Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTia > Ch.15 > Flashcards

Ch.15 Flashcards

1
Q

in software development, the process of defining a collection of hardware and software components along with their interfaces in order to create the framework for software development

A

architectural design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

the code that can be executed by unauthorized users in a software program

A

attack surface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

gathering information from messages that a service transmits when another program connects to it

A

banner grabbing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

a comparison of the present state of a system to its baseline

A

baseline reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

a penetration test in which the tester has no prior knowledge of the network infrastructure that is being tested

A

Black box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

in software development, presenting the code to multiple reviewers in order to reach agreement about its security

A

code review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

an analysis of the design of a software program by key personnel from different levels of the project

A

design review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

a penetration test where some limited information has been provided to the tester

A

gray box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

the process of eliminating as many security risks as possible to make the system more secure

A

hardening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

a network set up with intentional vulnerabilities to invite attacks and reveal attackers’ methods

A

honeynet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, but are actually imitations of real data files, to trick attackers into revealing their attack techniques

A

honeypot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

an agreement between parties intended to minimize security risks for data transmitted across a network

A

Interconnection Security Agreement (ISA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

an agreement through which parties in a relationship can reach an understanding of their relationships and responsibilities

A

interoperability agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

a scan that attempts to penetrate the system in order to perform simulated attack

A

intrusive vulnerability scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

an agreement between two or more parties to enable them to work together that is not legally enforceable but is more formal than an unwritten agreement

A

Memorandum of Understanding (MOU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

a scan that does not use credentials (username and password) to conduct an internal vulnerability assessment

A

non-credentialed vulnerability scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

a scan that uses only available information to hypothesize the status of the vulnerability

A

non-intrusive vulnerability scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

the termination of an agreement between parties

A

off-boarding business partners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

the start-up relationship agreement between parties

A

on-boarding business partners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

a test by an outsider that attempts to actually exploit any weaknesses

A

penetration testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

software to search a system for port vulnerabilities

A

port scanner

22
Q

disabling unused application/service ports to reduce the number of threat vectors

A

port security

23
Q

a contract between a vendor and a client that specifies what services will be provided, the responsibilities of each party, and any guarantees of service

A

Service Level Agreement (SLA)

24
Q

combining an organization’s systems and data with outside entities

A

third-party integration

25
Q

a systematic and methodical evaluation of the exposure of assets to attackers, forces of nature, and any other entity that could cause potential harm.

A

vulnerability assessment

26
Q

an automated software search through a system for any known security weaknesses that creates a report of those potential exposures

A

vulnerability scan

27
Q

generic term for a range of products that look for vulnerabilities in networks or systems

A

vulnerability scanner

28
Q

a penetration test where the tester has an in-depth knowledge of the network and systems being tested, including network diagrams, IP addresses, and even the source code of custom applications

A

white box

29
Q

sending a packet with every option set to on for whatever protocol is in use to observe how a host responds

A

Xmas Tree port scan

30
Q

At what point in vulnerability assessment would an attack tree be utilized?

a. vulnerability appraisal
b. risk assessment
c. risk mitigation
d. threat evaluation

A

D

Threat evaluation

31
Q

In the software development process, when should a design review be conducted?

a. at the completion of the project
b. at the same time as the code review
c. as the functional and design specifications are being developed based on the requirements
d. during verification

A

C

As the functional and design specifications are being developed based on the requirements

32
Q

A (n)_____ attempts to penetrate a system in order to perform a simulated attack.

a. intrusive vulnerability scan
b. vulnerability risk scan
c. PACK scan
d. master level scan

A

A

Intrusive vulnerability scan

33
Q

A (n)_____ is an agreement between two parties that is not legally enforceable.

a. Service Purchase Agreement (SLA)
b. Blanket Purchase Agreement (BPA)
c. Memorandum of Understanding (MOU)
d. Interconnection Security Agreement (ISA)

A

C

Memorandum of Understanding (MOU)

34
Q

A _____ is a systematic and methodical evaluation of the exposure of assets to attackers, forces of nature, and any other entity that could cause potential harm.

a. penetration test
b. vulnerability scan
c. vulnerability assessment
d. risk appraisal (RAP)

A

C

Vulnerability assessment

35
Q

Each of these can be classified as an asset EXCEPT _____.

a. business partners
b. buildings
c. employee databases
d. accounts payable

A

D

Accounts payable

36
Q

Each of these is a step in risk management EXCEPT _____.

a. attack assessment
b. vulnerability appraisal
c. threat evaluation
d. risk mitigation

A

A

Attack assessment

37
Q

Which statement regarding vulnerability appraisal is NOT true?

a. Vulnerability appraisal is always the easiest and quickest step.
b. Every asset must be viewed in light of each threat.
c. Each threat could reveal multiple vulnerabilities.
d. Each vulnerability should be cataloged

A

A

Vulnerability appraisal is always the easiest and quickest step.

38
Q

_____ constructs scenarios of the types of threats that assets can face in order to learn who the attackers are, why they attack, and what types of attacks may occur.

a. Vulnerability prototyping
b. Risk assessment
c. Attack assessment
d. Threat modeling

A

D

Threat modeling

39
Q

What is a current snapshot of the security of an organization?

a. vulnerability appraisal
b. risk evaluation
c. threat mitigation
d. liability reporting

A

A

Vulnerability appraisal

40
Q

_____ is a comparison of the present security state of a system to a standard established by the organization.

a. Risk mitigation
b. Baseline reporting
c. Comparative Resource Appraisal (CRA)
d. Horizontal comparables

A

B

Baseline reporting

41
Q

Which of these is NOT a state of a port that can be returned by a port scanner?

a. open
b. busy
c. blocked
d. closed

A

B

Busy

42
Q

Which statement regarding TCP SYN port scanning is NOT true?

a. It uses FIN messages that can pass through firewalls and avoid detection
b. Instead of using the operating system’s network functions, the port scanner generated IP packets itself and monitors for responses
c. The scanner host closes the connection before he handshake is completed.
d. This scan type is also known as “half-open scanning” because it never actually opens a full TCP connection

A

A

It uses FIN messages that can pass through firewalls and avoid detection.

43
Q

The protocol File Transfer Protocol (FTP) uses which two ports?

a. 19 and 20
b. 20 and 21
c. 21 and 22
d. 22 and 23

A

B

20 and 21

44
Q

Each of these is a function of a vulnerability scanner EXCEPT _____.

a. detects which ports are served and which ports are browsed for each individual system
b. alerts users when a new patch cannot be found
c. maintains a log of all interactive network sessions
d. detects when a application is compromised

A

B

Alerts users when a new patch cannot be found

45
Q

Which statement about the Open Vulnerability and Assessment Language (OVAL) is true?

a. It only functions on Linux-based computers
b. It attempts to standardize vulnerability assessments
c. It has been replaced by XML
d. It is a European standard and is not used in the Americas

A

B

It attempts to standardize vulnerability assessments

46
Q

Which statement regarding a honeypot is NOT true?

a. It is typically located in an area with limited security
b. It is intentionally configured with security vulnerabilities
c. It cannot be part of a honeynet
d. It can direct an attacker’s attention away from legitimate servers

A

C

It cannot be part of a honeynet

47
Q

Which statement about vulnerability scanning is true?

a. It uses automated software to scan for vulnerabilities
b. The testers are always outside of the security perimeter
c. It may disrupt the operation of the network or systems
d. It produces a short report of the attack methods and value of he exploited data

A

A

It uses automated software to scan for vulnerabilities

48
Q

If a tester is given the IP addresses, network diagrams, and source code of customer applications, the tester is using which technique?

a. black box
b. white box
c. gray box
d. blue box

A

B

White box

49
Q

If a software application aborts and leaves the program open, which control structure is it using?

a. fail-safe
b. fail-secure
c. fail-open
d. fail-right

A

C

Fail-open

50
Q

A prearranged purchase or sale agreement between a government agency and a business

A

Business. Purchase Agreement (BPA)

51
Q

a scan that provides credentials (username and password) to the scanner so that tests for additional internal vulnerabilities can be performed

A

credentialed vulnerability scan

CompTia (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions