Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SY0-701 2024 > SYO-701 > Flashcards

SYO-701 Flashcards

1
Q

Technical controls (category)

A

implemented using a system
IT security controls
eg: firewall, anti-virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Managerial Controls (category)

A

policies and procedures
admin stuff
SOPs
on-boarding policy, demotion, review login reports, separation of duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Operational controls (category)

A

implemented by people instead of systems
guard shack, require multiple guard, awareness training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

physical controls (category)

A

door lock, warning sign, power generator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

preventive control type

A

block access to a resource
firewall rules
door locks
on-boarding policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

deterrent control type

A

discourage attacks
warning banner
posted warning signs
threat of demotion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Detective control type

A

identify intrusion attempts
audit log monitoring
motion detectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Corrective control type

A

Apply a control after an event has been detected to reverse impact of event
Continue operations with minimal downtime
Ransomware recovery using backups
use law enforcement to manage criminal activity
fire extinguishers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

compensating control type

A

control using other means
existing controls aren’t sufficient
may be a temporary control

use a temporary firewall rule to block an application while waiting for a security patch
implement separation of duties
generator used after a power outage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Directive control type

A

direct a subject towards compliance
this is a weak security control

tell people to store sensitive files in a protected folder
train users on security policy
Create compliance policies and procedures
security policy training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Zero Trust

A

Authenticate to each device or process on the network, not just a VPN or firewall.
Everything must be verified, nothing inherently trusted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data plane

A

zero trust plane of operation
process frames packet and network data
movement of data across network
Switch ports, NAT, processsing, forwarding, trunking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Control plane

A

zero trust plane of operation
manage actions of the data plane
network decision making and traffic management
routing tables, NAT tables, IP address configs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Adaptive Identity

A

zero trust
Consider the source and the requested resources
Multiple risk indicators with relationship to the organization
If user is in China, considered higher risk
Find out how risky the login is.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

(zero trust) Threat Scope reduction

A

zero trust
decrease number of possible entry points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

policy-driven access control (zero trust)

A

zero trust
Make authentication requirements stronger based on Adaptive Identity.
combine adaptive identity with a predefined set of rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

PEP

A

zero trust
Policy Enforcement Point
everything must be validated via the PEP
Subjects and systems must be vallidated through Policy Enforcment Point
PEP is a gatekeeper for allowing or blocking traffic to resources
Can be multiple devices working together.
Works on the Data plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PDP

A

zero trust
Policy Decision Point
gets forwareded requests from the PEP
decides whether traffic should be allowed or not
makes a process for authentication
Works on the control plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Policy Engine - zero trust

A

zero trust
Part of the PDP
evaluate each access decision based on policy
grant, deny or revoke access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Policy Administrator - zero trust

A

Part of the PDP
Generate access tokens
the PA creates or shuts down a communication based on decisions from the Policy Engine
Tells the PEP to allow or disallow access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

TPM

A

trusted platform module
specification for cryptography hardware
cryptography process like random number generator, key generators
unique keys burned in during manufacturing
versatile memory to store keys, hardware config info
securely store bitlocker keys
password protected against dictionary attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

HSM

A

hardware security module
used in large environments
- a rack server
securely stoer thousands of keys
high-end cryptographic hardware used to perform crypto functios
key backup
- secure storage for keys
cryptographic accelerators
- GPU for performing crypto functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

secure enclave

A

protected area in hardware for secrets
- implemented as a hardware processor
- isolated from main processor
- many different technologies and names
extensive security features
- has its own boot ROM
- has its own boot process
- true random number generator
- real-time memory encryption
- root crypto keys
- AES encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

block chain

A

distributed ledger
everyone on blockchain tracks the ledger
tracks transaction and sends it everyone
can be used to track progress of parts on an assembly line

block of transactions
secure hash is calcuated from previous blocks of transaction data
hash is added to the new block of verified transactions
chain of hashes
new calculated block is distributed to everyone

if any blocks are altered, all the following hashes in the chain are recalcuated
is the altered chain doesn’t match other chains on network, it will be rejected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

OCSP stapling

A

During the TLS/SSL handshake, the server sends the digitally signed OCSP verification with the certificate message to the client.

OCSP stapling improves the client experience by:
* Reducing the time it takes to establish a connection
* Ensuring the browser gets the same response performance for the certificate status as it does for the website content
* Addressing privacy concerns by removing the need for the CA to receive revocation requests directly from the client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

UTM

A

unified threat management
aka all in one security device
aka web security gateway
URL filtering, content inspection
malware inspecion
spam filter
CSU/DSU (LAN to WAN connection)
routing and switching
firewall
IDS/IPS
badwidth shaper for QoS
VPN server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SD-WAN

A

Software defined networking in a wide area network
WAN built for cloud
cloud based app communicate directly to the cloud
dynamic network connects on-site users directly to cloud applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

SASE

A

Secure Access Service Edge
VPN for cloud services
SASE servers located on the cloud, near the apps
SASE client installed on devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

BYOD

A

bring your own device
BYOT
bring your own technology
employee owned devices
difficult to secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

BYOT

A

bring your own technology
employee owned devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

COPE

A

corporate owned personally enabled devices
organization owned device
used for both personal and corporate stuff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

CYOD

A

a subset of COPE device
choose your own device
choose apple or android

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

MIC

A

message integrity check
wireless security
make sure data is the same as sent
provides data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

GCMP

A

galois counter mode protocol
wifi protocol
works with WPA3
secure hashes with AES

35
Q

SAE

A

Simultaneous Authentication of Equals
wifi security protocol
Variant of diffie-helmen key exchange
everyone uses a different session key, even if everyone has the same preshared key
handshake and mutual authentication process is changed
create a shared session key without sending key across network

36
Q

EAP

A

extensible authentication protocol
many ways to authentication
integrates with 802.1x
works with WiFi

37
Q

enumeration

A

part of asset management
record all parts of an asset
CPU. mem, keyboard, mouse, etc

38
Q

CVSS

A

common vulnerability scoring system
uses NVD

39
Q

NVD

A

national vulnerabilit database
nvd.nist.gov
vulns with a score of 10 are most critical
0 score is least critical
scores change with CVSS version

40
Q

CVE

A

Common vulnerabilities and exposures
vulnerability database

41
Q

exposure factor

A

loss of value or business activity due to vulnerability
if a vuln takes down half of the business, exposure factor is 50%

42
Q

SPF

A

sender policy framework
email security
add a TXT record in DNS
SPF - configure a list of all servers authorized to send emails

43
Q

DKIM

A

domain key identified mail
mail server digitally signs all outgoing mail
public key is in the DKIM TXT record
users can validate that the messages are legit with DKIM public key

44
Q

DMARC

A

domain based message authentication, reporting and comformance
extension of SPF and DKIM
handle emails that aren’t validated using SPF and DKIM
write policy to a DNS TXT record
possible policy action on unvalidated email:
- accept all,
- send to spam,
- quarantine
- reject email
can send compliance reports to the email admin

45
Q

MAC

A

Mandatory Access Control
OS limits operations on an object
every object is labeled
- eg: confidential, secret
admin of the system decides which person can access which labels
eg: SELinux file types and user restrictions

46
Q

DAC

A

Discrectionary Access Control
similar to unix chmod
owner of data controls who can access it
flexible access control
weak security, because it depends on users to have good security

47
Q

RBAC

A

role based access control
each user has a role in the organization
admin provides access based on user’s role
in windows, use AD Groups to provide role-based access control

48
Q

rule-based access control

A

system enforced rules
rules created by admin, not users
object ACLs, similar to linux file ACLs
eg: a lab worker can only access a file between 9 AM and 5 PM.

49
Q

attribute based access control

A

users can have complex relationships to applications and data
next generation authorization model
evaluate multiple parameters
- resource info, IP addr, time of day, desired action, relationship to the data

50
Q

JIT permissions

A

Just in time permissions
short term admin permissions
a breached user account doesn’t have admin access
user requests admin permissions from a clearinghouse
primary credentials are stored in a password vault, and never doled out
each user gets a different short term set of admin credentials to use
when user is finished, short term credentials are deleted.

51
Q

cases for automation

A

user onboarding and offboarding
guard rails
- automated validation on configs
- limit admin mistakes
security groups
- assign or remove users from AD groups
ticket creation
- automate turning user emails into helpdesk tickets
escalation
- correct helpdesk issues before involving a human
- if helpdesk cannot fix it, automatically escalate to security
enable and disable services as needed
CI/CD Continuous integration and continuous deployment
use APIs with automation

52
Q

incident lifecycle (in order)

A

PDACERL
preparation
detection
analysis
containment,
eradication,
recovery
lessons learned

53
Q

chain of custody

A

used in digital forensics
control evidence
- maintain integrity of data
log who access data
have hashes and digital signatures of data to maintain data integrity
label and catalog everything
- digitally tag all items for ongoing documentation
- seal and store data

54
Q

Data owner

A

accountable for a specific data
VP of sales owns the customer relationship data
treasurer owns financial informatio

55
Q

data controller

A

manage the purposes and means by which personal data is processed
eg: payroll department defines payroll amounts and pay time

56
Q

data processor

A

processes data on behalf of the data controller
often a third-party or different group
eg: payroll company sends the paychecks

57
Q

data custodian/steward

A

responsible for data accuracy, privacy and security
attach sensitivity labels to data
make sure data complies with laws
implement security controls
grant users access to data

58
Q

Qualitative risk assessment

A

Risk assessment
identify significant risk factors
ask opinions about the significance
display visually with traffic light grid or similar method

59
Q

ARO

A

annualized rate of occurence

60
Q

AV

A

asset value
value of an asset to the organization
includes cost of th asset, effect on company sales

61
Q

EF

A

exposure factor
percentage of the value lost due to an incident

62
Q

SLE

A

single loss expenctancy
monetary loss if a single event occurs.
SLE = AV * EF
eg: 1 laptop stolen
- SLE = 1000 * 1 = 1000

63
Q

ALE

A

annualized loss expectency
annualize loss per year
ALE = ARO * SLE
eg: seven laptops stolen per years
- ALE = 7 * 1000

64
Q

risk likelihood

A

qualitative measurement of risk
eg: rare, possible, almost certain
eg: high, medium, low

65
Q

risk probability

A

quantitative measurement of risk
eg: statistical measurement
based on historical performance
numbers

66
Q

risk appetite posture

A

qualitative description for readiness to take risk
eg: conservative, neutral, expansionary

67
Q

risk tolerance

A

an acceptable variance from the risk appetite
usually larger than risk appetite
eg: you can drive 5 mph over speed limit before you get a ticket

68
Q

risk register

A

every project has a plan, but also a risk
- identify and document risk associated with each step of a project
- document solutions to the risk

69
Q

risk reporting

A

formal document
- identify risk
- detailed information for each risk
created for senior management
- make decisions regarding resources, budgeting, additional security tasks
includes critical and emerging risks
- the most important considerations

70
Q

SLA

A

service level agreement
minimum terms for services provided
uptime, down response time, etc
commonly used between customers and providers

71
Q

MOU

A

memorandum of understanding
informal contract between two organizations
confidentiality agreements
very broad, not detailed

72
Q

MOA

A

memorandum of agreement
one step above an MOU
more detailed than an MOU, but still fairly broad
not a contract
may not contain legally enforcable promises

73
Q

MSA

A

master service agreement
legal contract and agreement of terms
broad framework to cover future transactions
covers many detailed negotiations
foundation for future services

74
Q

WO

A

work order
aka SOW - statement of work
extends an MSA
specific list of items to be completed
Details the scope of the job, location and deliverables

75
Q

NDA

A

non-disclosure agreement
confidentiality agreement between parties
protect data, so companies can discuss trade secrets
unilateral - one way NDA
bilateral - two way NDA
multilateral - many way NDA, for multiple companies

76
Q

BPA

A

business partners agreement
two people going into business together make an agreement
has owner’s stake
has financial contract
who makes the decisions?
prepare for contingencies

77
Q

GLBA

A

gramm-leach-bliley act of 1999
requires disclosure of privacy info from banks

78
Q

SOX

A

sarbanes-oxley act
public accounting reform and investor protection act of 2002

79
Q

due diligence

A

monitor compliance
make sure that the company is acting in good faith to do compliance
implies a third party is doing due diligence

80
Q

due care

A

monitor compliance
make sure that the company is acting in good faith to do compliance
implies the company itself is doing due care

81
Q

attestation (compliance monitoring)

A

someone must sign off on formal compliance docs
ultimately responsible if the docs are incorrect

82
Q

EDR

A

Endpoint Detection and Response
host endpoint security client
more advanced than signature detection
behavioral analysis, machine learning and process monitoring
lightweight agent on the endpoint
detects threats
investigate the threat
root cause analysis
respond to threats

83
Q

XDR

A

eXtended Detection and Response
enhanced version of EDR
improved missed detection, false positives and long investigation times
analyses data from many different endpoints to make conclusions
adds network-based detection
correlate endpoint, network and cloud data to find threats

84
Q

XDR behavior analytics

A

user behavior analytics
watch users, hosts, network traffic, data repositories, etc
make a baseline of normal activity
watch for any unusual activity

SY0-701 2024 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions