Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Securitry+ > 2-Technologies and Tools > Flashcards

2-Technologies and Tools Flashcards

1
Q

What is the purpose of a Firewall?

A

To isolate one network from another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Are firewalls hardware or software based?

A

They can be either

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can firewalls be used internally?

A

They can segment one area from another i.e. PCI from R&D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What types of Firewalls exist?

A

Packet Filtering
Proxy Firewall
Stateful Packet Inspection Firewall
Web Application Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does a Packet Filtering firewall do?

A

Allows or blocks traffic based on port (i.e. HTTP on port 80)
No intelligence, but easy to setup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does a Proxy firewall do?

A

Dual-homed firewall
Segments internal users from outside world
Masks IP address using NAT
Cache requests to improve perceived speed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does a Stateful Packet Inspection firewall do?

A

Examines packets and keeps packet table of every communication channel
SPI tracks the entire conversation
Only allows packets from known active connections
Possible to attack by overloading the State Table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does a Web Application Firewall do?

A

Operates at the application layer
designed with granular rules specifically to analyze traffic to web servers and prevent typical attacks such as SQL injection, XSS, Forged HTTP requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a VPN?

A

Creates a private network across a public network utilizing tunneling protocols such as L2TP, PPTP, IPSEC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is IPSeC?

A

Internet Security Protocol used to encrypt VPN traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Authentication Header?

A

Provides authentication and integrity by adding a header to the packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Encapsulating Secure Payload?

A

Provides confidentiality

Header, trailer and check value added to packet (ICV)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a NIDS?

A

Network Intrusion Detection System
Logs alerts and events
Allows for reactive response/research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a NIPS?

A

Network Intrusion Prevention System
Enables prevention (blocking IP, etc.)
False positives could be an issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What can NIDS and NIPS be used for?

A

Log, alert and/or take action when suspicious activity occurs on network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the difference between active and passive systems?

A

Active systems can take action to prevent an attack

Passive systems record activity for later analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the components of a NIDS or NIPS and what is their purpose?

A

Alert - message generated by analyzer indicating an “interesting” event
Analyzer - processes data collected from one or more sensors and looks for suspicious activity
Data Source - raw data being analyzed - log files, audit logs, system logs, network traffic, etc.
Event - indication that suspicious activity may have occurred (can trigger an Alert or notification)
Manager - IDS console used to manage the system
Notification - Process by which operator is alerted to an event or incident
Operator - User, admin, etc.
Sensor - primary data collection point for the IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the four approaches to IDS?

A

Behaviour Based - variations in behaviour, increased traffic, etc.
Signature Based - uses attack signatures and audit trails
Anomaly Detection - learns what is normal
Heuristic - utilizes algorithms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Passive Response?

A

Logging issues for later analysis
Notifying admin or kick off some type of workflow
Shunning or ignoring the attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Active Response?

A

Issue some type of action
Block Ports
Reset Connections
Configuration changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Deception?

A

Using a honeypot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a Router?

A

Connects different networks together and routes traffic between them
Can provide firewall functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the difference between a static and dynamic route?

A

Static are programmed manually

Dynamic are learned as routers communicate with each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are four common routing protocols?

A

RIP
EIGRP
OSPF
BGP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are switches?

A

Multiport connectivity devices that improve network efficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is Port Security?

A

Can configure a switch so that it only learns one MAC address per port (can be set to trigger alert)
Can be used in conjunction with 802.1x to strengthen security at the wall jack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is 802.1x Authentication?

A

Extensible Authentication Access Protocol over LAN
Form of port security
Allows only EAPOL traffic over port until client authenticates with a RADIUS authentication server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is Loop Protection?

A

Layer 3 routers implement TTL
Each router hop decrements the TTL
Packet dropped once TTL expires

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is Spanning Tree Protocol?

A

Typically enabled to prevent layer 2 loops

Switches can also “clamp down” once broadcasts hit a certain percentage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are Load Balancers?

A

Dynamically balance the load between devices
Typically servers but can be other devices as well
Hardware or software based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the Load Balancing methods?

A

Affinity

Round-Robin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is a Web Security Gateway?

A

Proxy server with advanced features such as virus scanning, DLP, etc.
Can enable granular access to websites, block sites, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are some basic ways to secure a wireless access point?

A

Don’t broadcast SSID
MAC filtering
Common Sense administration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is SIEM?

A 
Security Information and Event Management (SIEM)
Software suites that provide:
Data aggregation
Correlation
Automated alerting and triggers
Time synchronization
Event deduplication
Logs/WORM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is DLP?

A

Data Loss Prevention

Detects potential breaches and exfiltration of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are common methods of DLP?

A 
Endpoint detection (in use)
Network Traffic (in transit)
Data Storage (at rest)
Email
USB
Cloud-based
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the three types of data to secure?

A

Data in-transit
Data at-rest
Data in-use

38
Q

What is Network Access Control?

A

Set of policies that define a minimal set of requirements each device must have before being allowed on the network
Devices can be denied access or places in a secure zone until requirements are met

39
Q

What is a NAC permanent agent?

A

Persistent agent that is installed on the host device and runs continuously

40
Q

What is a NAC dissolvable agent?

A

Agent that is run from a portal

User downloads the agent, runs it once then disappears.

41
Q

What is an agentless NAC?

A

Embedded within AD, NAC code verifies the host complies with access policies.

42
Q

What is Trust Platform Module?

A

Hardware chip embedded on a computer’s motherboard used to store cryptographic keys used for encryption

43
Q

What is a Hardware Security Module?

A

Similar to TPM, but are removable/external devices that can be added later
Used for encryption using RSA keys.

44
Q

What is a Mail Gateway?

A

Spam Filter
DLP
Encryption

45
Q

What should be established when assessing the security posture of an organization?

A

Security baseline to help understand what is normal and to help easily identify anomalies

46
Q

What is a protocol analyzer?

A

Packet sniffer

Captures packets as they traverse a network

47
Q

What are network scanners used for?

A

Network mapping, port scanning, vulnerability scanning, penetration testing

48
Q

What is a Port Scanner?

A

Can scan an IP address or range for open ports

Fingerprints what type of OS, apps, services a host is running

49
Q

What are Wireless Scanners/Crackers?

A

Tools that can crack WEP and WPA, find hidden networks, issue DOS attacks, MiTM attacks, etc.

50
Q

What are the top 5 things vulnerability scanners do?

A 
Passively test security controls
Interpret results
Identify vulnerabilities
Identify lack of security controls
Identify common misconfigurations
51
Q

What are Exploitation Frameworks?

A

Toolset such as Metasploit that can be used offensively or defensively and are often used by pen testers as well as hackers.

52
Q

What is the difference between wiping and deleting data?

A

Deleting doesn’t destroy the data until it is overwritten

Wiping overwrites data x number of times to ensure it cannot be recovered

53
Q

How are SSD disks sanitized?

A

Reset the NAND and marks all blocks as empty

54
Q

What is the DoD 5220.22-M Standard for data sanitzation?

A

Pass 1: writes a zero and verifies the write
Pass 2: writes a one and verifies the write
Pass 3: writes a random character and verifies the write

55
Q

What is the RCMP CSEC ITSG-06 standard?

A

Pass 1: writes a one or zero
Pass 2: writes the complement of the previously written character
Pass 3: Writes a random character and verifies the write

56
Q

What is Secure Erase?

A

Pass 1: writes a binary one or zero

Very fast and only available for whole disk sanitization

57
Q

What is Steganography?

A

Hiding something inside of something else
Documents can be hidden inside MP3 files, images, video files
Difficult to detect

58
Q

What is a Honeypot?

A

Computers or hosts that are setup specifically to become targets of an attack so that attackers can be monitored

59
Q

What is a Honeynet?

A

Similar to Honeypot but larger in scale

Network setup intentionally for attack

60
Q

What is Banner Grabbing?

A

Used to provide information about a service running on a particular port
Common with Telnet or Netcat

61
Q

What is the issue with unencrypted credentials?

A

They are easily sniffed and captured while in transit or stored.

62
Q

How should logs and event anomalies be treated?

A

Logs should be monitored and reviewed
Triggers setup to capture events
Logs should be aggregated and correlated across devices
Identify patterns and establish baselines

63
Q

How should access violations be treated?

A

Baselines should be established in order to identify if the event was outside the norm

64
Q

What are some common security issues with certificates?

A

Can result in people having access they shouldn’t

Mechanisms not in place to quickly recall/replace compromised certificates

65
Q

What are examples of weak security protocols that should not be in use?

A

WEP, WPA, RC4, DES, 3DES

66
Q

How can personnel issues affect security?

A 
Social engineering
Personal email
Insider threats
Policy violations
Social Media
67
Q

What are the issues with unauthorized software?

A

Pirated software often contains malware
Security implications if software is not vetted
Potential licensing and copyright violations
Unknown intent (i.e. steganography)

68
Q

Where should baselines be established?

A

Anything that needs to be monitored.

69
Q

Why is Asset Management important to security?

A

Compliance/Licensing
Patching/Updates
Hard to monitor what you don’t know about

70
Q

What are HIDS/HIPS?

A

Like NIDS/NIPS but host based

71
Q

What is an Antivirus?

A

Software that detects viruses, malware, and in some cases rootkits and ransomware.
Standalone or network based.

72
Q

What is file integrity checking?

A

Protects against tampering by ensuring that a file hasn’t been modified.
Compares current state to a known good state.

73
Q

What is a host-based firewall?

A

Protect single host only

usually by restricting applications

74
Q

What is application whitelising?

A

A list of applications that are allowed to run on a host

75
Q

What is application blacklisting?

A

Explicitly lists applications that are blocked. Allows others to run.

76
Q

What is Unified Threat Management?

A 
Multi-purpose suite of tools that provide:
Firewall
NIDS/NIPS
Gateway Anti-virus/Anti-spam
VPN Functionality
Content filtering
Load Balancing
Data Loss Prevention
77
Q

What is Data Loss Prevention?

A

Tools that can reside locally on a host or centrally on a server/perimeter or be cloud based.
Scans for sensitive information leakage (at-rest, in-use, in-transit)
PII, PCI data

78
Q

What is Data Execution Prevention?

A

System-level memory protection
Marks pages of memory as non-executable, preventing code from bring run from those locations
protects again buffer overruns

79
Q

What is a Web Application Firewall?

A

Hardware or Software based

Protects HTTP communication from XSS, SQL injectiion, etc.

80
Q

What are some risks with cellular devices?

A 
No password/PIN
Unpatched OS or apps
Jailbreaking/rooting
Unauthorized applications
Malware
81
Q

What are some methods to secure mobile devices?

A 
Authentication/two-factor authentication
Verify and authenticate downloaded applications
anti-malware software
firewalls
remote disable/wiping
encryption
82
Q

What are some ways to secure WiFi?

A

Disable SSID
MAC filtering
Require secure connectivity protocols (WPA2-PSK AES)

83
Q

What is NFC?

A

Used commonly for things like contactless payment systems

84
Q

How can you secure NFC communications?

A

By encrypting

85
Q

What are some good corporate policies to implement around mobile devices?

A

Strong passwords
Lock screens/screensavers
Disabling unnecessary services
application/software control

86
Q

How can you help secure mobile device authentication?

A

PKI/Digital Certificates
Enforce password policies
VPN/Two-factor (RSA)

87
Q

What is Geo-Tagging?

A

Pictures and documents can be tagged with GPS coordinates of where it was made
Potential security risk as it can expose location

88
Q

What is Context-Aware Authentication?

A

Type of two-factor authentication (2FA) that provides a more frictionless experience
Uses pre-defined rules to determine authentication or if more stringent challenge should be used

89
Q

What are three mobile device deployment models?

A

BYOD - Bring Your Own Device
COPE - Corporate Owned, Personally Enabled
CYOD - Choose Your Own Device

90
Q

What is DNSSEC?

A

DNS Security Extensions
Designed to add security to DNS
All responses from DNSSEC servers are digitally signed, authenticating their origin
Does not provide confidentiality as data is not encrypted

CompTIA Securitry+ (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions