Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ (SY0-501) Terms, Concepts, & Acronyms > Security+ Glossary > Flashcards

Security+ Glossary Flashcards

1
Q

layered security

A

An approach to operational security that incorporates many different avenues of defense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

security auditing

A

The act of performing an organized technical assessment of the security strengths and weaknesses of a computer system to ensure that the system is in compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

deep web

A

Those portions of the World Wide Web that are not indexed by standard search engines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

application whitelisting

A

The practice of allowing approved programs to run on a computer computer network or mobile device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

stream cipher

A

A relatively fast type of encryption that encrypts data one bit at a time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

protocol analyzer

A

This type of diagnostic software can examine and display data packets that are being transmitted over a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

aggregation switch

A

A network device that combines switches together in a network.

Enhances redundancy and increases bandwidth.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

VM sprawl

A

One of 3 virtualization risks

Situation where the number of virtual machines exceeds the organization’s ability to control or manage all of those virtual machines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

X.509

A

A standard for formatting digital certificates that defines the structure of a certificate with the information that was provided in a CSR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

controls

A

Countermeasures that avoid mitigate or counteract security risks due to threats and attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

packet analyzer

A

A device or program that monitors network communications on the network wire or across a wireless network and captures data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

endpoint protection

A

Software that incorporates anti-malware scanners into a larger suite of security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DSU

A

Data Service Unit

Device used to establish connectivity between a LAN and a WAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

static code analysis

A

The process of reviewing source code while it is in a static state i.e. it is not executing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

incremental backup

A

A backup type in which all selected files that have changed since the last full or incremental backup (whichever was most recent) are backed up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

access recertification

A

A security control where user access privileges are audited to ensure they are accurate and adhere to relevant standards and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

rule-based access control

A

A non-discretionary access control technique that is based on a set of operational rules or restrictions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

model verification

A

The process of evaluating how well a software project meets the specifications that were defined earlier in development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

XTACACS

A

An extension to the original TACACS protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

COBIT 5

A

A framework for IT management and governance created by ISACA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

stress testing

A

A software testing method that evaluates how software performs under e.xtreme load

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

data retention

A

The process of maintaining the existence of and control over certain data in order to comply with business policies and/or applicable laws and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

whitelisting

A

The practice of allowing approved progran1s to run on a computer computer network or mobile device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

prevention

A

The security approach of blocking unauthorized access or attacks before they occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

data at rest

A

Information that is primarily stored on specific media rather than moving from one medium to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

recovery agent

A

An individual with the necessary credentials to decrypt files that were encrypted by another user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

spatial database

A

A collection of information that is optimized for data that represents objects contained in a geometric space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

stateful firewall

A

A firewall that tracks the active state of a connection and can make decisions based on the contents of a network packet as it relates to the state of the connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

least privilege

A

The principle that establishes that users and software should have the minimal level of access that is necessary for them to perform the duties required of them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

proxy

A

A device that acts on behalf of one end of a network connection when communicating with the other end of the connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

secure IMAP

A

A version of the Internet Message Access Protocol that uses SSL or TLS to provide secure communications between a mail client and the mail server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

stateless firewalI

A

A firewall that does not track the active state of a connection as it reaches the firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

anti-spam

A

A program that will detect specific words that are commonly used in spam messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

versioning

A

The practice of ensuring that the assets that make up a project are closely managed when it comes time to make changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

airgap

A

A physical security control that provides physical isolation.

Systems separated by an air gap typically don’t have physical connections to other systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

networking enumerator

A

A device or program that can identify the logical topology of a network to reveal its connection pathways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

VPN concentrator

A

A single device that incorporates advanced encryption and authentication methods in order to handle a large number of VPN tunnels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

flood guard

A

A security control in network switches that protects hosts on the switch against SYN flood and ping flood DoS attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

OCSP stapling

A

A method of checking the status of digital certificates where a web server queries the OCSP server at specific .intervals and the OCSP server responds by providing a time­ stamped digital signature. The web server appends this signed response to the SSL/TLS handshake with the client so that the client can verify the certificate’s status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

anti-malware software

A

A category of software programs that scan a computer or network for known viruses Trojans worms and other malicious software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

shimming

A

The process of developing and implementing additional code between an application and the operating system to enable functionality that would otherwise be unavailable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

loss controls

A

Security measures implemented to prevent key assets from being damaged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

scheduling

A

A method used by load balancers to determine which devices should have traffic muted to them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

hardening

A

A security technique in which the default configuration of a system is altered to protect the system against attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

data in use

A

Information that is currently being created deleted read from or written to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

DevOps

A

A combination of software development and systems operations and refers to the practice of integrating one discipline with the other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

intranet

A

A private network that is only accessible by the organization’s own personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

business continuity

A

A collection of processes that enable an organization to maintain normal business operations in the face of some adverse event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

reverse engineering

A

The practice of deconstructing software into its base components so that its properties are easier to understand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

router

A

A device that connects multiple networks that use the same protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

continuous monitoring

A

The practice of Constantly scanning an environment for threats vulnerabilities and other areas of risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

anomaly-based monitoring

A

A network monitoring system that uses a baseline of acceptable outcomes or event patterns to identify events that fall outside the acceptable range.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

supply chain

A

The end-to-end process of supplying manufacturing distributing and finally releasing goods and services to a customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

auditing

A

The portion of accounting that entails security professionals examining logs of what was recorded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

sanitization

A

A data disposal method that completely removes all data from a storage medium at the virtual level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

data sovereignty

A

The sociopolitical outlook of a nation concerning computing technology and information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

technical controls

A

Hardware or software installations that are implemented to monitor and prevent threats and attacks to computer systems and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

fault tolerance

A

The ability of a computing environment to withstand a foreseeable component failure and continue to provide an acceptable level of service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

privilege management

A

The use of authentication and authorization mechanisms to provide an administrator with centralized or decentralized control of user and group role-based privilege management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

honeynet

A

An entire dummy network used to lure attackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

device

A

A piece of hardware such as a. computer server printer or smartphone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

resource exhaustion

A

A software vulnerability that can occur when software does not properly restrict access to requested or needed resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

application blacklisting

A

The practice of preventing undesirable programs from running on a computer computer network or mobile device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

security framework

A

A conceptual structure for security operations within the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

security assessment

A

The process of testing security controls through a comprehensive set of techniques aimed at exposing any weaknesses or gaps in your tools technologies services and operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

standard

A

A document that defines how to measure the level of adherence to a policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

administrative controls

A

Define the human factor(s) of security.

They use methods mandated by organizational policies or other guidelines. This includes:

  • Security education training and awareness programs
  • Acceptable use policies
  • Risk and vulnerability assessments
  • Penetration testing
  • Bring your own device (BYOD) policies
  • Password management policies
  • Incident response plans (which will leverage other types of controls)
  • Personnel management controls (recruitment, account generation, etc.).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

agile

A

A software development life cycle model that focuses on the collaborative interaction between customers, developers, and testers

Compare with waterfall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

honeypot

A

A security tool used to lure attackers away from the actual network components. Also called a decoy or sacrificial lamb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

directory service

A

A network service that stores identity information about all the objects in a particular network inchiding users groups servers client computers and printers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

differential backup

A

A backup type in which all selected files that have changed since the last full bach-up are backed up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

malware sandboxing

A

The practice of isolating malware in a viitual environment where it can be safely analyzed without compromising production systems or the rest of the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

data security

A

The security controls and measures taken to keep an organization’s data safe and accessible and to prevent unauthorized access to it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

first responder

A

The first experienced person or team to arrive at the scene of an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

embedded system

A

A computer hardware and software system that has a specific function within a larger system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

identity federation

A

The practice of linking a single identity across multiple disparate identity management systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

baseline report

A

A collection of security and configuration settings that are to be applied to a particular system or network in the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Personal Identity Verification card

A

A smart card that meets the standards for FIPS 201 in that it is resistant to tampering and provides quick electronic authentication of the card’s owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

network segregation

A

The general practice of keeping networks separate from one another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

hotfix

A

A patch that is often issued on an emergency basis to address a specific security flaw

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

collision

A

The act of two different plain text inputs producing the same exact cipher-text output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

affinity

A

A scheduling approach used with load balancers.

Uses client’s IP address to ensure the client is redirected to the same server during a session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

fuzzing

A

A dynamic code analysis technique that involves sending a running application random and unusual input so as to evaluate how the app responds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

telephony

A

Technology that provides voice and video communications through devices over a distance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

warm site

A

A location that is dormant or performs non­ critical functions under normal conditions but which can be rapidly converted to a key operations site if needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

SSL/TLS accelerator

A

A hardware interface that helps offload the resource-intensive encryption calculations in SSL/TLS to reduce overhead for a server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

separation of duties

A

Security principle that prevents any signle person or entity from controlling all the functions of a critical or sensitive process.

Designed to prevent fraud, theft, and errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

keystroke authentication

A

A type of authentication that relies on detailed information that describes exactly when a keyboard key is pressed and released as someone types information into a computer or other electronic device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

antispoofing

A

A technique for identifying and dropping packets that have a false source address.

In a spoofing attack, the source address of an incoming packet is changed to make it appear as if it is coming from a known, trusted source.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

deciphering

A

The process of translating ciphertext to plaintext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

network adapter

A

Hardware that translates the data between the network and a device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

VM escape

A

One of 3 virtualization risks

An attack that allows attacker to access host system from within virtual system.

Attacker can run code on virtual system and interact with hypervisor

Successful attack can give attacker unlimited control over host system and each VM

Important to keep patch levels current on both physical and virtual servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

privilege bracketing

A

The task of granting privileges to a user only when needed and revoking them as soon as the task is done

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

snapshot

A

The state of a virtual machine at a specific point in time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

captive portal

A

A web page that a client is automatically directed to when connecting to a network usually through public WI-FI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

network loop

A

The process of multiple connected switches bouncing traffic back and forth for an indefinite period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

information security triad

A

The three basic principles of security control and management: confidentiality integrity and availability. Also known as the CIA triad, information security triad or triple triad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

token

A

An authentication device or file. A hardware token is a physical device used in something you have a factor of authentication. A software token is a small file used by authentication services to indicate a user has logged on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

normalization

A

A software development technique that tries to repair invalid input to strip any special encoding and automatically convert the input to a specific format that the application can handle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

immutable system

A

System that cannot be changed

Once it’s created and tested then deplyed into a production environment

Example: creation of a secure image of a server for specific purpose that is deployed as an immutable system to ensure it stays secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

message digest

A

The value that results from hashing encryption. Also known as hash value or message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

anti-spyware

A

Software that is specifically designed to protect systems against spyware attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

rooting

A

The process of enabling root privileges on an Android device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

behavior-based monitoring

A

A network monitoring system that detects changes in normal operating data sequences and identifies abnormal sequences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

account policy

A

Document that specifies an organization’s requirements for managing accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

firewall

A

A software or hardware device that protects a system or network by blocking unwanted network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

hot site

A

A fully configured alternate network that can be online quickly after a disaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

private root CA

A

A root CA that is created by a company for use primarily within the company itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

correction controls

A

A security mechanism that helps mitigate the consequences of a threat or attack from adversely affecting the computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

recovery

A

The act of recovering vital data present in files or folders from a crashed system or data storage devices when data has been compromised or damaged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Wi-Fi Direct

A

Technology that enables two mobile devices to connect to each other without a wireless access point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

security through obscurity

A

The practice of attempting to hide the existence of vulnerabilities from others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

microcontroller

A

An embedded systems component that consolidates the functionality of a CPU memory module and peripherals. Also known as system on chip (SoC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

asset management

A

The process of taking inventory of and tracking all of an organization’s objects of value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

spam

A

An email-based threat that floods the user’s inbox with emails that typically carry unsolicited advertising material for products or other spurious content and which sometimes deliver viruses. It can also be utilized within social networking sites such as Facebook and Twitter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

signature-based monitoring

A

A network monitoring system that uses a predefined set of rules provided by a software vendor or security personnel to identify events that are unacceptable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

bridge

A

A device similar to a switch that has one port for incoming traffic and one port for outgoing traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

compliance

A

The practice of ensuring that the requirements of legislation regulations industry codes and standards and organizational standards are me

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

elasticity

A

The property by which a computing environment can instantly react to both increasing and decreasing demands in workload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

persistence

A

A penetration testing technique where the tester has concluded the initial exploitation and is now interested in maintaining access to the network

121
Q

cellular network

A

A connection method that enables mobile devices to connect to wireless transceivers in fixed locations all over the world.

122
Q

biometrics

A

Authentication schemes based on individuals’ physical characteristics.

123
Q

load balancer

A

A network device that distributes the network traffic or computing workload among multiple devices in a network

124
Q

packet sniffing

A

An attack on wireless networks where an attacker captures data and registers data flows in order to analyze what data is contained in a packet

125
Q

session key

A

A single-use symmetric key used for encrypting all messages in a series of related communications

126
Q

identification

A

The process of claiming some information about the nature of a paiticular entity

127
Q

trust model

A

A single CA or group of CAs that work together to issue digital certificates

128
Q

geotagging

A

The process of adding geographic location metadata to captured media such as pictures or videos

129
Q

CIA triad

A

The three basic principles of security control and management: confidentiality integrity and availability. Also known as the information security triad or triple.

130
Q

shibboleth

A

An identity federation method that provides single sign-on capabilities and enables websites to make informed authorization decisions for access to protected online resources

131
Q

media

A

A method that connects devices to the network and carries data between devices.

132
Q

mutual authentication

A

A security mechanism that requires that each party in a communication verifies the identity of every other party in the communication

133
Q

network-based firewalls

A

A hardware/ software combination that protects all the computers on a network behind the firewall

134
Q

input validation

A

Limits what data a user can enter into specific fields like not allowing special characters in a user name field

135
Q

grey box test

A

A penetration test where the tester may have knowledge of internal architectures and systems or other preliminary information about the system being tested

136
Q

plaintext

A

Un-Encrypted data that is meant to be encrypted before it is transmitted or the result of decryption of encrypted data

137
Q

impersonation

A

A type of social engineering in which an attacker pretends to be someone they are not typically to pretend to be average user in distress or a help desk representative

138
Q

blacklisting

A

The practice of preventing undesirable programs from running on a computer computer network or mobile device

139
Q

virtualization

A

Technology that allows you to host multiple virtual machines on a single physical system

Different types include:

  • Type I
  • Type II
  • Container
140
Q

network isolation

A

The general practice of keeping networks separate from one another

141
Q

Telnet

A

A network protocol that enables a client to initiate remote command access to a host over TCP/ IP

142
Q

MD5

A

A hash algorithm based on RFC 1321 that produces a 128-bit hash value and is used in IPSec policies for data authentication

143
Q

private key

A

The component of asymmetric encryption that is kept secret by one party during two-way encryption

144
Q

three-way handshake

A

The process by which a TCP connection is completed between two hosts where a host sends a SYN packet to the host it needs to communicate with that host sends a SYN­ ACK packet back and the originating host sends an ACK packet to complete the connection

145
Q

degaussing

A

A data disposal method that applies a strong magnetic force to a disk drive so that it loses its magnetic charge and is rendered inoperable.

146
Q

detection controls

A

A security mechanism that helps to discover if a threat or vulnerability has entered into the computer system

147
Q

implicit deny

A

The principle that establishes that everything that is not explicitly allowed is denied

148
Q

protocol

A

Software that controls network communications using a set of rules

149
Q

security control types

A

Security controls implementation:

  • Technical: use technology
  • Administrative: use administrative or management methods
  • Physical: controls you can physically touch

Security control goals:

  • Preventitive
  • Detective
  • Corrective
  • Deterrent
  • Compensating
150
Q

transitive trust

A

A principle in which one entity implicitly trusts another entity because both of them trust the same third party

151
Q

self-signed certificate

A

A type of digital certificate that is owned by the entity that signs it

152
Q

defense in depth

A

A more comprehensive approach to layered security that also includes non-technical defenses like user training and physical protection

153
Q

succession plan

A

A documented plan that ensures that all key business personnel have one or more designated backups who can perform critical functions when needed

154
Q

cloud computing

A

A method of computing that involves real-time communication over large distributed networks to provide the resources software data and media needs of a user business or organization

155
Q

sideloading

A

The practice of directly installing an app package on a mobile device instead of downloading it through an app store

156
Q

disaster recovery

A

A major component of business continuity that focuses on repairing reconstructing restoring and replacing systems personnel and other

157
Q

rollup

A

A collection of previously issued patches and hot fixes usually meant to be applied to one component of a system such as the web browser or a particular service

158
Q

non-persistence

A

The property by which a computing environment is discarded once it has finished its assigned task

159
Q

remote lockout

A

A security method of restricting access to sensitive data on a device without deleting it from memory

160
Q

order of volatility

A

The order in which volatile data should be recovered from various storage locations and devices after a security incident occurs

161
Q

detection

A

The act of determining if a user has tried to access unauthorized data or scanning the data and networks for any traces left by an intruder in any attack against the system.

162
Q

scalability

A

the property by which a computing environment is able to gracefully fulfill its ever- increasing resource needs

163
Q

grey hat

A

A hacker who exposes security flaws in applications and operating systems without consent but not ostensibly for malicious purposes

164
Q

accountability

A

The process of determining who to hold responsible for a particular activity or event.

165
Q

schema

A

A set of rules in a directory service for how objects are created and what the.r characteristics can be

166
Q

heuristic monitoring

A

A network monitoring system that uses known best practices and characteristics in order to identify and fix issues within the network

167
Q

secure boot

A

A UEFI feature that prevents unwanted processes from executing during the boot operation

168
Q

non-repudiation

A

The security goal of ensuring that the party that sent a transmission or created data remains associated with that data and cannot deny sending or creating that data

169
Q

credential manager

A

An application that stores passwords in an encrypted database for easy retrieval by the appropriate user

170
Q

access control

A

The process of determining and assigning privileges to resources objects and data.

171
Q

Faraday cage

A

A wire mesh container that blocks external electromagnetic fields from entering into the container

172
Q

tunneling

A

A data-transport technique in which a data packet is encrypted and encapsulated in another data packet in order to conceal the info1mation of the packet inside

173
Q

application container

A

A virtualization method where applications run in isolated containers on the host operating system instead of in separate VM’s

AKA application cell or container virtualization

174
Q

waterfall model

A

A software development model where the phases of the SDLC cascade so that each phase will start only when all tasks identified in the previous phase are complete

175
Q

guideline

A

Suggestions recommendations or best practices for how to meet a policy standard

176
Q

tabletop exercise

A

A discussion-based session where disaster recovery team members discuss their roles in emergency situations as well as their responses to particular situations

177
Q

protected distribution

A

A method of securing the physical cabling of a communications infrastructure

178
Q

stored procedure

A

One of a set of pre-compiled database statements that can be used to validate input to a database

179
Q

NIST 800 Series

A

Publications by the National Institute of Standards and Technology (NIST) that focus on computer security standards

180
Q

accounting

A

The process of tracking and recording system activities and resource access.

181
Q

change management

A

The process of approving and executing change in order to assure maximum security stability and availability of IT services.

182
Q

scale up

A

The process of increasing the power of existing resources to achieve scale ability

183
Q

version control

A

The practice of ensuring that the assets that make up a project are closely managed when it comes time to make changes

184
Q

root of trust

A

Technology that enforces a hardware platform’s trusted computing architecture through encryption mechanisms designed to keep data confidential and to prevent tampering

185
Q

incident report

A

A description of the events that occurred during a security incident

186
Q

smart card

A

A device similar to a credit card that can store authentication information such as a user’s private key on an embedded microchip

187
Q

distribution frame

A

A passive device which terminates cables allowing arbitrary interconnections to be made.

188
Q

MAC filtering

A

The security technique of allowing or denying specific MAC addresses from connecting to a network device.

189
Q

switch

A

A device that has multiple network ports and combines multiple physical network segments into a single logical network

190
Q

smart device

A

An electronic device other than a typical computer that is connected to a network and has some computing properties

191
Q

enciphering

A

The process of translating plain-text to cipher-text

192
Q

M04

A

A hash algorithm based on RFC 1320 that produces a 128-bit hash value and is used in message integrity checks for data authentication

193
Q

false positive

A

Something that is identified by a scanner or other assessment tool as being a vulnerability when in fact it is not

194
Q

pointer dereference

A

A software vulnerability that can occur when the code attempts to remove the relationship between a pointer and the thing it points to (pointee). If the pointee is not properly established the dereferencing process may crash the application and corrupt memory

195
Q

OpenlD

A

An identity federation method that enables users to be authenticated on cooperating websites by a third-party authentication service

196
Q

network segmentation

A

The division of a large network into smaller logical networks

197
Q

active-active

A

A redundancy mode used by load balancers to router traffic through primary (active) Load balancer is on standby in case of failure of the active device

198
Q

directory traversal

A

An application attack that allows access to commands files and directories that may or may not be connected to the web document root directory

199
Q

geolocation

A

The process of identifying the real-world geographic location of an object often by associating a location such as a street address with an IP address hardware address Wi-Fi positioning system GPS coordinates or some other form of information

200
Q

information security

A

The protection of available information or information resources from unauthorized access attack theft or data damage

201
Q

failover

A

A technique that ensures a redundant component device or application can quickly and efficiently take over the functionality of an asset that has failed

202
Q

active directory

A

the standards-based directory service from Microsoft that runs on Microsoft Windows servers.

203
Q

pop-up blocker

A

Software that prevents pop-ups from sites that are unknown or untrusted and prevents the transfer of unwanted code to the local system

204
Q

gain

A

The reliable connection range and power of a wireless signal measured in decibels

205
Q

sniffer

A

A device or program that monitors network communications on the network wire or across a wireless network and captures data

206
Q

active-passive

A

A redundancy mode used by load balancers to route traffic equally through two load balancers. balancers to route traffic through a primary (active) load balancer while the other (passive) load balancer is on standby in case of failure of the active Device

207
Q

chain of custody

A

The record of evidence history from collection to presentation in court to disposal.

208
Q

geofencing

A

The practice of creating a virtual boundary based on real-world geography

209
Q

risk register

A

The record of risk information as represented in tables or graphs

210
Q

management controls

A

Procedures implemented to monitor the adllerence to organizational security policies

211
Q

integrity

A

The fundamental security goal of keeping organizational information accurate free of errors and without unauthorized modifications

212
Q

infrastructure as code (IaC)

A

The process of managing and provisioning computer data centers through machine-readable definition files rather than physical hardware configuration or interactive configuration tools.

213
Q

port

A

An endpoint of a logical connection that host computers use to connect to processes or services on other hosts

214
Q

local shared object (LSO)

A

Commonly called a Flash cookie (due to its similarity with an HTTP cookie) is a piece of data that websites which use Adobe Flash may store on a user’s computer.

215
Q

procedure

A

Step-by-step instructions that detail how to implement components of a policy

216
Q

storage segmentation

A

The practice of compartmentalizing different types of data on one or more storage media such as isolating a mobile device’s OS and base apps from the apps and data added by the user

217
Q

patch

A

A small unit of supplemental code meant to address either a security problem or a functionality flaw in a software package or operating system

218
Q

IPv6

A

(IP version 6) An Internet standard that increases the available pool of IP addresses by implementing a 128-bit binary address space.

219
Q

stealth scan

A

A type of port scan that identifies open ports without completing the three-way handshake

220
Q

black box test

A

A penetration test where the tester is given no information about the system being tested.

221
Q

data in transit

A

Information that primarily moves from medium to medium such as over a private network or the Internet

222
Q

cookie

A

A piece of data-such as an authentication token that is sent by a website to a client and stored on the client’s computer

223
Q

subdomain

A

In DNS a logical division of an organizational domain such as sales.develetech.com

224
Q

IS0/IEC 27001

A

A standard model for information systems management practices created by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)

225
Q

ROT13

A

A simple substitution cipher that replaces a letter with the letter that is 13 letters after it in the alphabet

226
Q

code review

A

An evaluation used to identify potential weaknesses in an application

227
Q

damage controls

A

Security Measures implemented to prevent key assets from being damaged

228
Q

ad hoc (wireless)

A

A decentralized connection mode used by wireless devices without relying on a pre-existing infrastructure, such as routers (wired networks) or access points (wireless networks).

229
Q

live boot

A

The process of booting into an operating system that runs directly on RAM rather than being installed on a storage device

230
Q

account management

A

Processes, functions, and policies used to effectively manage user accounts within an organization.

231
Q

mantrap

A

A physical security control system that has a door at each end of a secure chamber

232
Q

confidentiality

A

The fundamental security goal of keeping information and communications private and protected from unauthorized access

233
Q

SSID broadcast

A

A continuous announcement by a WAP that transmits its name so that wireless devices can discover it

234
Q

bitcoin

A

A decentralized encrypted electronic payment system that is used by legitimate entities and threat actors alike.

235
Q

legal hold

A

A process designed to preserve all relevant information when litigation is reasonably expected to occur

236
Q

vulnerability

A

Any condition that leaves an information system open to harm

237
Q

incident response

A

The practice of using an organized methodology to address and manage security breaches and attacks while limiting danlige and reducing recovery costs

238
Q

backout contingency plan

A

A documented plan that includes specific procedures and processes that are applied in the event that a change or modification made to a system must be undone

239
Q

OSI model

A

A method of abstracting how different layers of a network structure interact with one another

240
Q

cold site

A

A predetermined alternate location where a network can be rebuilt after a disaster

241
Q

prevention controls

A

A security mechanism that helps to prevent a threat or attack from exposing a vulnerability in the computer system

242
Q

false negative

A

Something that is identified by a scanner or other assessment tool as not being a vulnerability when in fact it is

243
Q

screen filter

A

An object attached to a screen that conceals the contents of the screen from certain viewing angles

244
Q

multi-factor authentication

A

An authentication scheme that requires validation of at least two distinct authentication factors

245
Q

refactoring

A

The process of restructuring application code to improve its design without affecting the external behavior of the application or to enable it to handle particular situations

246
Q

staging

A

The process of setting up an environment through which an asset can be quickly and easily deployed for testing purposes

247
Q

hot and cold aisle

A

A method used within data centers and computer rooms to control the temperature and humidity by directing the flow of hot and cold air

248
Q

scale out

A

The process of adding more resources in parallel with existing resources to achieve scale ability

249
Q

system of records

A

A collection of information that uses an individual’s name or an identifying number symbol or other identification Scheme

250
Q

context aware authentication

A

Authentication method using multiple elements to authenticate a user and a mobile device. It can include:

  • Identity
  • Geolocation
  • Device type
251
Q

runtime code

A

Source code that is interpreted by an intermediary run time environment that runs the code rather than the system executing the code directly

252
Q

tethering

A

The process of sharing a wireless Internet connection with multiple devices

253
Q

security policy

A

A formalized statement that defines how security will be implemented within a particular organization

254
Q

risk analysis

A

The security process used for assessing risk damages that affect an organization

255
Q

code signing

A

A form of digital signature that guarantees that source code and application binaries are authentic and have not been tampered wit

256
Q

penetration test

A

A method of evaluating security by simulating an attack on a system

257
Q

interference

A

In wireless networking the phenomenon by which radio waves from other devices interfere with the 802.11 wireless signals used by computing devices and other network devices

258
Q

hypervisor

A

Software that creates, runs, and manages VM

2 types of hypervisors:

  • Type I - runs directly on the hardware, aka bare bones virtualization
  • Type II - runs as s/w within host OS

Several virtualization technologies exist:

  • VMware pdts
  • Microsoft Hyper-V pdts
  • Oracle VM VirtualBox
259
Q

full connect scan

A

A type of port scan that completes the three way handshake identifies open ports and collects information about network hosts by banner grabbing

260
Q

OpenlD Direct

A

An authentication layer that sits on top of the OAuth 2.0 authorization protocol

261
Q

risk management

A

The process of identifying risks analyzing iliem developing a response strategy for them and mitigating their future impact

262
Q

slashdot effect

A

A sudden temporary surge in traffic to a website that occurs when another website or other source posts a story that refers visitors to the victim website

263
Q

SORN

A

A federally mandated publication of any system of record in the Federal Register

264
Q

decryption

A

A cryptographic technique that converts ciphertext back to plaintext

265
Q

operational controls

A

Security measures implemented to safeguard all aspects of day-to-day operations functions and activities

266
Q

wildcard certificate

A

A type of digital certificate that enables organizations to configure a certificate’s scope to encompass multiple subdomains

267
Q

round robin

A

A scheduling approach used by load balancers to route traffic to devices one by one according to a list

268
Q

job rotation

A

A concept that states that personnel -should rotate between job roles to prevent abuses of power reduce boredom and improve professional skills

269
Q

site survey

A

The collection of information on a location for the purposes of building the most ideal infrastructure

270
Q

secure POP

A

A version of the Post Office Protocol that uses SSL or TLS to provide secure communications between a mail client and the mail server

271
Q

network mapper

A

A device or program that can identify the logical topology of a network to reveal its connection pathways

272
Q

order of restoration

A

A concept that dictates what types of systems to prioritize in disaster recovery efforts

273
Q

security architecture review

A

An evaluation of an organization’s current security infrastructure model and security measures

274
Q

remote wipe

A

A security method used to remove and permanently delete sensitive data from a mobile device when it is not in the authorized user’s physical possession

275
Q

subnetting

A

The division of a large network into smaller logical networks

276
Q

vulnerability assessment

A

A security assessment that evaluates a system’s security and its ability to meet compliance requirements based on the configuration state of the system

277
Q

IV attack

A

A wireless attack where the attacker is able to predict or control the IV of an encryption process thus giving the attacker access to view the encrypted data that is supposed to be hidden from everyone else except the user or network

278
Q

extranet

A

A private network that provides some access to outside parties particularly vendors partners and select customers

279
Q

host-based firewall

A

Software that is installed on a single system to specifically guard against networking attacks

280
Q

remote attestation

A

An authentication process that enables a host to verify its hardware and software configuration to a remote host such as a server

281
Q

personnel management

A

The practice of ensuring that all of an organization’s personnel whether internal or external ace complying with policy

282
Q

full backup

A

A backup type in which all selected filesregardless of prior state are backed up

283
Q

deduplication

A

A technique for removing duplicate copies of repeated data. In SIEM the removal of redundant information provided by several monitored systems

284
Q

network operating system

A

Software that controls network traffic and access to network resources

285
Q

computer forensics

A

The practice of collecting and analyzing data from storage devices computer systems networks and wireless communications and presenting the information as a form of evidence in the court of law

286
Q

infrared transmission

A

A form of wireless transmission in which signals are sent as pulses of infrared light

287
Q

service pack

A

A collection of system updates that can include functionality enhancements new features and typically all patches updates and hot fixes issued up to the point of the release of the service pack

288
Q

scanning

A

The phase of the hacking process in which the attacker uses specific tools to determine organization’s infrastructure and discover vulnerabilities

289
Q

data disposal

A

The practice of thoroughly eliminating data from storage media so that it cannot be recovered.

290
Q

spam filter

A

A program that will detect specific words that are commonly used in spam messages

291
Q

IPv4

A

(IP version 4) An Internet standard that uses a 32-bit number assigned to a computer on a TCP /IP network

292
Q

S-box

A

A relatively complex key algorithm that when given the key provides a substitution key in its place

293
Q

checkpoint

A

The state of a virtual machine at a specific point in time.

294
Q

standard operating procedure

A

A collection of procedures that dictate how policy components are implemented

295
Q

redundancy

A

The property by which a computing environment keeps one or more sets of additional resources in addition to the primary set of resources

296
Q

compiled code

A

Code that is converted from high-level programming language source code into a lower level code that can then be directly executed by the system.

297
Q

risk

A

An information security concept that indicates exposure to the chance of damage or loss and signifies the likelihood of a hazard or dangerous threat

298
Q

mandatory vacation

A

A concept that states that personnel should be required to go on vacation for a period of time so their activities can be reviewed

CompTIA Security+ (SY0-501) Terms, Concepts, & Acronyms (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions