Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ Self Sudy Dump > Threats, Attacks, and Vulnerabilities > Flashcards

Threats, Attacks, and Vulnerabilities Flashcards

1
Q

What is the difference between intrusive versus non-intrusive vulnerability scans?

A

Non-intrusive identifies active OSs, applications, and ports by scanning system attributes, which intrusive actually probes devices and examines their responses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which type of attack involves flooding a recipient e-mail address with identical e-mails?

A

Spamming attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What type of attack sequentially generates every possible password and checks them all against a password file

A

Brute force attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which type of attack allows an attacker to redirect Internet traffic by setting up a fake DNS server to answer client requsts?

A

DNS spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is spear phishing?

A

Phishing attempt that appears to come from a trusted person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a replay attack?

A

An attack where an intruder records the communication between a user and a server, and plays the recorded information back to impersonate the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does the acronym XSRF denote>

A

Cross-Site Request Forgery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What category of threat actor is most likely to have high funding and a high level of sophistication?

A

State actors or APTs (Advanced Persistent Threats)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What occurs during grey-box testing?

A

Security professionals with limited inside knowledge of the network attempted to hack into the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What social engineering principle is being used when limited availability is used as a technique

A

Scarcity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is bluesnarfing?

A

The act of gaining unauthorized access to a device (and the network it is connected to) through its Bluetooth connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a flaw, loophole, or weakness in the system, software, or hardware?

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What viruses are written in a macro language and typically infect operating systems?

A

Macro viruses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is phishing

A

When a request for confidential information that appears to originate from a seemingly trusted entity is recieved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What self-replicating computer program sends copies of itself to other devices on the network?

A

Worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the most likely cause of a single computer communicating with an unknown IRC server and scanning other systems on the network

A

The computer is infected with a botnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is pharming

A

Traffic redirection to a website that looks identical to the intended website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What type of attack embeds an intruder to capture and modify data traffic by rerouting the traffic from a network device to the intruder’s computer

A

Network address hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What category of vulnerability includes injection, cross-site scripting, and cross-site request forgery

A

Improper input handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a trojan horse?

A

Malware that is disguised as a useful utility, but is embedded with a malicious code to infect computer systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Nessus?

A

Network vulnerability scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is an evil twin?

A

An access point with the same SSID as the legitimate access point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does the acronym XSS denote?

A

Cross site scripting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an integer overflow

A

When an application or OS tries to place into computer memory an integer that is too large for the data type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a zero-day exploit

A

An attack that exploits a security vulnerability on the day the vulnerability becomes generally known

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which virus creates many variants by modifying its code to decieve antivirus scanners

A

Polymorphic virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which malicious software infects a system without relying upon other applications for its executing

A

Worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the term for a potential opening in network security that a hacker can exploit to attack a network

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which type of attack intercepts an established TCP session?

A
  • TCP hijacking

* Session hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which type of attack does Challenge Handshake Authentication Protocol (CHAP) protect against?

A

Replay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is meant by the term data exfiltration

A

The unauthorized transfer of data from a computer or device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which error condition arises because data is not checked before input to ensure that it has an appropriate length?

A

Buffer overflow errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which type of attack runs code within another process’s address space by making it a dynamic link library

A

DLL injection attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which attack is an extension of the denial-of-service (DoS) attack and uses multiple computers

A

A distributed denial of service attack (DDoS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which type of brute-force attack attempts to find any two hashed passwords or messages that have the same value

A

Birthday attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What type of virus can change its signature to avoid detection

A

Polymorphic virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the difference between credentialed and non credentialed vulnerability scans

A
  • Credentialed vulnerability scans use authentication to simulate an administrator or use on the system
  • Non credentialed vulnerability scans do not authenticate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which type of attack is characterized by an attacker who takes over the session of an already authenticated user?

A

Hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What does the acronym DDoS denote?

A

Distributed denial of service

40
Q

Which type of attack is characterized by an attacker who records an encrypted transmission between a client and a server computer so that they can then send it to the server to gain access?

A

Replay attack

41
Q

Which type of virus attempts to hide from antivirus software and from the operating system by remaining in memeory?

A
  • Fileless virus

* Stealth

42
Q

What is a malicious insider?

A

An employee who uses his access to the network and facility to obtain confidential information

43
Q

What occurs during white-box testing

A

A security firm is provided with a production-like test environment, login details, production documentation, and source code

44
Q

What is bluejacking

A

An attack that sends spam over a bluetooth connection

45
Q

What are the nine categories of threat actors according to the CompTIA Security+ blueprint?

A
  • Script Kiddies
  • Hacktivist
  • Criminal syndicates
  • State actors
  • Advanced Persistent Threat (APT)
  • Insiders
  • Hackers
  • Shadow IT
  • Competitors
46
Q

What is the name for a hole in the security of an application deliberately left in place by a designer

A

Backdoor

47
Q

What is an attempt by someone to get one or more users to believe that a specific computer virus exist

A

Hoax

48
Q

What is spimming

A

Spam sent over instant messaging applications

49
Q

What social engineering principle is being used when limited time is used as a technique

A

Urgency

50
Q

What social engineering principle is being used when an attacker pretends to be a member of law enforcement to obtain information

A

Authority

51
Q

What social engineering principle is being used when bullying tactics are employed to obtain information

A

Intimidation

52
Q

What is a smurf attack?

A

An attack where a ping request is sent to a broadcast network address with the aim to overwhelm the system

53
Q

What social engineering principle is being used when an attacker attempts to build rapport?

A

Familiarity or liking

54
Q

Which type of attack is characterized by an attacker who situates themselves in such a way that they can intercept all traffic between two hosts?

A

Man-in-the-middle

55
Q

What type of malware appears to perform a valuable function, but actually performs malicious acts

A

Trojan

56
Q

Which attack requires that a hacker compromises as many computers as possible to initiate the attack

A

Distributed Denial of Service (DDoS) attack

57
Q

What is click-jacking

A

Tricking a web user into clicking a spoofed button or graphic in place of the one the user is trying to click

58
Q

What is a race condition?

A

A flaw that produces an unexpected result when the timing of actions impact other actions

59
Q

What conditions or event does a pointer dereference usually cause

A

An application crash

60
Q

Which type of code performs malicious acts only when a certain set of conditions occurs?

A

Logic bomb

61
Q

What are alternate terms for cross-site request forgery (XSRF)?

A
  • Session riding

* One-click attack

62
Q

According to CompTIA’s Security+ examination blueprint, what are the seven listed reasons for effectiveness for social engineering attacks

A
  • Authority
  • Intimidation
  • Consensus
  • Scarcity
  • Urgency
  • Familiarity
  • Trust
63
Q

What address is faked with IP spoofing attacks?

A

The source IP address

64
Q

What is the best protection against cross-site scripting (XSS)?

A

Disable the running of scripts

65
Q

What is vishing?

A

Phishing via Voice over IP (VoIP)

66
Q

What is an IV attack?

A

Cracking the WEP secret key using the initialization vector (IV)

67
Q

What is the purpose of dumpster diving?

A

To discover confidential information, such as user passwords

68
Q

What is meant by the term end-of-life system

A

A device, OS, or application that is no longer supported by the vender

69
Q

What is an IP spoofing attack?

A

An attack in which the source IP address in an IP datagram is modified to imitate the IP address of a packet originating from an authorized source

70
Q

Which error occurs when the length of the input data is more than the length of the processor buffer can handle

A

Buffer overflow

71
Q

Which attack uses clients, handles, agents, and targets?

A

Distributed Denial of Service (DDoS) attack

72
Q

What does the acronym APT denote?

A

Advanced Persistent Threat

73
Q

What is XML injection?

A

When a user enters values in an XML query that takes advantage of security loopholes

74
Q

What is the act of gaining unauthorized access to a facility by using another user’s access credentials?

A
  • Tailgating

* Piggybacking

75
Q

Which type of attack searches long lists of words for a particular language to match them to an encrypted password

A

Dictionary Attack

76
Q

What is a command injection?

A

When an operating system command is submitted in an HTML string

77
Q

What is the greatest security risk of instant messaging?

A

Impersonation

78
Q

What category of threat actor is most likely to be trying to make a political statement

A

Hacktivist

79
Q

What is war driving?

A

The act of discovering unprotected wireless network by driving around with a laptop

80
Q

What is an injection attack?

A

When an application is tricked into including unintended commands in the data sent to the interpreter

81
Q

What is war chalking?

A

Leaving signals about a wireless network on the outside of the building where it is housed

82
Q

What social engineering principle is being used when fake testimonials are used to promote a fake security product?

A
  • Consensus

* Social proof

83
Q

Which type of attack do privacy screens protect against

A

Shoulder surfing

84
Q

What assessment determines whether network security is properly configured to rebuff hacker attacks?

A

Penetration test

85
Q

In which type of attack is a user connected to a different web server than the one inteded by the user

A

Hyperlink spoofing attack

86
Q

What is a memory leak?

A

The failure of an OS or application to free up dynamically requested memory

87
Q

What is cross-site scripting?

A

Injection of malicious code into a vulnerable web application or database that will execute scripts in a victim’s browser

88
Q

What is whaling?

A

Phishing that targets a single power user, such as a CEO of a company

89
Q

What is cross-site request forgery (XSRF)?

A

Unauthorized commands coming from a trusted user to a user or website, usually through social networking

90
Q

What social engineering principle is being used when an attacker builds a long-term relationship?

A

Trust

91
Q

Which category of threat actor is most likely to be acting out of a grievance against the organization?

A

Insider

92
Q

What is cross-site request forgery?

A

Tricking a web browser into executing a malicious action on a trusted site for which the user is currently authenticated

93
Q

What is a phishing attack?

A

An attack where a user is sent a message that appears to come from a valid entity asking for personally identifiable information (PII)

94
Q

What is an Xmas attack?

A

An attack that looks for open ports

95
Q

Are instant messages typically encrypted

A

No

Security+ Self Sudy Dump (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions