Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ > Operations and Incident Responses > Flashcards

Operations and Incident Responses Flashcards

1
Q

How do hardware-based authentication methods enhance security?

A

Hardware-based authentication methods, such as password keys, provide an additional layer of security - requiring a physical key to be present for login. Password vaults, or password managers, securely store all passwords in one location and allow the use of unique passwords across different sites.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are some common account policies for enhancing security?

A

Account policies include password complexity and length requirements, account lockout and disablement after too many incorrect login attempts, location-based policies for network access, routine audits to ensure policy compliance, and auditing permissions and resource usage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How does Kerberos enable single sign-on (SSO)?

A

Kerberos is a network authentication protocol that allows users to authenticate once and be trusted by the system without needing to re-authenticate for every service. This eliminates the need for constant username and password input, providing a seamless SSO experience across multiple services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the purpose of RADIUS in authentication management?

A

RADIUS (Remote Authentication Dial-in User Service) is an AAA protocol that centralizes authentication for different platforms and devices. It can be used to authenticate users for routers, switches, firewalls, server access, remote VPN connections, and 802.1X network access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are PAP and CHAP, and how do they differ in terms of security?

A

PAP (Password Authentication Protocol) is a basic authentication method used in legacy operating systems. It transmits passwords in clear text, making it a weak authentication scheme. CHAP (Challenge-Handshake Authentication Protocol) uses encrypted challenges and password hashes, providing stronger security than PAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does dnsenum contribute to network reconnaissance?

A

dnsenum is used to enumerate DNS information, such as finding host names and viewing host information from DNS servers. It can help discover hosts listed in DNS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is knowledge-based authentication (KBA) and how does it work?

A

Knowledge-based authentication uses personal knowledge as an authentication factor. Static KBA relies on pre-configured shared secrets, often used for account recovery. Dynamic KBA generates questions based on an identity verification service. Questions can be specific to the user’s history or personal information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the purpose of scanless tool in reconnaissance?

A

Scanless allows you to run port scans from a different host, acting as a port scan proxy. It provides options for choosing the option for scan origination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are some hardware-based cryptographic functions used for authentication management?

A

Trusted Platform Module (TPM) provides cryptographic functions such as random number generation, key generation, and secure storage. It comes with unique keys burned in during production. Hardware Security Modules (HSMs) are high-end cryptographic hardware devices that offer key backup, cryptographic accelerators, and are commonly used in large environments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can theHarvester tool be used to gather OSINT?

A

theHarvester scrapes information from search engines, social media platforms, DNS servers, and other sources to gather open-source intelligence (OSINT).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the purpose of route command in networking?

A

The route command allows you to view the device’s routing table, which shows the paths that packets will take when traveling through the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How does the Challenge-Handshake Authentication Protocol (CHAP) work?

A

How CHAP works:
1. An encrypted challenge is sent by the server to authenticate the client.
2. The client responds with a password hash calculated from the challenge and the password.
3. The server compares the received hash with the stored hash to verify the client’s identity.

MS-CHAP is Microsoft’s implementation of CHAP, commonly used in PPTP connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How does Address Resolution Protocol (ARP) help in determining MAC addresses?

A

ARP allows you to determine the MAC address based on an IP address, which is necessary for communication at the hardware level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the purpose of Nessus in vulnerability scanning?

A

Nessus is an industry-leading vulnerability scanner that identifies known vulnerabilities in systems, helping to find and address potential security risks before they can be exploited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are some common AAA protocols used for centralizing authentication?

A

RADIUS (Remote Authentication Dial-in User Service) is a widely supported AAA protocol that centralizes authentication for various platforms and devices. It can be used for routers, switches, firewalls, server authentication, remote VPN access, and 802.1X network access. TACACS+ and XTACACS are Cisco-created versions of TACACS with additional features like accounting and auditing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How do IP scanners contribute to network reconnaissance?

A

IP scanners are used to search a network for IP addresses, locate active devices, and gather information about services and hosts that are listed in DNS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Kerberos and how does it enable single sign-on (SSO)?

A

<div>Kerberos is a network authentication protocol that allows users to authenticate once and be trusted by the system without needing to re-authenticate for every service. It provides mutual authentication between the client and server, protecting against on-path or replay attacks. SSO with Kerberos eliminates the need for constant username and password input, saving time for users.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some common uses of netcat tool in networking?

A

<div>Netcat can be used to read from or write to the network, listen on a port number, transfer data, scan ports, send data to a port, and even become a backdoor for remote access.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How do hardware-based authentication methods and password vaults enhance security?

A

<div>Hardware-based authentication methods, such as password keys and Trusted Platform Modules (TPM), provide an additional layer of security by requiring a physical key or secure storage for credentials. Password vaults, also known as password managers, securely store all passwords in one location, encrypting them and allowing the use of unique passwords across different sites.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does netstat help in troubleshooting network connections?

A

<div>Netstat provides network statistics and allows you to view active connections, binaries associated with those connections, and additional IP details.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the purpose of using ping tool in networking?

A

<div>Ping is used to test reachability and determine round-trip time by sending ICMP (Internet Control Message Protocol) packets to a host.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are some important considerations for account policies?

A

<div>Account policies go beyond usernames and passwords and include factors like password complexity and length, account lockout and disablement, location-based policies, auditing, and routine audits. Routine audits help ensure policy compliance, while auditing checks permissions and resource usage.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How does Nmap contribute to network mapping and vulnerability scanning?

A

<div>Nmap is a network mapper that can scan for devices, identify open ports, discover the operating system without logging in, and provide details about services running on a device.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the different types of user accounts and their characteristics?

A

<div>User accounts are associated with specific individuals on a computer and have private storage and files. Shared and generic accounts are used by multiple people but lack proper audit trails and make password management difficult. Guest accounts provide limited access to guests, while service accounts are used exclusively by services running on a computer. Privileged accounts have elevated access to one or more systems and should be highly secured.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the purpose of theHarvester tool in reconnaissance?

A

<div>theHarvester is used to gather open-source intelligence (OSINT) by scraping information from search engines, social media platforms, DNS servers, and other sources.</div>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How does curl tool help in retrieving data from a URL?

A

<div>Curl is a client URL tool that allows you to retrieve data using a URL, such as web pages, FTP, emails, databases, etc.</div>

27
Q

How do SSH keys contribute to secure terminal communication and automation?

A

<div>SSH keys use a public/private key pair instead of a username and password for authentication. They are critical for secure terminal communication and are commonly used for automation purposes. Key management is important to centralize, control, and audit key use.</div>

28
Q

What is the purpose of using address resolution protocol (ARP) in networking?

A

<div>ARP is used to determine the MAC address based on an IP address, allowing devices to communicate at the hardware level.</div>

29
Q

What are some examples of attributes used for identification in authentication?

A

<div>Attributes can be personal, such as name, email address, phone number, or employee ID. Other attributes like department name, job title, or mail stop can also be used. One or more attributes can be combined to provide more detailed identification.</div>

30
Q

How do user certificates enhance authentication in a system?

A

<div>User certificates associate a certificate with a user, acting as a powerful electronic ID card. They can be used as an additional authentication factor and limit access without the certificate.</div>

31
Q

What is the role of an identity provider (IdP) in authentication?

A

<div>An identity provider vouches for the user's identity during the authentication process. It maintains a list of entities such as users and devices and commonly used by Single Sign-On (SSO) applications or cloud-based services that need to verify the user's identity. Standard authentication methods like SAML, OAuth, and OpenID Connect are often used by IdPs.</div>

32
Q

What is the purpose of reconnaissance tools in cybersecurity?

A

<div>Reconnaissance tools are used to gather information about networks, such as IP addresses, DNS information, and vulnerabilities, to assess potential security risks.</div>

33
Q

What are some common certificate file formats used in PKI?

A

<div>Some common certificate file formats include DER (Distinguished Encoding Rules), PEM (Privacy-Enhanced Mail), and PKCS #12 (Personal Information Exchange Syntax Standard).</div>

34
Q

How do cloud-native security controls differ from third-party solutions?

A

<div>Cloud-native security controls are integrated and supported by the cloud provider, with many configuration options available. They are part of the infrastructure and do not incur additional costs. Third-party solutions, on the other hand, provide support across multiple cloud providers and offer a single pane of glass for managing security policies and extending them beyond the scope of the cloud provider.</div>

35
Q

What are the different ways to communicate with an authentication server?

A

The three different ways to communicate with an authentication server are RADIUS, TACACS+, and Kerberos.

36
Q

What is the purpose of a root certificate in a Public Key Infrastructure (PKI)?

A

<div>A root certificate is the public key certificate that identifies the root Certificate Authority (CA). It issues other certificates, such as intermediate CA certificates, and serves as the foundation of trust in the PKI.</div>

37
Q

What are some common forensic tools used in digital investigations?

A

<div>Common forensic tools used in digital investigations include dd, Winhex, Autopsy, and Metasploit. These tools enable investigators to create disk images, analyze file systems, recover deleted data, and simulate attacks for testing purposes.</div>

38
Q

How can packet capture tools like tcpdump and Wireshark be used in network security?

A

<div>Packet capture tools like tcpdump and Wireshark allow network security professionals to analyze network traffic, detect anomalies, identify potential threats, and troubleshoot network issues. They provide detailed information about the packets flowing through a network, helping to ensure the security and integrity of the network infrastructure.</div>

39
Q

How can cryptography be used in an email platform?

A

<div>Cryptography in an email platform involves using public key cryptography to encrypt emails and digitally sign them for non-repudiation and integrity.</div>

40
Q

How does IEEE 802.1X prevent access to the network until authentication succeeds?

A

<div>IEEE 802.1X prevents access to the network until authentication succeeds by integrating with the Extensible Authentication Protocol (EAP) and ensuring that users don't get access to the network until they authenticate.</div>

41
Q

What are some examples of scripting environments used in security operations?

A

<div>Examples of scripting environments used in security operations include Windows PowerShell, Python, and OpenSSL. These scripting languages provide powerful capabilities for automating tasks, managing systems, and implementing security measures.</div>

42
Q

What is the purpose of ABAC (Attribute-based Access Control)?

A

<div>ABAC allows users to have complex relationships to applications and data, and access may be based on multiple criteria such as resource information, IP address, time of day, desired action, and relationship to the data.</div>

43
Q

How can file permissions be changed using the chmod command?

A

<div>The chmod command allows users to change file permissions by specifying the desired mode for the file owner, group, others, or all users. Permissions can be set using symbolic notation (e.g., u+x) or octal notation (e.g., 744).</div>

44
Q

What are some cloud security solutions for controlling traffic flows?

A

Firewalls in the cloud can control traffic flows both inside and outside the cloud. They are relatively inexpensive compared to physical appliances and can be virtual or host-based. Segmentation between microservices, VMs, or VPCs is also possible.

45
Q

Which access control model limits operations on an object based on security clearance levels?

A

<div>The MAC (Mandatory Access Control) model limits operations on an object based on security clearance levels. Every object is labeled with a predefined security level, such as confidential or top secret, and users cannot change these settings.</div>

46
Q

What are machine and computer certificates used for?

A

<div>Machine and computer certificates are used to manage many devices, especially those that may never be physically seen. These certificates authenticate the device and support other business processes that rely on the certificate.</div>

47
Q

What are some key steps in the incident response process?

A

<div>Key steps in the incident response process include preparation (establishing communication methods, incident handling hardware and software), detection and analysis (identifying incident precursors and indicators), containment and eradication (isolating and removing the threat), recovery (restoring systems and fixing vulnerabilities), and post-incident activity (lessons learned and improvements).</div>

48
Q

What is the role of forensic tools in digital investigations?

A

<div>Forensic tools play a crucial role in digital investigations by enabling investigators to create bit-by-bit copies of drives, analyze disk images, recover data from storage devices, and perform tasks such as file carving, password cracking, and memory analysis.</div>

49
Q

How can self-signed certificates be used for internal purposes?

A

<div>Self-signed certificates can be used for internal purposes when there is no need to purchase trust from a public CA. Organizations can build their own CA and issue certificates signed by their own CA. The CA certificate/trusted chain is installed on all devices to establish trust.</div>

50
Q

How can packet tools like tcpdump and Wireshark be used in security analysis?

A

<div>Packet tools like tcpdump and Wireshark can be used to capture and analyze network traffic, allowing security analysts to identify potential threats, verify packet filtering and security controls, and view detailed information about application traffic.</div>

51
Q

What is the purpose of using VPN for remote access?

A

<div>VPN allows authorized devices to establish a secure connection to a network from a remote location.</div>

52
Q

What is the role of a root certificate in a Public Key Infrastructure (PKI)?

A

<div>A root certificate is the public key certificate that identifies the root Certificate Authority (CA). It issues other certificates, such as intermediate CA certificates, and serves as the foundation of trust in the PKI.</div>

53
Q

What are some examples of shell environments used in security operations?

A

<div>Some examples of shell environments used in security operations include SSH (Secure Shell) for encrypted console communication and Windows PowerShell for command-line administration tasks.</div>

54
Q

What is the purpose of a code signing certificate?

A

<div>A code signing certificate allows developers to provide a level of trust for their applications. It verifies the authenticity and integrity of the software by checking the developer's signature and ensuring that the software has not been modified.</div>

55
Q

How can file manipulation tools like head, tail, and cat be used in security operations?

A

<div>File manipulation tools like head, tail, and cat can be used to view specific parts of a file, concatenate files together, or search for specific patterns within files, which can be useful for analyzing log files and identifying potential security issues.</div>

56
Q

What are the different access control models used in security?

A

<div>The different access control models used in security are MAC (Mandatory Access Control), DAC (Discretionary Access Control), RBAC (Role-based Access Control), ABAC (Attribute-based Access Control), and rule-based access control.</div>

57
Q

What is the incident response process according to NIST SP800-61?

A

<div>The incident response process, as defined by NIST SP800-61, includes preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.</div>

58
Q

What are some forensic tools used in digital investigations?

A

<div>Some forensic tools used in digital investigations include dd, Winhex, Autopsy, and exploitation frameworks like Metasploit.</div>

59
Q

What is the purpose of IEEE 802.1X in network access control?

A

IEEE 802.1X is a port-based Network Access Control (NAC) protocol that prevents access to the network until authentication succeeds. It integrates with the Extensible Authentication Protocol (EAP) and ensures that users don’t get access to the network until they authenticate.

60
Q

What are some packet tools commonly used in security analysis?

A

<div>Some packet tools commonly used in security analysis include Tcpreplay, tcpdump, and Wireshark.</div>

61
Q

What are the three different ways to communicate with an authentication server?

A

<div>The three different ways to communicate with an authentication server are RADIUS, TACACS+, and Kerberos.</div>

62
Q

What are some examples of shell and script environments used in security?

A

Some examples of shell and script environments used in security include SSH (Secure Shell), Windows PowerShell, Python, and OpenSSL.

63
Q

How does the chmod command work for changing file permissions?

A

<div>The chmod command is used to change the mode of a file system object, allowing users to set read, write, and execute permissions for different user groups. It can be specified using either symbolic notation (e.g., u+x) or octal notation (e.g., 744).</div>

64
Q

What are some common file manipulation tools used in security operations?

A

<div>Some common file manipulation tools used in security operations include head, tail, cat, and grep.</div>

CompTIA Security+ (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions