create a unified and extended coverage area for users in a large building or facility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Optimal Wireless Channels for 2.4GHz Range (4.1)

A

Channels 1, 6, and 11 (When selected the listed channels won’t interfere with each other)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Site Survey (4.1)

A

Process of planning and designing a wireless network to provide a solution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Heat Map (4.1)

A

Graphical representation of the wireless coverage, the signal strength, and frequency utilization data at different locations on a map

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

WEP (4.1)

A

Wired Equivalency Protocol- Outdated 1999 wireless security standard meant to match wired LAN security for wireless networks

64-bit- 40 bits of key data with 24-bits of initialization vector
128-bit- 104 bits of key data with 24-bits of initialization vector

113
Q

WPA (4.1)

A

Wi-Fi Protected Access- Introduced in 2003 as a temporary improvement over WEP while the more robust IEEE 802.11i standard was in development

114
Q

WPA2 (4.1)

A

Wi-Fi Protected Access 2- Improved data protection and networks access control by addressing weaknesses in WPA version; replaced TKIP with the AES (Advanced Encryption Standard) protocol and adopted CCMP for stronger Encryption

115
Q

TKIP (4.1)

A

Temporal Key Integrity Protocol- Generates new 128-bit keys for each packet, eliminating WEPs key-reuse vulnerabilities

116
Q

WPA3 (4.1)

A

Wi-Fi Protected Access 3- Latest version using AES (Advanced Encryption Standard) encryption and introducing new features like SAE (Simultaneous Authentication of Equals), OWE (Enhanced Open/Opportunistic Wireless Encryption), updated cryptographic protocols, and management protection frames

117
Q

CCMP (4.1)

A

Counter Cipher Mode with Black Chaining Message Authentication Code Protocol

118
Q

AES (4.1)

A

Advanced Encryption Standard

119
Q

MIC (4.1)

A

Message Integrity Code

120
Q

SAE (4.1)

A

Simultaneous Authentication of Equals- Enhances security by offering a key establishment protocol to guard against offline dictionary attacks

121
Q

OWE (4.1)

A

Enhanced Open/Opportunistic Wireless Encryption- Major advancement in wireless security, especially for networks using open authentication

122
Q

Cryptographic Protocol (4.1)

A

Uses a newer variant of AES (Advanced Encryption Standard) known as the AES GCMP (Galois Counter Mode Protocol)

123
Q

GCMP (4.1)

A

Galois Counter Mode Protocol- Supports 128-bit AES (Advanced Encryption Standard) for personal networks and 192-bit AES for enterprise networks with WPA3

124
Q

Management Protection Frames (4.1)

A

Required to protect network from key recovery attacks; prevents eavesdropping, forging, and tampering

125
Q

AAA Protocol (4.1)

A

Authentication, Authorization, and Accounting Protocol- Plays a vital role in network security by centralizing user authentication to permit on authorized users to access network resources

126
Q

RADIUS (4.1)

A

Remote Authentication Dial-In User Service- Client/server protocol offering AAA (Authentication, Authorization, Accounting) services for network users

127
Q

TACACS+ (4.1)

A

Terminal Access Controller Access-Control System Plus- Separates the functions of AAA (Authentication, Authorization, Accounting) to allow for more granular control over processes

128
Q

Authentication Protocols (4.1)

A

Confirm user identity for network security and authorized access

  1. EAP- Extensible Authentication Protocol
  2. PEAP- Protected Extensible Authentication Protocol
  3. EAP-TTLS- Extensible Authentication Protocol-Tunneled Transport Layer Security
  4. EAP-FAST- Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling
129
Q

EAP (4.1)

A

Extensible Authentication Protocol- Authentication framework that supports multiple authentication methods

130
Q

PEAP (4.1)

A

Protected Extensible Authentication Protocol- Authentication protocol that secures EAP within an encrypted an authenticated TLS (Transport Layer Security) tunnel

131
Q

EAP-TTLS (4.1)

A

Extensible Authentication Protocol-Tunneled Transport Layer Security- Authentication protocol that extends TLS (Transport Layer Security) support across multiple platforms

132
Q

EAP-FAST (4.1)

A

Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling- Developed by Cisco, it enables secure re-authentication while roaming within a network without full authentication reach time

133
Q

Application Security (4.1)

A

Critical aspect of software development that focuses on building applications that are secure by design

134
Q

Application Security Areas (6) (4.1)

A

Input Validation
Secure Cookies
Static Code Analysis
Dynamic Code Analysis
Code Signing
Sandboxing

135
Q

Input Validation (4.1)

A

Acts as a gatekeeper to ensure that applications only act on well-defined and uncontaminated data

136
Q

Validation Rules (4.1)

A

Rules that delineate acceptable and unacceptable inputs

137
Q

SAST (4.1)

A

Static Application Security Testing (aka Static Code Analysis)- A method of debugging an application by reviewing and examining its source code before the program is ever run

138
Q

Manual Code Review (4.1)

A

Performing the code review using a human instead of a static analysis tool

139
Q

Dynamic Code Analysis (4.1)

A

Testing method that analyzes an application while it’s running

140
Q

Fuzzing (4.1)

A

aka Fuzz Testing- Finds software flaws by bombarding it with random data to trigger crashes and security vulnerabilities

141
Q

Stress Testing (4.1)

A

Type of software testing that evaluates the stability and reliability of a system under extreme conditions

142
Q

Code Signing (4.1)

A

Technique used to confirm the identity of the software author and guarantee that the code has not been altered or corrupted since it was signed

143
Q

Sandboxing (4.1)

A

Security mechanism that is used to isolate running programs by limiting the resources and the changes they can make to a system

144
Q

Persistent Agent (4.5)

A

Network access is granted using software installed on a device requesting network access

145
Q

NAC (4.5)

A

Network Access Control- Scans devices for their security status before granting network access, safeguarding against both known and unknown devices

146
Q

Non-Persistent Agent (4.5)

A

Network access is granted by users connect to Wi-Fi, access a web portal, and click a link for login

147
Q

Time-Based Network Access Control (4.5)

A

Users can only log onto network during specific times of the day

148
Q

Location-Based Network Access Control (4.5)

A

Users can only log on from specified areas/locations

149
Q

Web Filtering (4.5)

A

Technique used to restrict or control the content a user can access on the Internet

150
Q

Agent-Based Web Filtering (4.5)

A

Installing a small piece of software known as an agent on each device that will require web filtering

151
Q

Centralized Proxy (4.5)

A

Server that acts as an intermediary between an organizations end users and the Internet

152
Q

URL Scanning (4.5)

A

Used to analyze a websites URL to determine if it is safe or not to access

153
Q

Content Categorization (4.5)

A

Websites are categorized based on content, like social media, adult content, or gambling, which are frequently restricted in the workplace

154
Q

Block rules (4.5)

A

Specific guidelines set by an organization to prevent access to certain websites or categories of websites

155
Q

Reputation-Based Filtering (4.5)

A

Blocking or allowing website based on their reputation score which is usually determined by a third party website

156
Q

DNS Filtering (4.5)

A

Technique used to block access to certain websites by preventing the translation of specific domain names to their corresponding IP addresses

157
Q

DKIM (4.5)

A

DomainKeys Identified Mail- Allows the receiver to check if the email was actually sent by the domain it claims to be sent from and if the content was tampered with during transit

158
Q

SPF (4.5)

A

Sender Policy Framework- Email authentication method designed to prevent forging sender addresses during email delivery

159
Q

DMARC (4.5)

A

Domain-based Message Authentication, Reporting, and Conformance- An email validation system designed to detect and prevent email spoofing

160
Q

Email Gateway (4.5)

A

Server or system that serves as the entry and exit point for emails

161
Q

On-Premise Email Gateway (4.5)

A

Physical server that is located within an organizations own data center or premises that provides an organization with full control over their email system

162
Q

Cloud-Based Email Gateway (4.5)

A

Email gateway that is hosted by third-party cloud service providers to provide greater scalability and ease of maintenance

163
Q

Hybrid Email Gateway (4.5)

A

Used to combine the benefits of both on-premise and cloud-based gateways into a single offering

164
Q

Spam Filtering (4.5)

A

Process of detecting unwanted and unsolicited emails and preventing them from reaching as users email inbox

165
Q

EDR (4.5)

A

Endpoint Detection and Response- Category of security tools that monitor endpoint and network events and record the information in a central database; not as comprehensive as XDR (Extended Detection and Response)

166
Q

FIM (4.5)

A

File Integrity Monitoring- Used to validate the integrity of operating system and application software files using a verification method between the current file state and a known, good baseline

167
Q

XDR (4.5)

A

Extended Detection and Response- Security strategy that integrates multiple technologies into a single platform to improve detection accuracy and simplify the incident response process; more comprehensive than EDR (Endpoint Detection and Response)

168
Q

UBA (4.5)

A

User Behavior Analytics- Deploys big data and machine learning to analyze user behaviors for detecting security threats

169
Q

UEBA (4.5)

A

User and Entity Behavior Analytics- Built upon the foundation of UBA (User Behavior Analytics) with monitoring of entities as an addition function

170
Q

Protocol (4.5)

A

Set of rules or procedures for transmitting data between electronic devices

171
Q

Secure Protocol (4.5)

A

HTTPS instead of HTTP
FTPS instead of FTP
SSH instead of Telnet
IMAPS instead of IMAP
POP3S instead of POP3
SMTPS instead of SMTP
SNMPS instead of SNMP

172
Q

Port (4.5)

A

Logical construct that identifies specific processes or services in a given system

Well Known = 0 - 1,023 (system processes and services)
Registered Ports = 1,024 - 49,151 (software applications)
Dynamic/Private Ports = 49152 - 65,535 (client-side connections)

173
Q

Transport Method (4.5)

A

Refers to the way data is moved from one place to another, usually using either TCP (has error checking built in) or UDP (no error checking or delivery assurance) to transmit the data

174
Q

Vulnerability Management (4.3)

A

Systematic and ongoing process of identifying, evaluating, prioritizing, and mitigating vulnerabilities

175
Q

Package Monitoring (4.3)

A

Ensures that the libraries and components that the application depends on are secure and up-to-date

176
Q

Penetration Testing (4.3)

A

Used to simulate a real-world attack on a system to evaluate its security posture

177
Q

Threat Intelligence (4.3)

A

Continual process used to understand the threats faced by an organization

178
Q

System and Process Audits (4.3)

A

Process that involves conducting a comprehensive review of the information system, security policies, and procedures

179
Q

Threat Intelligence Feed (4.3)

A

Continuous stream of data related to potential or current threats to an organizations security

180
Q

OSINT (4.3)

A

Open Source Intelligence- Intelligence that is collected from publicly available sources including reports, forums, news articles, blogs, and social media posts

181
Q

Proprietary Third-Party Feeds (4.3)

A

Threat intelligence feeds that are provided by commercial vendors, usually under a subscription service type of business model

182
Q

Dark Web (4.3)

A

Part of the Internet tat is intentionally hidden and inaccessible through standard web browsers

183
Q

Responsible Disclosure (4.3)

A

Term used to describe the ethical practice where a security researcher discloses information about vulnerabilities in a software, hardware, or online service

184
Q

CVE (4.3)

A

Common Vulnerability and Exposures- System that provides a standardized way to uniquely identify and reference known vulnerabilities in software and hardware

185
Q

EF (4.3)

A

Exposure Factor- Used as a quantifiable metric to help a cybersecurity professional understand the exact percentage of an asset that is likely to be damaged or affected if a particular vulnerability is exploited

186
Q

Risk Tolerance (4.3)

A

Refers to the level of risk that an organization is willing to accept in pursuit of its objectives and before action is deemed necessary to mitigate the risk

187
Q

Vulnerability Response and Remediation (4.3)

A

Strategies that identify, assess, and address vulnerabilities in a system or network to strengthen an organizations security posture

188
Q

Cybersecurity Strategies (4.3)

A

Patching
Purchasing cybersecurity insurance policies
Network segmentation
Implementing compensating controls
Granting exceptions and exemptions

189
Q

Validating Vulnerability Remediation (4.3)

A

Rescans
Audits
Verification

190
Q

Vulnerability Reporting (4.3)

A

Process of documenting aand communicating details about security weaknesses identified in software or systems to the individuals or organzations responsible for addressing the issue

191
Q

Internal Reporting (4.3)

A

Involves the identification, documentation, and communication of the organizations vulnerabilities within the organizational structure

192
Q

External Reporting (4.3)

A

Involves discussions with the vendors, partners, customers, or the public at large, depending on the specific vulnerability involved

193
Q

Responsible Disclosure Reporting (4.3)

A

Art of disclosing vulnerabilities ethically and judiciously to the affected stakeholders before making the announcement to the public at large

194
Q

System Monitoring (4.4)

A

Observation of computer system, including the utilization and consumption of its resources

195
Q

Baseline (4.4)

A

Established performance metrics and data points for standard behavior of a system, network, or application

196
Q

Application Monitoring (4.4)

A

Emphasizes the management and monitoring of software application performance and availability

197
Q

Infrastructure Monitoring (4.4)

A

observation of the performance and availability of an organizations physical and virtual infrastructure

198
Q

Log Aggregation (4.4)

A

Process of collecting and consolidating log data from various sources into a centralized location

199
Q

Alerting (4.4)

A

Involves setting up notification to inform relevant stakeholders when specific events or conditions occur

200
Q

Scanning (4.4)

A

Involves examining systems, networks, or applications to identify vulnerabilities, configuration issues, or other potential problems

201
Q

Vulnerability Scan (4.4)

A

Checks for vulnerabilities in systems, networks, or applications by comparing the systems state against databases of vulnerabilities

202
Q

Configuration Scan (4.4)

A

Checks for misconfiguration that could impact system performance or security

203
Q

Code Scan (4.4)

A

Checks the source code of an application for potential issues, such as security vulnerabilities or coding errors

204
Q

Reporting (4.4)

A

Involves generating summaries or detailed reports based on the collected and analyzed data

205
Q

Archiving (4.4)

A

Involves storing data for long-term retentions and future reference, including organizations log data, performance data, and incident data

206
Q

Alert Response and Remediation or Validation (4.4)

A

Involves taking appropriate actions in response to alerts and ensuring that the identified issues have been effectively addressed

207
Q

Remediation (4.4)

A

Steps used to resolve the identified issues or vulnerabilities

208
Q

Validation (4.4)

A

Involves verifying that the remediation implemented was actually successful and has effectively addressed the given issue or vulnerability

209
Q

Quarantining (4.4)

A

Isolating a system, network, or application to prevent the spread of a threat and limit its potential impact

210
Q

Alert Tuning (4.4)

A

Adjusting alert parameters to reduce errors, false positive, and to improve the overall relevance of the alerts being generated by a given system

211
Q

SNMP (4.4)

A

Simple Network Management Protocol- Internet protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior

212
Q

SNMP Trap Message (4.4)

A

Simple Network Management Protocol Trap Message- A message that’s sent from a network device to an SNMP management system without being solicited by the system

213
Q

Granular Trap Message (4.4)

A

Sent message to get a unique objective identifier to distinguish each message as a unique message being received

214
Q

OID (4.4)

A

Object Identifier (used with SNMP- Simple Network Management Protocol- trap messages)

215
Q

MIB (4.4)

A

Management Information Base- Used to describe the structure of the management data of a device subsystem using a hierarchical namesapace containing object identifiers

216
Q

Verbose Trap (4.4)

A

Simple Network Management Protocol Trap- May be configured to contain all the information about a given alert or event as a payload

217
Q

SNMPv3 (4.4)

A

SNMPv1 and v2 both transmit in plaintext. V3 offer…
Confidentiality using encryption (DES for earlier implementations and 3DES or AES for newer implementations)
Integrity using hashes
Authentication by validating source of messages

218
Q

SIEM (4.4)

A

Security Information and Event Manager- Solution that provides real-time or near-real-time analysis of security alerts that are generated by network hardware and applications

219
Q

Agent (SIEM) (4.4)

A

Software agent installed on each system, such as a server or workstation, from which the SIEM (Security Information and Event Manager) needs to collect log data

220
Q

Agentless (SIEM) (4.4)

A

Under this approach, the SIEM (Security Information and Event Manager) system directly collects log data from each system using standard protocols such as SNMP (Simple Network Management Protocol) or WMI (Windows Management Instrumentation)

221
Q

SIEM Software examples (4.4)

A

Security Information and Event Manager- Splunk, ELK or Elastic Stack, ArcSight, QRadar

222
Q

CVSS (4.4)

A

Common Vulnerability Scoring System- Used to provide a numerical score to reflect the severity of a given vulnerability

0.0 = None
0.1 - 3.9 = Low
4.0 - 6.9 = Medium
7.0 - 8.9 = High
9.0 - 10.0 = Critical

223
Q

Antivirus Software (4.4)

A

fundamental security tool that protects systems against malware, including viruses, worms, trojans, ransomware, and spyware

224
Q

DLP Systems (4.4)

A

Data Loss Prevention Systems- Used to monitor and control data endpoints, network traffic, and data store in the cloud to prevent potential data breaches from occurring

225
Q

NIDS (4.4)

A

Network Intrusion Detection System- Passively identify potential threats

226
Q

NIPS (4.4)

A

Network Intrusion Prevention System- Actively identify and block or prevent potential threats

227
Q

Firewalls (4.4)

A

Serve as a barrier between a trusted internal network and an untrusted external network

228
Q

Vulnerability Scanner (4.4)

A

Tools that identify security weaknesses in a system, including missing patches, incorrect configurations, and other types of known vulnerabilities

229
Q

SCAP (4.4)

A

Security content Automation Protocol- Open standards that automate vulnerability management, measurement, and policy compliance for systems in an organization

230
Q

3 Main languages used within SCAP (4.4)

A

OVAL- Open Vulnerability and Assessment Language
XCCDF- Extensible Configuration Checklist Description Format
ARF- Asset Reporting Format

231
Q

OVAL (4.4)

A

Open Vulnerability and Assessment Language- XML (extensible Markup Language) schema for describing system security states and querying vulnerability reports and information

232
Q

XCCDF (4.4)

A

Extensible Configuration Checklist Description Format- XML (Extensible Markup Language) schema for developing and auditing best-practice configuration checklists and rules

233
Q

ARF (4.4)

A

Asset Reporting Format- XML (Extensible Markup Language) schema for expressing information about assets and the relationships between assets and reports

234
Q

CCE (4.4)

A

Common Configuration Enumeration- Scheme for provisioning secure configuration checks across multiple sources

235
Q

CPE (4.4)

A

Common Platform Enumeration- Scheme for identifying hardware devices, operating systems, and applications

236
Q

CVE (4.4)

A

Common Vulnerabilities and Exposures- List of records where each item contains a unique identifier used to describe a publicly known vulnerability

237
Q

Benchmark (4.4)

A

Set of security configuration rules for some specific set of products to provide a detailed checklist that can be used to secure systems to a specific baseline

238
Q

FPC (4.4)

A

Full Packet capture- Captures the entire packet, including the header and the payload for all traffic entering and leaving a network

239
Q

Flow Analysis (4.4)

A

Relies on a flow collector, which records metadata and statistics rather than recording each frame that passes through the network

240
Q

NetFlow (4.4)

A

A Cisco developed means of reporting network flow information to a structured database

241
Q

IPFIX (4.4)

A

Internet Protocol Information Export- Defines traffic flows based on shared packet characteristics

242
Q

Zeek (4.4)

A

Software that passively monitors a network like a sniffer, but only logs full packet capture of potential interest

243
Q

MRTG (4.4)

A

Multi router Traffic Grapher- Creates graphs showing traffic flows through the network interfaces of routers and switches by polling the appliances using SNMP (Simple Network Management Protocol)

244
Q

single Pane of Glass (4.4)

A

A central point of access for all the information, tools, and systems

245
Q

Implementing Single Pane of Glass (4.4)

A

Define requirements
Identify and integrate data sources
Customize the interface
Develop SOPs and documentation
Continuously monitor and maintain the solution

246
Q

Incident Response Cycle (7 phases) (4.8)

A
  1. Preparation
  2. Detection
  3. Analysis
  4. Containment
  5. Eradication
  6. Recovery
  7. Post-Incident activity/lessons learned
247
Q

threat Hunting (4.8)

A

Cybersecurity methods for finding hidden threats not caught by regular security monitoring

248
Q

Intelligence Fusion and Threat Data (4.8)

A

Use SIEM (Security Information and Event Manager) and analysis platforms to spot concerns in the logs and real-world security threats

249
Q

Root Cause Analysis (4.8)

A

A systematic process to identify the initial source of the incident and how to prevent it from occurring again

250
Q

Root Cause Analysis Process (4.8)

A

Define the scope of the incident
Determine the causal relationships
Identify an effective solution
Implement and track the solution

251
Q

TTX (4.8)

A

Tabletop Exercise- Exercises simulate incident within a control framework

252
Q

Digital Forensics (4.8)

A

Process of investigating and analysing digital devices and data to uncover evidence for legal purposes

253
Q

Digital Forensics Procedures (4.8)

A

Identification
Collection
Analysis
Reporting

254
Q

Identification (Digital Forensics) (4.8)

A

Ensures the safety of the scene, secures it to prevent any evidence contamination, and determines the scope of the evidence to be collected

255
Q

Collection (Digital Forensics) (4.8)

A

Refers to the process of gathering, preserving, and documenting physical or digital evidence in various fields

256
Q

Analysis (Digital Forensics) (4.8)

A

Involves systematically scrutinizing the data to uncover relevant information, such as potential signs of criminal activity. hidden files, timestamps, and user interactions

257
Q

Reporting (Digital Forensics) (4.8)

A

Involves documenting the finding, processes, and methodologies used during a digital forensic investigation

258
Q

Order of Volatility (4.8)

A

Dictates the sequence in which data sources should be collected and preserved based on their susceptibility to modification or loss

  1. Collect data from systems memory
  2. Capture data from the system state
  3. Collect data from the storage devices
  4. Capture network traffic and logs
  5. Collect remotely store or archived data
259
Q

Chain of Custody (4.8)

A

Documented and verifiable record that tracks the handling, transfer, and preservation of digital evidence from the moment it is collected until it is presented in a court of law

260
Q

Disk Imagin (4.8)

A

Involves creating a bit-by-bit or logical copy of a storage device, preserving its entire content, including deleted files and unallocated space

261
Q

File Carving (4.8)

A

Focuses on extracting files and data fragments from storage media without relying on the file system

262
Q

Legal Hold (4.8)

A

Formal notification that instructs employees to preserve all potentially relevant electronic data, documents, and records

263
Q

Electronic Discovery (4.8)

A

Process of identifying, collecting, and producing electronically stored information during legal proceedings

264
Q

Data Acquisition (4.8)

A

The method and tools used to created a forensically sound copy of the data from a source device, such as system memory or a hard disk

265
Q

Log File (4.9)

A

A file that records either events that occur in an operating system or other software that runs or messages between different users of a communication software

266
Q

Journalctl (4.9)

A

Linux command line utility used for querying and displaying logs from the journal, which is responsible for managing and storing log data on a Linux machine

267
Q

NXLog (4.9)

A

A multi-platform log management tool that helps to easily identify security risks, policy breaches, or analyze operational problems

268
Q

Metadata (4.9)

A

Data the describes other data by providing an underlying definition or description by summarizing basic information about data that makes finding and working with particular instances of data easier

269
Q

SOAR (4.7)

A

Security, Orchestration, Automation, Response

270
Q

Playbook (4.7)

A

Checklist of actions for specific incident responses

271
Q

Runbook (4.7)

A

Automated versions of playbooks with human interaction points

272
Q

REST (4.7)

A

REpresentational State Transfer- Architectural style that uses standard HTTP methods and status codes, uniform resource identifiers, and MIME (Multipurpose Internet Mail Extensions) types

273
Q

SOAP (4.7)

A

Simple Object Access Protocol- Protocol that defines a strict standard with a set structure for the message, usually in XML (eXtensible Markup Language) format

274
Q

CURL (4.7)

A

Tool to transfer data to or from a server using one of the supported protocols

275
Q

Runbook (4.7)

A

Automated version of a Playbook and includes clearly defined interaction points for human intervention and analysis

276
Q

Orchestration (4.7)

A

Coordinated and sequenced execution of multiple automated tasks, ensuring they work harmoniously within a larger, complex process

277
Q

Continuous Delivery (4.7)

A

Software development practice where new code changes are automatically tested and prepared for a release that allows for reliable, manual deployments to a production environment at any chosen time

278
Q
A

Security+ (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions