Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ SY0-701 > Untitled Deck > Flashcards

Untitled Deck Flashcards

1
Q

Information Security

A

Protecting data and information from unauthorized access, modification, disruption, disclosure, and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information Systems Security

A

Protecting the systems (e.g., computers, servers, network devices) that hold and process critical data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CIA Triad

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Confidentiality

A

Ensures information is accessible only to authorized personnel (e.g., encryption)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrity

A

Ensures data remains accurate and unaltered (e.g., checksums)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Availability

A

Ensures information and resources are accessible when needed (e.g., redundancy measures)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Non-Repudiation

A

Guarantees that an action or event cannot be denied by the involved parties (e.g., digital signatures)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CIANA Pentagon

A

An extension of the CIA triad with the addition of non-repudiation and authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Triple A’s of Security

A

Authentication, Authorization, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Authentication

A

Verifying the identity of a user or system (e.g., password checks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Authorization

A

Determining actions or resources an authenticated user can access (e.g., permissions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Accounting

A

Tracking user activities and resource usage for audit or billing purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security Control Categories

A

Technical, Managerial, Operational, Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security Control Types

A

Preventative, Deterrent, Detective, Corrective, Compensating, Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Zero Trust Model

A

Operates on the principle that no one should be trusted by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Control Plane (Zero Trust)

A

Adaptive identity, threat scope reduction, policy-driven access control, and secured zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data Plane (Zero Trust)

A

Subject/system, policy engine, policy administrator, and establishing policy enforcement points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Threat

A

Anything that could cause harm, loss, damage, or compromise to our information technology systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Threat Sources

A

Natural disasters, Cyber-attacks, Data integrity breaches, Disclosure of confidential information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Vulnerability

A

Any weakness in the system design or implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Vulnerability Sources

A

Software bugs, Misconfigured software, Improperly protected network devices, Missing security patches, Lack of physical security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk

A

The intersection of a threat and a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Reasons Confidentiality is important

A

To protect personal privacy, To maintain a business advantage, To achieve regulatory compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Methods to ensure Confidentiality

A

Encryption, Access Controls, Data Masking, Physical Security Measures, Training and Awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Encryption

A

Process of converting data into a code to prevent unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Access Controls (Confidentiality)

A

Setting up strong user permissions to ensure only authorized personnel can access certain data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Data Masking

A

Obscuring specific data within a database for unauthorized users while retaining its use for authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Physical Security Measures (Confidentiality)

A

Ensuring confidentiality for both physical and digital information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Training and Awareness (Confidentiality)

A

Regular training on security awareness best practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Reasons Integrity is important

A

To ensure data accuracy, To maintain trust, To ensure system operability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Methods to maintain Integrity

A

Hashing, Digital Signatures, Checksums, Access Controls, Regular Audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Hashing

A

Process of converting data into a fixed-size value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Digital Signatures

A

Ensure both integrity and authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Checksums

A

Method to verify the integrity of data during transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Access Controls (Integrity)

A

Ensure only authorized individuals can modify data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Regular Audits

A

Systematically reviewing logs and operations to ensure only authorized changes have been made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Reasons Availability is important

A

Ensuring Business Continuity, Maintaining Customer Trust, Upholding an Organization’s Reputation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How to maintain Availability

A

Using redundancy in systems and network designs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Redundancy

A

Duplication of critical components or functions of a system to enhance reliability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Server Redundancy

A

Using multiple servers in a load-balanced or failover configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Data Redundancy

A

Storing data in multiple places

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Network Redundancy

A

Ensures that if one network path fails, the data can travel through another route

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Power Redundancy

A

Using backup power sources, like generators and UPS systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Reasons Non-repudiation is important

A

To confirm the authenticity of digital transactions, To ensure the integrity of critical communications, To provide accountability in digital processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

5 Commonly used Authentication Methods

A

Something you know (Knowledge Factor), Something you have (Possession Factor), Something you are (Inherence Factor), Something you do (Action Factor), Somewhere you are (Location Factor)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Something you know (Authentication)

A

Relies on information a user can recall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Something you have (Authentication)

A

Relies on the user presenting a physical item

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Something you are (Authentication)

A

Relies on a unique physical or behavioral characteristic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Something you do (Authentication)

A

Relies on a unique action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Somewhere you are (Authentication)

A

Relies on the user being in a certain geographic location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Multi-Factor Authentication (MFA)

A

Requires multiple methods of identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Reasons Authentication is critical

A

To prevent unauthorized access, To protect user data and privacy, To ensure resources are accessed by valid users only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Authorization

A

Permissions and privileges granted after authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Reasons Authorization mechanisms are important?

A

To protect sensitive data, To maintain system integrity, To create a streamlined user experience

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Accounting

A

Ensures all user activities are tracked and recorded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Reasons a robust Accounting system is important?

A

Create an audit trail, Maintain regulatory compliance, Conduct forensic analysis, Perform resource optimization, Achieve user accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Technologies used for Accounting

A

Syslog Servers, Network Analysis Tools, SIEM Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Syslog Servers

A

Aggregate logs from various devices for analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Network Analysis Tools

A

Capture and analyze network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

SIEM Systems

A

Real-time analysis of security alerts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Security Control Categories (4)

A

Technical, Managerial, Operational, Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Technical Controls

A

Technologies, hardware, and software to manage and reduce risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Managerial Controls

A

Strategic planning and governance of security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Operational Controls

A

Procedures and measures for day-to-day data protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Physical Controls

A

Tangible measures to protect assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Security Control Types (6)

A

Preventive, Deterrent, Detective, Corrective, Compensating, Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Preventive Controls

A

Proactive measures to thwart threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Deterrent Controls

A

Discourage attackers by making attacks less appealing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Detective Controls

A

Monitor and alert to malicious activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Corrective Controls

A

Mitigate damage and restore systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Compensating Controls

A

Alternative measures when primary controls are not feasible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Directive Controls

A

Guide, inform, or mandate actions (often policy-based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Gap Analysis

A

Evaluating the differences between current and desired performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Steps in Conducting a Gap Analysis

A

Define the scope, Gather data on the current state, Analyze the data, Develop a plan to bridge the gap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Types of Gap Analysis

A

Technical Gap Analysis, Business Gap Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Technical Gap Analysis

A

Evaluating technical infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Business Gap Analysis

A

Evaluating business processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Plan of Action and Milestones (POA&M)

A

Outlines measures to address vulnerabilities, allocate resources, and set timelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Zero Trust

A

Demands verification for every device, user, and transaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Two Planes of Zero Trust

A

Control Plane, Data Plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Control Plane (Zero Trust)

A

Framework for defining, managing, and enforcing access policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Elements of Control Plane (Zero Trust)

A

Adaptive Identity, Threat Scope Reduction, Policy-Driven Access Control, Secured Zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Adaptive Identity (Zero Trust)

A

Real-time validation based on user behavior, device, location, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Threat Scope Reduction (Zero Trust)

A

Limits user access to reduce the attack surface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Policy-Driven Access Control (Zero Trust)

A

Managing access based on roles and responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Secured Zones (Zero Trust)

A

Isolated environments for sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Components used by Control Plane (Zero Trust)

A

Policy Engine, Policy Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Policy Engine (Zero Trust)

A

Cross-references access requests with predefined policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Policy Administrator (Zero Trust)

A

Establishes and manages access policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Data Plane (Zero Trust)

A

Consists of the Subject/System and Policy Enforcement Point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Subject/System (Zero Trust)

A

The entity attempting to gain access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Policy Enforcement Point (Zero Trust)

A

Where access decisions are executed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Threat Actor Objectives

A

Summarize security concepts, Compare threat actors and motivations, Explain threat vectors and attack surfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Threat Actor Motivations

A

Data Exfiltration, Blackmail, Espionage, Service Disruption, Financial Gain, Philosophical/Political Beliefs, Ethical Reasons, Revenge, Disruption/Chaos, War

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Threat Actor Attributes

A

Internal vs. External, Differences in resources and funding, Level of sophistication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Types of Threat Actors

A

Unskilled Attackers, Hacktivists, Organized Crime, Nation-state Actors, Insider Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Unskilled Attackers (Script Kiddies)

A

Individuals with limited technical expertise who use readily available tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Hacktivists

A

Individuals or groups driven by political, social, or environmental ideologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Organized Crime

A

Groups that execute cyberattacks for financial gain (e.g., ransomware, identity theft)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Nation-state Actors

A

Highly skilled attackers sponsored by governments for cyber espionage or warfare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Insider Threats

A

Security threats originating from within the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Shadow IT

A

IT systems, devices, software, or services managed without explicit organizational approval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Threat Vector

A

The means or pathway by which an attacker gains unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Shadow IT

A

Use of information technology systems, devices, software, applications, and services without explicit organizational approval; IT-related projects managed outside of the IT department.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Why does Shadow IT exist?

A

An organization’s security posture is set too high or too complex, negatively affecting business operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Bring Your Own Devices (BYOD)

A

Involves the use of personal devices for work purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Threat Vector

A

The means or pathway by which an attacker can gain unauthorized access to a computer or network to deliver a malicious payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Attack Surface

A

Encompasses all the various points where an unauthorized user can try to enter or extract data from an environment. Can be minimized by restricting access, removing unnecessary software, and disabling unused protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Message-based Threat Vectors

A

Threats delivered via email, SMS text messaging, or other forms of instant messaging.

Phishing campaigns are commonly used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Phishing Campaigns (Message-based)

A

When an attacker impersonates a trusted entity to trick victims into revealing sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Image-based Threat Vectors

A

Embedding malicious code inside an image file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

File-based Threat Vectors

A

Files, often disguised as legitimate documents or software, transferred as email attachments, through file-sharing services, or hosted on malicious websites.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Voice Calls (Threat Vector)

A

Vhishing: Use of voice calls to trick victims into revealing sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Vhishing

A

Use of voice calls to trick victims into revealing sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

Removable Devices (Threat Vector)

A

One common technique is baiting: leaving a malware-infected USB drive in a public location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Baiting (Removable Devices)

A

An attacker leaves a malware-infected USB drive in a location where a target might find it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Unsecure Networks (Threat Vector)

A

Wireless, wired, and Bluetooth networks that lack appropriate security measures. Unauthorized access can intercept communications or gain network access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

MAC Address Cloning

A

An attack that can occur with physical access to network infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

VLAN Hopping

A

An attack that can occur with physical access to network infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

BlueBorne

A

A set of vulnerabilities in Bluetooth technology that allows attackers to take over devices, spread malware, or establish on-path attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

BlueSmack

A

A type of Denial of Service attack targeting Bluetooth devices by sending a specially crafted packet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Deception and Disruption Technologies

A

Technologies designed to mislead, confuse, and divert attackers while detecting and neutralizing threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

Tactics, Techniques, and Procedures (TTPs)

A

Specific methods and patterns of activities associated with a particular threat actor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Honeypots

A

Decoy systems or networks set up to attract potential hackers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Honeynets

A

A network of honeypots designed to mimic an entire network of systems (servers, routers, switches).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Honeyfiles

A

Decoy files placed within a system to lure attackers.

127
Q

Honeytokens

A

Pieces of data or resources with no legitimate value but are monitored for access or use.

128
Q

Bogus DNS entries

A

Fake Domain Name System entries introduced into a system’s DNS server.

129
Q

Creating decoy directories

A

Fake folders and files placed within a system’s storage.

130
Q

Dynamic page generation

A

Effective against automated scraping tools or bots trying to index or steal content.

131
Q

Port Triggering

A

Security mechanism where services/ports remain closed until a specific outbound traffic pattern is detected.

132
Q

Spoofing fake telemetry data

A

When a system detects a network scan, it can be configured to respond with fake network data.

133
Q

Physical Security

A

Measures to protect tangible assets (buildings, equipment, people) from harm or unauthorized access.

134
Q

Fencing and Bollards

A

Physical security controls. Fences are barriers made of posts and wire or boards. Bollards are short, sturdy vertical posts preventing vehicle access.

135
Q

Fences

A

Barriers made of posts and wire or boards to enclose or separate areas; provide visual deterrent, physical barrier, and delay intruders.

136
Q

Bollards

A

Robust, short vertical posts (steel or concrete) designed to manage or redirect vehicular traffic.

137
Q

Brute Force Attacks (Physical Security)

A

Forcible entry, tampering with security devices, confronting security personnel, or ramming barriers with vehicles.

138
Q

Forcible Entry

A

Gaining unauthorized access by physically breaking or bypassing barriers (windows, doors, fences).

139
Q

Tampering with security devices

A

Manipulating security devices to create exploitable vulnerabilities.

140
Q

Confronting security personnel

A

Direct confrontation or attack of an organization’s security personnel.

141
Q

Ramming barriers with vehicles

A

Using a vehicle to ram into physical security barriers.

142
Q

Surveillance Systems

A

An organized strategy to observe and report activities. Components include video surveillance, security guards, lighting, and sensors.

143
Q

Video Surveillance

A

Can include motion detection, night vision, facial recognition, and remote access.

144
Q

Security Guards

A

Flexible and adaptable forms of surveillance.

145
Q

Lighting

A

Crucial for effective surveillance; deters criminals, reduces hiding spots, and enhances video quality.

146
Q

Sensors

A

Devices that detect and respond to external stimuli. Categories include infrared, pressure, microwave, and ultrasonic.

147
Q

Infrared Sensors

A

Detect changes in infrared radiation (emitted by warm bodies).

148
Q

Pressure Sensors

A

Activated when a specified weight is detected.

149
Q

Microwave Sensors

A

Detect movement by emitting microwave pulses and measuring reflections.

150
Q

Ultrasonic Sensors

A

Measure the reflection of ultrasonic waves off moving objects.

151
Q

Bypassing Surveillance Systems

A

Visual obstruction, blinding sensors/cameras, interfering with acoustics or electromagnetics, or attacking the physical environment.

152
Q

Visual Obstruction

A

Blocking a camera’s line of sight (e.g., paint, stickers, objects).

153
Q

Blinding Sensors and Cameras

A

Overwhelming a sensor or camera with a sudden burst of light.

154
Q

Interfering with Acoustics

A

Jamming or playing loud music to disrupt microphones.

155
Q

Interfering with Electromagnetic Signals (EMI)

A

Jamming the signals that surveillance systems rely on.

156
Q

Attacking the Physical Environment

A

Physically tampering with surveillance equipment (e.g., cutting wires).

157
Q

Access Control Vestibules

A

Double-door systems electronically controlled so only one door is open at a time; prevents piggybacking and tailgating.

158
Q

Piggybacking

A

Two people working together; one with access allows another without access to enter.

159
Q

Tailgating

A

An unauthorized person closely follows someone with access into a secure area without their knowledge.

160
Q

Door Locks

A

Restrict and regulate access to spaces. Types include padlocks, pin and tumbler locks, numeric locks, wireless locks, biometric locks, and cipher locks.

161
Q

Padlocks

A

Easily defeated, offer minimal protection.

162
Q

Basic Door Locks

A

Vulnerable to simple techniques like lock picking.

163
Q

Modern Electronic Door Locks

A

Utilize various authentication methods (identification numbers, wireless signals, biometrics).

164
Q

Biometric Challenges

A

False Acceptance Rate (FAR), False Rejection Rate (FRR), Crossover Error Rate (CER).

165
Q

False Acceptance Rate (FAR)

A

System erroneously authenticates an unauthorized user.

166
Q

False Rejection Rate (FRR)

A

System denies access to an authorized user.

167
Q

Crossover Error Rate (CER)

A

Balance between FAR and FRR for optimal authentication.

168
Q

Cipher Locks

A

Mechanical locks with numbered push buttons requiring a correct combination.

169
Q

Access Badge Cloning

A

Copying data from an RFID or NFC card onto another device. Steps: Scanning, Data Extraction, Writing, Using.

170
Q

Radio Frequency Identification (RFID)

A

A technology used for contactless authentication.

171
Q

Near Field Communication (NFC)

A

A technology used for contactless authentication.

172
Q

Social Engineering

A

Manipulative strategy exploiting human psychology for unauthorized access.

173
Q

Motivational Triggers (Social Engineering)

A

Familiarity/Likability, Consensus/Social Proof, Authority/Intimidation, Scarcity/Urgency, Fear.

174
Q

Authority (Social Engineering)

A

People comply if they believe the request comes from someone in authority.

175
Q

Urgency (Social Engineering)

A

Creating a sense of immediacy to drive quick action.

176
Q

Social Proof (Social Engineering)

A

Looking to others’ behaviors to determine one’s own actions.

177
Q

Scarcity (Social Engineering)

A

Psychological pressure when a resource is perceived as limited.

178
Q

Likability (Social Engineering)

A

People want to interact with those they like.

179
Q

Fear (Social Engineering)

A

Threatening negative consequences if instructions aren’t followed.

180
Q

Impersonation (Social Engineering)

A

Pretending to be someone else. Includes brand impersonation, typosquatting, and watering hole attacks.

181
Q

Brand Impersonation

A

Pretending to represent a legitimate company or brand.

182
Q

Typosquatting/URL Hijacking/Cybersquatting

A

Registering domain names similar to popular websites with typographical errors.

183
Q

Watering Hole Attacks

A

Compromising a website or service that a target is known to use.

184
Q

Pretexting

A

Creating a fabricated scenario to manipulate targets.

185
Q

Phishing

A

Sending fraudulent emails to obtain personal information.

186
Q

Spear Phishing

A

Targeted phishing focused on a specific group or organization.

187
Q

Whaling

A

Targets high-profile individuals (CEOs, CFOs).

188
Q

Business Email Compromise (BEC)

A

Using a compromised business email account to trick other employees.

189
Q

Vishing (Voice Phishing)

A

Tricking victims into sharing information over the phone.

190
Q

Smishing (SMS Phishing)

A

Using text messages to trick individuals into providing information.

191
Q

Key Indicators of Phishing

A

Urgency, unusual requests, mismatched URLs, strange email addresses, poor spelling/grammar.

192
Q

Frauds

A

Wrongful or criminal deception for financial or personal gain.

193
Q

Identity Fraud/Identity Theft

A

Using another person’s information without authorization.

194
Q

Scams

A

Fraudulent or deceptive acts or operations.

195
Q

Invoice Scam

A

A scam in which a person is tricked into paying for a fake invoice for a product or service they did not order.

196
Q

Influence Campaigns

A

Coordinated efforts to affect public perception or behavior towards a particular cause, individual, or group. They foster misinformation and disinformation.

197
Q

Misinformation

A

False or inaccurate information shared without harmful intent.

198
Q

Disinformation

A

The deliberate creation and sharing of false information with the intent to deceive or mislead.

199
Q

Diversion Theft

A

Involves manipulating a situation or creating a distraction to steal valuable items or information.

200
Q

Hoaxes

A

Malicious deceptions often spread through social media, email, or other communication channels, often paired with phishing and impersonation. Prevention requires fact-checking and critical thinking.

201
Q

Shoulder Surfing

A

Involves looking over someone’s shoulder to gather personal information, sometimes using cameras. Prevention requires awareness of surroundings.

202
Q

Dumpster Diving

A

Searching through trash to find valuable information, often discarded documents. Prevention involves clean desk and clean desktop policies.

203
Q

Eavesdropping

A

Secretly listening to private conversations, intercepting communications without knowledge. Prevention involves data encryption in transit.

204
Q

Baiting

A

Leaving a malware-infected physical device (e.g., USB drive) in a place where it will be found by a victim. Prevention requires user training not to use found devices.

205
Q

Tailgating

A

An attacker follows an employee through an access control point without their knowledge.

206
Q

Piggybacking

A

An attacker convinces an authorized employee to let them into a facility by having them swipe their access badge.

207
Q

Malware

A

Malicious software designed to infiltrate and potentially damage computer systems without user consent. Categories include viruses, worms, Trojans, ransomware, spyware, rootkits, and spam.

208
Q

Threat Vector

A

The method used to infiltrate a victim’s machine (e.g., unpatched software, USB drives, phishing).

209
Q

Attack Vector

A

The means by which the attacker gains access and infects the system, combining infiltration method and infection process.

210
Q

Viruses

A

Attach to clean files, spread, and corrupt host files.

211
Q

Worms

A

Standalone programs replicating and spreading to other computers without user interaction.

212
Q

Trojans

A

Disguise as legitimate software, granting unauthorized access.

213
Q

Ransomware

A

Encrypts user data and demands ransom for decryption.

214
Q

Zombies/Botnets

A

Compromised computers (zombies) remotely controlled in a network (botnet) for malicious purposes.

215
Q

Rootkits

A

Hide presence and activities on a computer, operating at the OS level.

216
Q

Backdoors

A

Bypass normal security and authentication functions, often placed by designers/programmers or threat actors.

217
Q

Logic Bombs

A

Malicious code that executes only when specific conditions are met.

218
Q

Keyloggers

A

Record every keystroke made on a computer or mobile device.

219
Q

Spyware

A

Monitors and gathers user/system information without knowledge.

220
Q

Bloatware

A

Unnecessary software pre-installed on devices, consuming resources and potentially introducing vulnerabilities.

221
Q

Computer Virus

A

Malicious code that runs on a machine without the user’s knowledge, infecting the computer when executed.

222
Q

Boot Sector Virus

A

Stored in the first sector of a hard drive, loaded into memory upon boot-up.

223
Q

Macro Virus

A

Code embedded inside a document, executing when the document is opened.

224
Q

Program Virus

A

Infects executable or application files.

225
Q

Multipartite Virus

A

Combines boot sector and program virus characteristics.

226
Q

Encrypted Virus

A

Hides from detection by encrypting its code/payloads.

227
Q

Polymorphic Virus

A

Changes its code each time it executes to evade detection.

228
Q

Metamorphic Virus

A

Rewrites itself entirely before infecting a file.

229
Q

Stealth Virus

A

Uses techniques to prevent detection by antivirus software.

230
Q

Armored Virus

A

Has a layer of protection to confuse analysis.

231
Q

Hoax Virus

A

A form of technical social engineering that scares users into undesirable actions.

232
Q

Worm

A

Self-replicating malicious software that spreads without user interaction, disrupting network traffic.

233
Q

Trojan

A

Malicious software disguised as harmless or desirable software.

234
Q

Remote Access Trojan (RAT)

A

Provides an attacker with remote control of a victim’s machine.

235
Q

Ransomware

A

Malware that blocks access to a system or data by encrypting it until a ransom is paid.

236
Q

Botnet

A

A network of compromised computers or devices controlled remotely.

237
Q

Zombie

A

A compromised computer or device within a botnet.

238
Q

Command and Control Node

A

The computer managing and coordinating botnet activities.

239
Q

Distributed Denial-of-Service (DDoS) Attack

A

Many machines target a single victim simultaneously.

240
Q

Rootkit

A

Designed to gain administrative-level control over a system without detection.

241
Q

Administrator/Root Account

A

Account with the highest level of permissions.

242
Q

Kernel Mode

A

Operating at Ring 0, controlling access to device drivers and other core system functions.

243
Q

DLL Injection

A

Technique to run arbitrary code within another process by forcing it to load a dynamic-link library.

244
Q

Dynamic Link Library (DLL)

A

A collection of code and data used by multiple programs.

245
Q

Shim

A

Software code placed between two components to intercept and redirect calls.

246
Q

Backdoor

A

Bypasses normal security and authentication functions.

247
Q

Easter Egg

A

A hidden feature or novelty within a program.

248
Q

Logic Bomb

A

Malicious code that executes when specific conditions are met.

249
Q

Keylogger

A

Software or hardware that records every keystroke.

250
Q

Spyware

A

Malicious software designed to gather and send user/organization information without knowledge.

251
Q

Bloatware

A

Unnecessary software pre-installed on devices.

252
Q

Stage 1 Dropper/Downloader

A

Malware that retrieves additional malware code and tricks the user into activating it.

253
Q

Dropper

A

Malware designed to initiate or run other malware forms within a payload.

254
Q

Downloader

A

Retrieves additional tools post-initial infection.

255
Q

Shellcode

A

Lightweight code meant to execute an exploit.

256
Q

Stage 2 Downloader

A

Downloads and installs a remote access Trojan.

257
Q

“Actions on Objectives” Phase

A

Threat actors execute primary objectives (e.g., data exfiltration, file encryption).

258
Q

Concealment

A

Hiding tracks and erasing logs to prolong unauthorized access.

259
Q

“Living off the Land”

A

Exploiting standard system tools for intrusions.

260
Q

Account Lockouts

A

Multiple failed login attempts.

261
Q

Concurrent Session Utilization

A

Multiple simultaneous sessions from a single account.

262
Q

Blocked Content

A

Increased alerts from security tools.

263
Q

Impossible Travel

A

Account access from geographically separated locations in an impossibly short time.

264
Q

Resource Consumption

A

Unusual spikes in CPU, memory, or network bandwidth.

265
Q

Resource Inaccessibility

A

Files or systems suddenly become inaccessible.

266
Q

Out-of-Cycle Logging

A

Logs generated at odd hours.

267
Q

Missing Logs

A

Gaps in logs or cleared logs without authorization.

268
Q

Published/Documented Attacks

A

Reports of network infection.

269
Q

Data Protection

A

Safeguarding information from corruption, compromise, or loss.

270
Q

Data Classifications

A

Categorizing data based on value and sensitivity (e.g., Sensitive, Confidential, Public).

271
Q

Data Owners

A

Senior executives responsible for labeling and protecting information assets.

272
Q

Data Controllers

A

Entities responsible for determining data storage, collection, and usage purposes.

273
Q

Data Processors

A

Entities hired by data controllers to assist with data tasks.

274
Q

Data Stewards

A

Focus on data quality and metadata, ensuring proper labeling and classification.

275
Q

Data Custodians

A

Responsible for managing data storage systems and enforcing access controls.

276
Q

Data States

A

Data at rest, data in transit, and data in use.

277
Q

Data at Rest

A

Inactive data on storage devices.

278
Q

Data in Transit/Data in Motion

A

Data actively moving from one location to another.

279
Q

Data in Use

A

Data actively being created, retrieved, updated, or deleted.

280
Q

Full Disk Encryption (FDE)

A

Encrypts the entire hard drive.

281
Q

Partition Encryption

A

Encrypts specific partitions.

282
Q

File Encryption

A

Encrypts individual files.

283
Q

Volume Encryption

A

Encrypts selected files or directories.

284
Q

Database Encryption

A

Encrypts data within a database.

285
Q

Record Encryption

A

Encrypts specific fields within a database record.

286
Q

SSL (Secure Sockets Layer)/TLS (Transport Layer Security)

A

Secure communication over networks.

287
Q

VPN (Virtual Private Network)

A

Creates secure connections over less secure networks.

288
Q

IPSec (Internet Protocol Security)

A

Secures IP communications by authenticating and encrypting IP packets.

289
Q

Encryption at the Application Level

A

Encrypts data during processing.

290
Q

Access Controls

A

Restricts access to data during processing.

291
Q

Secure Enclaves

A

Isolated environments for processing sensitive data.

292
Q

Regulated Data

A

Controlled by laws, regulations, or industry standards.

293
Q

PII (Personal Identification Information)

A

Information used to identify an individual.

294
Q

PHI (Protected Health Information)

A

Information about health status, healthcare provision, or payment.

295
Q

Trade Secrets

A

Confidential business information giving a competitive edge.

296
Q

Intellectual Property (IP)

A

Creations of the mind (e.g., inventions, literary works).

297
Q

Legal Information

A

Data related to legal proceedings, contracts, or regulatory compliance.

298
Q

Financial Information

A

Data related to financial transactions.

299
Q

Human-Readable Data

A

Understandable directly by humans.

300
Q

Non-Human-Readable Data

A

Requires a machine or software to interpret.

301
Q

Data Sovereignty

A

Digital information is subject to the laws of the country where it is located.

302
Q

GDPR (General Data Protection Regulation)

A

Protects EU citizens’ data.

303
Q

Geographic Restrictions/Geofencing

A

Virtual boundaries to restrict data access based on location.

304
Q

Encryption

A

Transforms plaintext into ciphertext.

305
Q

Hashing

A

Converts data into fixed-size hash values.

306
Q

Masking

A

Replaces data with placeholders.

307
Q

Tokenization

A

Replaces sensitive data with non-sensitive tokens.

308
Q

Obfuscation

A

Makes data unclear or unintelligible.

309
Q

Segmentation

A

Divides a network into separate segments.

310
Q

Permission Restrictions

A

Defining data access and actions through ACLs or RBAC.

311
Q

Data Loss Prevention (DLP)

A

A strategy to prevent sensitive information from leaving an organization.

312
Q

Endpoint DLP System

A

Installed on workstations/laptops, monitors data in use.

313
Q

Network DLP System

A

Monitors data in transit across the network.

CompTIA Security+ SY0-701 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions