Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + > Test Prep > Flashcards

Test Prep Flashcards

1
Q

MOU

A

Memorandum of understanding - preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve monetary exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Rules of engagement

A

define how that testing is to occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CRLF Injection

A

software application coding vulnerability that occurs when an attacker injects a CRLF character sequence where it is not expected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

MOA

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CSRF

A

malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Full Disk Encryption

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data Masking

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

LDAP

A

Lightweight directory access protocol: uses a client-server model for mutual authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Directory Traversal

A

allows attackers to access restricted directories and execute commands outside the web server’s root directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NTLM

A

Creates a 128-bit fixed output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RIPEMD

A

160-bit, 256-bit, or
320-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Air Gaps

A

designed to remove connections between two networks to create physical segmentation between them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Symmetric encryption

A

Private key : encryption algorithm in which both the sender and the receiver must
know the same secret using a privately-held key, 1 key

example: DES, IDEA, AES, RC4, RC5, Blowfish

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Asymmetric encryption

A

Public key: Encryption algorithm where different keys are used to encrypt and
decrypt the data, 2 keys are needed.

Example: Diffie-Hellman, RSA, ECC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Stream cipher

A

Utilizes a keystream generator to encrypt data bit by bit using a
mathematical XOR function to create the ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Block Cipher

A

Breaks the input into fixed-length blocks of data and performs the
encryption on each block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DES

A

Data encryption standard: Encryption algorithm which breaks the input into 64-bit blocks and uses
transposition and substitution to create ciphertext using an effective key
strength of only 56-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

3DES

A

Triple DES: uses three separate symmetric keys to encrypt, decrypt, then encrypt the plaintext into ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IDEA

A

International Data Encryption Algorithm: Symmetric block cipher which uses 64-bit blocks to encrypt plaintext into
ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

AES

A

Advanced encryption standard: uses 128-bit, 192-bit, or 256-bit blocks and a
matching encryption key size to encrypt plaintext into ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Blowfish

A

uses 64-bit blocks and a variable length
encryption key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Twofish

A

uses 128-bit blocks
and a 128-bit, 192-bit, or 256-bit encryption key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

RC4

A

Rivest Cipher: 40-bits to 2048-
bits that is used in SSL and WEP, this is the only stream cipher on the exam

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Diffie-Hellman

A

Diffie-Hellman is used for the establishment of a VPN tunnel using IPSec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

RSA

A

RSA is widely used for key exchange, encryption, and digital signatures RSA can use key sizes of 1024-bits to 4096-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

One-time pad

A

A stream cipher that encrypts plaintext information with a secret random
key that is the same length as the plaintext input

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Steganography

A

The science and art of hiding messages within other messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Ephemeral

A

A cryptographic key that is generated for each execution of a key
establishment process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Homomorphic Encryption

A

An encryption method that allows calculations to be performed on data
without decrypting it first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

MD5

A

Algorithm that creates a fixed-length 128-bit hash value unique to the
input file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

SHA-1

A

creates a fixed-length 160-bit hash value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

SHA-2

A

SHA-224, SHA-256, SHA-348, and
SHA512

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

SHA-3

A

creates hash digests between 224-bits and 512-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Pass the Hash

A

allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LM hash instead of requiring the associated plaintext password, Mimikatz tool helps to automate the harvesting of hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

PKI

A

Public key infrastructure: n entire system of hardware, software, policies, procedures, and people
that is based on asymmetric encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Wildcard certificates

A

Public key certificate that can be used with multiple subdomains of a domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

BER

A

Basic encoding rules: original ruleset governing the encoding of data structures for
certificates where several different encoding types can be utilized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

CER

A

Canonical Encoding Rules: only allows the use of only one encoding type

39
Q

DER

A

Distinguished encoding rules: allows one encoding type and has more restrictive rules for length, character strings, and how elements of a digital certificate are stored in X.509

40
Q

GLBA

A

Gramm-Leahc-Biliey Act - Financial institutions and how they are to protect their customers private information

41
Q

SOX

A

Sarbanes-Oxley - federal law that sets new or expanded requirements for all US public company boards, management, and public accounting firm

42
Q

FERPA

A

governs the access to educational information and records

43
Q

WPA

A

Wi-Fi protected access (WPA) is an improved encryption scheme for protecting Wi-Fi communications that was designed to replace WEP

44
Q

WPA3

A

Most secure - Wi-Fi protected access version 3 (WPA3) has replaced WPA2 as the most secure wireless encryption method

45
Q

WEP

A

Least secure - Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption.

46
Q

WPA2

A

Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard

47
Q

Protected Health Information

A

defined as any information that identifies someone as the subject of medical and insurance records, plus their associated hospital and laboratory test results.

requires notification of the individual, the Secretary of the US Department of Health and Human Services (HHS), and the media (if more than 500 individuals are affected)

48
Q

PII - Personally Identifiable Information

A

any data that can be used to identify, contact, or impersonate an individual

49
Q

syslog

A

a way network devices can use a standard message format to communicate with a logging server

50
Q

Proxy Server

A

server application that acts as an intermediary between a client requesting a resource and the server providing that resource.

51
Q

Port 389

A

LDAP - This includes the active directory

52
Q

Port 3389

A

RDP - Remote desktop protocol

53
Q

Port 21

A

FTP - File transfer protocol

54
Q

MAC

A

Mandatory access control - requires all access to be predefined based on system classification, configuration, and authentication

55
Q

Diamond Model of Intrusion Analysis

A

constructed around a graphical representation of an attacker’s behavior.

56
Q

OpenIOC

A

contains a depth of research on APTs but does not integrate the detection and mitigation strategy.

57
Q

Data Protection Officer (DPO)

A

ensure that her organization processes the personal data of its staff, customers, providers, or any other individuals

58
Q

Passive Reconnaissance

A

focuses on collecting information that is widely and openly available from publicly available sources.

59
Q

ICS/SCADA network

A

machines utilize very specific commands to control the equipment and to prevent malicious activity

60
Q

SPI

A

Sensitive Personal Information: information about an individual’s race or ethnic origin

61
Q

One-time use pad

A

Provides the strongest and most secure encryption - ensures that every message is encrypted with a different shared key that only the two owners of the one-time use pad would know.

62
Q

Port 445

A

SMB service

63
Q

Port 23

A

TELNET

64
Q

Port 69

A

TFTP

65
Q

Port 53

A

DNS

66
Q

EDM

A

Exact Data Match: a pattern matching technique that uses a structured database of string values to detect matches

67
Q

BeEF

A

penetration testing tool that focuses on the web browser.

68
Q

SSO

A

Single Sign On

69
Q

SAML

A

XML-based framework for exchanging security-related information such as user authentication, entitlement, and attributes

70
Q

PKI

A

Public key infrastructure: an entire system of hardware, software, policies and procedures that is based on asymmetric encryption

71
Q

SSL

A

Secure socket layer: Cryptographic protocols that provide secure internet communications for web browsing, email and many other services. Should NOT USE

72
Q

SSH

A

Secure Shell: A protocol that can create a secure channel between two computers or
network devices, one device takes control of another device.

73
Q

Port 22

A

SSH

74
Q

Port 1723

A

PPTP: Port to port tunneling protocol, A protocol that encapsulates PPP packets and ultimately sends data as
encrypted traffic

75
Q

Port 1701

A

L2TP: Layer 2 tunneling protocol

76
Q

Redundant Power Supply

A

An enclosure that provides two or more complete power supplies

77
Q

UPS

A

Uninterruptible Power Supply: Combines the functionality of a surge protector with that of a battery backup

78
Q

RAID

A

Redundant array of independent disks: Allows the combination of multiple physical hard disks into a single logical hard disk drive

79
Q

RAID 0

A

Provides data striping across multiple disks to increase performance

80
Q

RAID 1

A

Provides mirroring the data identically into two hard disks, least amount of down time

81
Q

RAID 5

A

Striping data and parity data across the disk drives, three physical disks needed.

82
Q

RAID 6

A

Striping data and double parity data across the disk drives, requires 4 physical disks

83
Q

RAID 10

A

Two mirrored RAIDS combines RAID 1 and RAID 0

84
Q

TLS

A

Transport Layer Security: Symmetric tunnel between the private keys

85
Q

Port 25

A

SMTP: Secure mail transfer protocol

86
Q

Incident response (IMPORTANT TO KNOW)

A

PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons learned

87
Q

SIEM

A

Security Information and Event Monitoring: combination of different data sources into one tool that provides real time analysis of security alerts generated by applications and network
hardware

88
Q

Tracert

A

displaying possible routes and
measuring transit delays of packets across an
Internet Protocol network

89
Q

nmap

A

An open-source network scanner that is used to discover hosts and
services on a computer network

90
Q

Shimming

A

Alters the external behavior of an application and at the same time does not introduce any changes to application code

91
Q

Refactoring

A

The practice of modifying an applications code without changing its external behavior

92
Q

RFID

A

Radio Frequency Identification: wireless system comprised of tags and readers

93
Q

VM Escape

A

Attack that allows an attacker to break out of a normally isolated VM

94
Q

subnetting

A

Act of creating subnetworks through manipulating IP addresses.

Security + (32 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions