Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

security+ > Basic security controls and data > Flashcards

Basic security controls and data Flashcards

(49 cards)

Start Studying
1
Q

What is the DAD triad

A

Disclosure, Alteration, Denial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the difference between strategic and operational risks

A

Strategic risks impact major goals and objectives, operational risks affect daily functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define physical controls

A

controls used to limit physical access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define managerial controls

A

administrative controls associated with security design and implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define operational controls

A

processes put in place to manage technology in a secure manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the two mechanisms of action DLP uses?

A

watermarking- electronic tags applied by administrators
Pattern matching- flagging transmissions based on signs of sensitive information eg Top Secret or social security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the difference between isolation and segmentation of networks?

A

Segmented networks allow free communication between devices on the same network but restrict outside communication. Isolated systems are completely cut off from outside networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the difference between agent based and agentless DLP?

A

Agent based DLP uses software installed on systems and searches them for sensitive information, and blocks undesirable actions.

Agentless DLP is network based and monitors traffic and can block/allow or encrypt transmissions with sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an MSP

A

Managed service providers remotely manage a customer’s IT infrastructure and end user systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a threat map

A

A geographic representation of where cyber attacks originate from

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an API key?

A

a security token used to authenticate and authorize requests made to an API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the function of a decompiler

A

to translate compiled binary code back its source programming language eg Python or Java

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What do these abbreviations mean in relation to CVSS:
AV
AC
PR
UI
S
C
I
A

A

Attack vector
Attack complexity
Privileges required
User interaction
Scope
Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are these organizations examples of: Ernst & Young, Deloitte, PricewaterhouseCoopers PwC, KPMG

A

These are four of the biggest external audit firms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the five steps of the vulnerability lifecycle

A

Identification, analysis, response and remediation, validation of remediation, reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the eight steps of the SDLC

A

planning, requirements, design, coding, testing, training and transition, ongoing operations and maintenance, end of life decommissioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are APIs used for

A

they are used as interfaces between clients and servers or applications and operating systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a file inclusion attack

A

executing code contained within a file hosted on the victim web server or on a remote server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a cross site request forgery

A

Attackers embed code in one website that sends a command to a second website. The attack is only successful if the victim is already logged on to both sites.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a server side request forgery

Study These Flashcards
A

tricking a server into visiting a URL to retrieve information

21
Q

what is parameter pollution

Study These Flashcards
A

sending more than one value for an input variable to bypass security controls

22
Q

what is a memory leak

Study These Flashcards
A

when an application fails to return memory it no longer needs

23
Q

what is buffer overflow

Study These Flashcards
A

when an attacker manipulates a program into placing more data into an area of memory than expected

24
Q

define key space and key length

Study These Flashcards
A

key space is the range of values possible for use as a key, key length is the number of bits in a key

25
What are the common encryption algorithms used for symmetric encryption
DES and AES
26
what are the common encryption algorithms used for asymmetric encryption
RSA and elliptic curve
27
what is the X.509 standard used for
guidance for constructing digital certificates to include information like the CA name, subject name, subject public key
28
who are some of the major CAs
IdenTrust, AWS, DigiCert Group, Sectigo/Comodo, GlobalSign, Let's Encrypt, GoDaddy
29
what is certificate chaining
using a series of intermediate CAs created by the root CA
30
what are DV and EV certificates
Domain validation, the CA has verified that the subject controls the domain Extended validation, the CA has taken steps to verify that the subject is a legitimate business
31
what are certificate pinning and certificate stapling
Certificate pinning instructs browsers to attach a certificate/public key to a subject Certificate stapling is when an OCSP server attaches a validation response to a certificate which web servers can use instead of repeatedly making OCSP requests
32
what is key stretching
running a piece of data through a hashing algorithm multiple times to make it more resilient to brute force attacks
33
what is homomorphic encryption
encryption methods that allow you to perform computations on the encrypted data and decrypt to get the same result as if calculated on plain text
34
what is the difference between block and stream ciphers
block ciphers encrypt blocks of text at once stream ciphers operate on one character at a time
35
what is an ssh key
a cryptographic key pair used for secure authentication, it replaces traditional password login for remote system login
36
what is vertical vs horizontal scaling
vertical scaling improves the performance/capacity of a system or device horizontal scaling adds more systems or devices for use
37
what is cloud bursting
utilizing a private cloud for the majority of work and a public cloud for needs over capacity
38
what is the risk of resource reuse
unintended users could access data thus breaching confidentiality
39
what is the difference between edge and fog computing
edge computing places processing power on remote sensors so they can process data before sending it to the cloud fog computing puts the processing burden on the local gateway which then sends data to the cloud
40
what is an SNMP trap
error messages sent by devices configured to use SNMP that communicates issues to administrators
41
what are telnet and SSH used for?
They're both used for remote access but telnet has been phased out since it sends data in plain text and SSH provides encryption
42
What are the four security modes for bluetooth
1: no security 2: service level enforced security, offers PIN authentication 3: link level security, encrypts data between paired devices 4: standard pairing with security simple pairing SSP, uses public keys for authentication instead of PINs
43
define bluejacking and bluesnarfing
bluejacking is sending unsolicited messages to bluetooth devices bluesnarfing is unauthorized access to a bluetooth devices usually with the purpose of gathering information like contacts
44
what are the six steps of the incident response process
preparation detection analysis containment eradication recovery
45
what is the difference between centralized and decentralized governance
in centralized governance a central authority dictates policies and standards which are followed by the entire organization in decentralized governance individual businesses have the authority to develop their own policies to achieve cybersecurity
46
describe policies, standards, procedures, and guidelines
policies are high level statements of management intent standards dictate how an organization will carry out policies procedures are detailed processes that must be followed in specific circumstances guidelines provide best practices and recommendations for tasks or concepts
47
what are the three standard elements of a risk register
KRI, risk owner, risk threshold information
48
outline the roles of data subjects, controller, stewards, custodians, and processors
subjects are those whose personal data is being processed controllers determines the reasons for and methods of processing data stewards carry out the intents of the controller and are delegated responsibility custodians don't have controller/steward responsibilities but are accountable for safe handling of information processors are third parties that process information for a controller
49
describe the contents of ISO 27001, 27002, 27701, and 31000
27001 information security management systems 27002 information security controls 27701 managing privacy controls 31000 risk management

security+ (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions