Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

comptia itf+ (certmaster) > 21. Using Best Practices > Flashcards

21. Using Best Practices Flashcards

1
Q

3 types of viruses?

A
  • Program viruses
  • Macro viruses
  • Worms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are program viruses?

A

Code snippets that integrate into other programs or scripts

When the application is executed, the virus code becomes active.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are macro viruses?

A

Viruses exploiting Microsoft Office macros

Microsoft macros are small programs or scripts written in the Visual Basic for Applications (VBA) language.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are worms?

A

Network-exploiting viruses residing in memory

like email,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a drive-by download?

A

Malware installed on a user’s device without consent or knowledge

often simply by visiting a compromised website or clicking on a malicious link.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a virus vector?

A

The route by which malware infects a computer

i.e. opening links in unsolicited email, infection from another compromised machine on the same network, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is cross-site scripting (XSS)?

A

Malicious scripts injected into webpages to harm user’s browsers or steal data

i.e. 1 technique is to spawn a pop-up window when a user visits a genuine banking site to try to trick them into entering their credentials through the pop-up.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is pharming?

A

Attempts to redirect web traffic to a counterfeit page

This is usually done by corrupting the way the computer resolves the website name used in the web address to the IP address of a particular server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a service pack?

A

Collection of updates, fixes, & patches for a software product

Typically on an OS or app suite

Microsoft products like Windows have a lifecycle policy: 5 years of mainstream support, 5 years of extended support for security updates. You need the latest Service Pack for support, and non-updated versions get 24 months after its release.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do antiviruses identify infected files?

A

Using definitions/signatures of known virus code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Access Control System?

A

Technical controls that govern how subjects may interact with objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Subject in an access control systems?

A

Anything that can request & be granted access to a resource

i.e. Users or software processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Objects in access control systems?

A

Resources

i.e. networks, servers, databases, files, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is an Access Control List (ACL)?

A

List of subjects & the permissions they have on the object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

4 main processes on an access control system?

A
  • Identification
  • Authentication
  • Authorization
  • Accounting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

4 comon ways ACLs are implemented?

The different ways they’re implemented determine how users receive rights

A
  • Discretionary Access Control (DAC)
  • Role-based Access Control (RBAC)
  • Mandatory Access Control (MAC)
  • Rule-based
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How does DAC operate?

A

By giving authority to the owner

Ownership can be transferred. Owner has full control over the resource, allowing them to modify its ACL to grant rights to others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How does RBAC control access?

A

By assigning roles with specific permissions to users

You can see a simple version of RBAC working in the division of Windows user account types into Administrators and Standard Users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How does MAC (Mandatory Acces Control) control access?

A

By assigning security clearance levels to objects & users

Users can access objects at or below their clerance level in hierarchial or within the same domain in compartmentalized setups, adhering to the “Need to Know” principle.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what does rule-based access control refer to?

A

Access control models based on system-enforced rules

Users do not determine the rules

RBAC, MAC, and continuous authentication exemplify rule-based access control. For instance, Windows User Account Control (UAC) prompts user confirmation for privileged actions, safeguarding against hijacking attempts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is non-repudiation?

A

Principle that a user can’t deny having performed some action

Accounting is an important part of ensuring non-repudiation

22
Q

3 types of user accounts in Windows?

A
  • Administrator
  • Guest
  • User
23
Q

Which Windows version doesnt allow creating group accounts?

A

“home” editions

24
Q

How does symmetric encryption work?

A

Using a single secret key to encrypt & decrypt data

If the key is lost or stolen, the security is breached

25
Q

Main problem with symmetric encryption?

A

Securely distributing & storing the key

It escalates exponentially with its wider distribution

26
Q

Main advantage of symmetric encryption?

A

Speed

symmetric key encryption is less processor and system memory intensive than asymmetric encryption.

27
Q

What is symmetric encryption used for?

A

Encoding data for storage or transmission over a network

Some examples of symmetric encryption technologies or ciphers are 3DES, AES, RC (Rivest Cipher), IDEA, Blowfish/Twofish, and CAST.

28
Q

What key size is commonly advised for encryption in general usage?

A

1024-bit keys

larger keys are used for highly sensitive data

The larger the key however, the more processing is required to perform encryption and decryption.

29
Q

How does asymmetric encryption work?

aka Public Key Cryptography

A

A math-related public key encrypts data & a private key decrypts data

This public key can be safely shared with anyone the host wants to communicate with, as the private key cannot be derived from it. Additionally, the public key cannot decrypt a message it encrypted.

30
Q

What does it mean when key pairs are “reversible” in asymmetric encryption?

A

If private key is used to encrypt, public key can decrypt it.

The point is that one type of key cannot rever the operation it has just performed

31
Q

What is asymmetic encryption mainly used for?

A

Authentication technologies

i.e. digital certificates, digital signatures, & key exchange

32
Q

What is key exchange?

A

2 hosts securely share a symmetric encryption key

Meaning no other hosts can find out what it is

33
Q

Why is asymmetric encryption only used on small amounts of data?

A

Takes longer for a computer to process

34
Q

What cipher do most asymmetric encryption technologies use?

A

RSA cipher

35
Q

Meaning of PKI?

A

Public Key Infrastructure

36
Q

What is PKI a solution for?

A

Authenticating subjects on public networks

37
Q

What does the Certificate Authority (CA) issue to subjects?

A

Digital certificate

38
Q

Under PKI, what are users/servers validated by?

A

A Certificate Authority (CA)

39
Q

Certificate Authority (CA)

What do digital certificates contain?

A

Subject’s public key

If the CA signs the certificate, it’s valid. So, trusting the CA means trusting the certificate holder.

40
Q

What happens after a secure connection is established via PKI?

A

Client encrypts data using the server’s public key

This ensures only the server can decrypt it

41
Q

How do digital signatures work?

A

By using a private key to encrypt a message’s hash, which is verified by using the corresponding public key

Public/private key pairs enable message signing: the sender encrypts a signature with their private key, shares the public key in a digital certificate, and the recipient verifies the signature by decrypting it with the public key. This proves the sender signed it.

42
Q

What is a hash?

A

Short representation of data

43
Q

Prpose of cryptographic hashes?

A

Irreversible hashing & to prevent hash collisions

44
Q

What does irreversible hashing mean?

A

Converting data to a fixed-length string that can’t be revered to obtain original data

once data is hashed, it is computationally infeasible to reconstruct the original input from the hash value.

45
Q

What are hash collisions?

A

When pieces of data produce the same hash value

46
Q

one way cryptographic hasing can be used?

A

Prove that a message has not been tampered with

i.e. When creating a digital signature, the sender hashes the message, encrypts the hash with their private key, and sends it. The recipient decrypts the hash, hashes the message themselves, and compares the values to verify.

Cryptographic hashes are also used for secure storage of data where the original meaning does not have to be recovered—passwords for instance.

47
Q

3 most commonly used cryptographic hash algorithms?

A
  • SHA-1
  • SHA-2
  • MD5
48
Q

Meaning of SHA?

A

Secure Hash Algorithm

49
Q

Meaning of MD5?

A

Message Digest 5

50
Q

How does a VPN work?

A

Links private networks via a public one OR links a remote host with Internet to a local private network

VPNs use special connection protocols and encryption technology to ensure that the tunnel is secure and the user is properly authenticated.

51
Q

How do dictionary password crackers work?

A

Compares the hash of a password to a list of pre-computed hashes of dictionary words

If a match is found, it means the password is likely a common word or phrase, making it susceptible to being cracked.

52
Q

How do brute force password crackers work?

A

Match the hash against every possible combination

Short passwords without complexity can be cracked in minutes, while longer and more complex ones can take years to crack.

comptia itf+ (certmaster) (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions