Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec+ 501 > Terms > Flashcards

Terms Flashcards

Risk Management

1
Q

What is Risk Management?

A

A practice of identifying, monitoring, and limiting risks to a manageable level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 Risk Control Types?

A

Administrative
Technical
Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Risk Assessment?

A

Used to understand the current risks, probability, impact, and the solution to prevent them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the 4 Risk Management Options?

A

Avoidance
Transference
Acceptance
Mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Is a living document used to track different types of data elements associated to risk factors and scenarios.

A

Risk Register

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Continuity of operations plan (COOP)

A

Provides an alternate location for operations after a critical outage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Business Continuity Plan (BCP)

A

Ensures that critical business operations continue and the organization can survive the outage. Identify key items.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is DRP?

A

Disaster Recovery Plan: Provides a step-by-step procedure that personnel will follow to save human life and recover/restore your business .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is BIA?

A

Business Impact Analysis: Identifies systems and components that are essential to the organization’s success and potential for financial loss.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is ALE?

A

Annual Loss Expectancy: The possible yearly cost of all instances of a specific realized threat against a specific asset. Allows for proper budgeting of the security measures if risk happens

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is ARO?

A

Annual Rate of Occurrence: The frequency with which a specific threat or risk will occur within a single year.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is SLE?

A

Single Loss Expectancy: The cost associated with a single realized risk against a specific asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do you calculate the ALE?

A

ALE = ARO * SLE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is SLA?

A

Service Level Agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is BPA?

A

Business Partnership Agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is MOA/MOU ?

A

Memorandum of Agreement/Understanding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is ISA?

A

Interconnection Security Agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is AUP?

A

Acceptable Use Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is BYOD?

A

Bring Your Own Device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is CYOD?

A

Choose Your Own Device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What isCOPE?

A

Company Owned, Personally Enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is VDI?

A

Virtual Desktop Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is AV?

A

Asset Value - Monetary value of the information asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is EF?

A

Exposure Factor: Percentage of loss that an organization would experience if a specific asset were violated by a realized risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How is the SLE calculated?

A

SLE = AV * EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the 4 pillars of Sec+

A

Confidentiality
Integrity
Availability
Safety/Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the 6 Access Control Types?

A 
Preventative
Detective 
Corrective 
Deterrent 
Recovery 
Compensation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is PAP?

A

Password Authentication Protocol: passwords are sent over the wire in cleartext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is CHAP?

A

Challenge Handshake Authentication Protocol: passwords are sent over the network encrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is PPP?

A

Point-to-Point Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is FFR?

A

False Reject Rate OR Type 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is FAR?

A

False Acceptance Rate OR Type 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the 5 Authentication Factors?

A

Something You Know (Password) - [Weakest]
Something You Have (Multi-Factor)
Something You Are (Biometric) - [Strongest]
Somewhere You Are (Geolocation)
Something You Do (Gestures)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is Single Factor Authentication?

A

Authentication that requires a single authentication factor type.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is Multi-Factor Authentication?

A

Authentication that requires more then one authentication factor type.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is Mutual Authentication?

A

Two-way Authentication: client to server, & server to client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is SSO?

A

Single Sign On: authentication that allows for access of multiple applications without requiring additional authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are 2 services that use SSO Secure Token?

A

Kerberos (Domain)

LDAP (Active Directory)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are 4 Federated Identity Management services?

A

OpenID
Oauth
SAML (Domain to Domain)
Shibboleth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are the 2 Categories of Identify Management

A

Centralized Access Control: authorization verification performed by a single entity.

Decentralized Access Control (Distributed Access Control): various entities located throughout a system perform authorization verification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is LDAP/LDAPS?

A

Lightweight Directory Access Protocol (Secured)
TCP 389
SSL/TLS TCP 636/3269
uses x.500 Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is PKI?

A

Public Key Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is ADDS?

A

Active Domain Services OR Domain Controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are the 2 types of Domain Administrators?

A

Root Domain

Enterprise Domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is AES?

A

Advanced Encryption Standard: symmetric encryption to protect the users logon credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Whats is KDC?

A

Key Distribution Center OR Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the 4 parts of KDC?

A

Authentication Server (AS)
Ticket Granting Service (TGS)
Ticket Granting Ticket (TGT)
Domain Controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is IDaaS

A

Identity as a Service:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is Federated Identify Management?

A

is when organizations join a group of organizations, to share authentication.

Cloud identify authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What 2 protocols used for Personal Federations?

A

OpenID
OAuth

Google, Facebook, LinkedIN, Microsoft, & Twitter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What 2 protocols are used for Business Federation?

A

Security Assertion Markup Language (SAML) [Cloud]

Shibboleth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is SOAP?

A

Simple Object Access Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is CRM?

A

Customer Relation Managment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is SAML?

A

Security Assertion Markup Language (business to business)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is used by SSH?

A

SFTP

SCP

56
Q

What is PEAP?

A

Protected Extensible Authentication, works with SSL/TLS

57
Q

What are the 3 phases of Account Management?

A

Provisioning (on-boarding)
Review
Deprovisioning (off-boarding)

58
Q

What are the 3 types of Authorization?

A

Rights
Permissions
Privileges

59
Q

What are the 5 Access Control Models?

A 
Role-based access control (role-BAC) 
Rule-based access control (rule-BAC) 
Discretionary access control (DAC) 
Mandatory access control (MAC)
Attribute-based access control (ABAC)
60
Q

What is Separation of Duties?

A

Dividing roles and responsibilities of individuals or departments so that one critical task cannot be performed by one entity.

61
Q

What is Dual Control?

A

Ensuring that more than one individual has to be involved in completing a task.

62
Q

What are the 4 Role-based access control (Role-BAC) types?

A

Administrators
Executives
Project Managers
Team Members

63
Q

What is rule-BAC?

A

Rule-based access control: uses IF/THEN logic.

64
Q

What is MAC?

A

Mandatory access control: uses sensitivity labels

65
Q

What is DAC?

A

Discretionary access control: Owner establishes access for the objects (files and folders)

66
Q

What is a RAS?

A

Remote Access Service: example VPN

67
Q

What are the 3 types of user authentication?

A

Point-to-Point (PPP)
Client Side
Server Side

68
Q

What are the 4 Client Side protocols used for user authentication?

A

PAP
CHAP
MSCHAP (mutual authentication)
EAP

69
Q

What are the 5 Server Side protocols used for user authentication?

A 
AAA
TACACS+
802.1X
RADIUS/ Radius Federation 
DIAMETER
70
Q

What are the 3 Network Authentication Server (AAA) protocols?

A

RADUIS (UDP)
TACACS+ (Cisco, TCP 49)
Diameter (TCP)

71
Q

What does AAA stand for?

A

Authentication, Authorization, and Accounting

72
Q

What is IdP?

A

Identity Provider: creates, maintains and manages users identity information.

73
Q

What is Change Management?

A

Controls software changes, patches

74
Q

What are the 2 Cryptographic Methods?

A

Symmetric Cryptography: 1 key, out-of-band

Asymmetric Cryptography: 2 separate keys, in-band

75
Q

What are 5 Popular Symmetric Algorithms?

A

Advanced Encryption Standard (AES) strongest
Data Encryption Standard (DES) weakest
Triple Data Encryption Standard (3DES) slow
RC4 (Rivest Cipher), weakest encryption
Blowfish, next most secure

76
Q

What are 5 Popular Asymmetric Algorithms?

A 
RSA
DSA
Diffie-Hellman (Groups, DHE, ECDHE)
Elliptic curve
PGP/GPG
77
Q

What are the 4 Data Encryption Standard (DES) Modes?

A

ECB, weakest
CBC
CTR
GCM

78
Q

What are the 4 most common Hashing Algorithms?

A

MD5
SHA, NSA 256
HMAC
RIPEMD

79
Q

What is HMAC?

A

Hash-based Message Authentication Code: used in IT security with VPNs.

80
Q

What are 2 Key Stretching Algorithms?

A

Bcrypt [salts, and hashes with Blowfish] strongest

Password-Based Key Derivation Function 2 (PBKDF2)

81
Q

What are 3 advantages of using digital signatures?

A

Authentication
Non-repudiation
Integrity

82
Q

What 2 things are utilized when a Certificate Revocation takes place?

A

Certificate Revocation List (CRL)

Online Certificate Status Protocol (OCSP)

83
Q

What are the 3 main Certificate Formats & PKI Structures?

A

Distinguished Encoding Rules (DER), Ascii
PKCS#7, Share public key
PKCS#12, Private key with certificate

84
Q

What are the 4 types of Trust Models?

A

Web Of Trust [decentralized]
Third-Party (Single Authority) Trust
Hierarchical Trust [centralized]
Cross-trust [different organizations]

85
Q

What is Encapsulation/Multiplexing in regards to OSI?

A

Going from High to Low, Application to Physical Layer.

86
Q

What is Decapsulation/De-multiplexing in regards to ISO?

A

Going from Low to High, Physical to Application Layer.

87
Q

What are the 7 layers of the ISO model?

A
  1. Application
  2. Presentation
  3. Session
  4. Transport
  5. Network
  6. Data Link
  7. Physical
88
Q

What are the 7 layers of the ISO model?

A
  1. Application [data]
  2. Presentation [data]
  3. Session [data]
  4. Transport [protocols]
  5. Network [packets]
  6. Data Link [frames]
  7. Physical [bits]
89
Q

What are the 3 types of communication sessions?

A

Simplex [one way]
Full-duplex [two way, same time]
Half-duplex [two way, one at a time]

90
Q

What are the 4 layers of the TCP/IP model?

A

Application
Transport
Internet
Link/Network Interface

91
Q

What are the 4 protocol groups?

A

Basic connectivity protocols
Encryption protocols
Application protocols
Email protocols

92
Q

What is SNMP?

A

Simple Network Management Protocol
UDP 161 (query); UDP 162 (trap/notifications)
SNMPv2, authentication
SNMPv3, encryption TCP 10161, TCP 10162

93
Q

What is SRTP?

A

Secure Real-time Protocol
Used to implement voice encryption (VoIP)
UDP 5004

94
Q

SMTP

SMTPS

A

TCP 25

TCP 465

95
Q

POP3

POP3S

A

TCP 110

TCP 995

96
Q

IMAP4

IMAPS

A

TCP 143

TCP 993

97
Q

DHCP

A 
Dynmic Host Configuration Protocol 
UDP 67 (server)
UDP 68 (client)
98
Q

DNS Comands

A

Nslookup (Windows)

Dig (Linux)

99
Q

What is a BIND server?

A

Berkeley Internet Name Domain, a DNS server

100
Q

What does SCP use?

A

Uses SSH

TCP 22

101
Q

What does TFTP use?

A

UDP 69

102
Q

What does HTTP use?

A

TCP 80

103
Q

What does HTTPS use?

A

TCP 443

104
Q

What port does SIP use?

A

5060/5061

105
Q

What port does H.323 use?

A

1720

106
Q

What port does RADUIS use?

A

UDP 1812/1813

107
Q

What are the 3 types of FIREWALLS?

A

Packet filtering (Stateless Inspection)
Stateful
Application-Aware Firewall (WAF)

108
Q

Application-Aware Firewall

A

Web based firewall

Host based firewall

109
Q

What are the 6 types of Proxy Servers?

A 
Forward proxy (protects client)
Reverse proxy (protects servers)
Transparent (does not modify)
Nontransparent (modify or filter)
Application (specific applications)
Multipurpose (multiple protocol types)
110
Q

What are the 2 modes of Internet Protocol security (IPsec)?

A

Transport

Tunnel

111
Q

What is SIEM?

A

Security Information and Event Management

112
Q

What is WORM in relation to SIEM?

A

Write Once, Read Many (offer tamper-proof data)

113
Q

What is a HSM?

A

Hardware Security Module

-can generate, store, and manage RSA keys used in asymmetric encryption

114
Q

What is a NAC?

A

Network Access Control

-entry point or gateway into the network, typically for remote or mobile clients

115
Q

What is Host Health Check / Posture Assessment?

A

Enforces NAC

116
Q

What is 802.1x ?

A

Switch Port based authentication

  • RADIUS server
  • Diameter server
  • redirect unauthorized clients to a non-production network via a VLAN
117
Q

What is EPA?

A

Extensible Authentication Protocol

118
Q

What is NAC?

A

Network Access Control: provides continuous security monitoring by inspecting computers and preventing them from accessing the network if they don’t pass the inspection.

119
Q

What is ESP?

A

Encapsulating Security Payload

120
Q

What is SSTP?

A

Secure Socket Tunneling Protocol: encrypts VPN traffic using TLS over TCP 443

121
Q

What is PPTP?

A

Point-to-Point Tunneling Protocol: TCP 1723

122
Q

What is L2TP?

A

Layer 2 Tunneling Protocol: uses IPsec, UDP 1701

123
Q

SSL Accelerator

A

Offloads the SSL process to a hardware accelerator, makes secure connection faster, and provides load balancing options.

124
Q

What is FDE?

A

Full disk encryption: software based

125
Q

What is SED?

A

Self-encrypted devices: hardware or software based

126
Q

What is UEFI?

A

Unified Extensible Firmware Interface: replaces a BIOS, supposed to be better.

127
Q

What is a TPM?

A

Trusted Platform Module: Prevent any type of dictionary attack

128
Q

What is HSM?

A

Hardware Security Module: manage, generate, and securely store cryptographic keys in a secure location

129
Q

What is SCADA?

A

Supervisory control and data acquisition

Industrial Control System (ICS) is associated with SCADA

130
Q

What is IaaS?

A

Infrastructure-as-a-service [host, servers]

131
Q

What is PaaS?

A

Platform as a service [build, operating systems]

132
Q

What is SaaS?

A

Software as a service [consume, applications]

133
Q

What is SECaaS?

A

Security as a Service

134
Q

What is CASB?

A

Cloud access security broker

135
Q

Virtualization Hypervisors

A

Type 1: it is an OS, faster, more expensive
Type 2: runs on an OS, cheaper, slower
Type 3: Container virtualization, runs within isolated cells and does not have its own kernel

136
Q

802.11x

A

Captive Portal

Sec+ 501 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions