Chapter 1 Flashcards
(129 cards)
1
Q
Define Confidentiality:
A
prevents the unauthorized disclosure of data.
2
Q
The different methods to ensure confidentiality is:
A
Encryption
Access Controls
Steganography
Obfuscation
3
Q
Define Encryption:
A
scrambles data to make it unreadable by unauthorized personnel
4
Q
What is included to provide access controls?
A
Identification
Authentication
Authorization
5
Q
Define Identification:
A
a unique username
6
Q
Define Authentication:
A
a password
7
Q
Define Authorization:
A
grant or restrict access to resources
8
Q
Define Steganography:
A
the practice of hiding data within data
9
Q
Define obfuscation:
A
security through obscurity
10
Q
The CIA security triads includes:
A
Confidentiality
Integrity
Availability
11
Q
Define Integrity:
A
provides assurances that data has not changed
12
Q
What can you use to enforce integrity?
A
Hashing or Message Authentication Code (MAC)
Digital signatures
13
Q
Describe hash:
A
a number created by executing a hashing algorithm against data, such as a file or message
14
Q
What are two key concepts related to integrity?
A
Integrity provides assurances that data has not been modified, tampered with, or corrupted
Hashing verifies integrity
15
Q
Digital signatures provide:
A
non-repudiation
16
Q
Digital signatures requires:
A
the use of certificates
and
Public Key Infrastructure (PKI)
17
Q
Certificates include:
A
keys used for encryption
18
Q
Public Key Infrastructure provides:
A
the means to create, manage, and distribute certificates
19
Q
Define non-repudiation:
A
the ability to prevent a party from denying an action.
20
Q
Access logs provide:
A
non-repudiation
21
Q
Define availability:
A
indicates that data and services are available when needed
22
Q
What is a common goal of fault tolerance and redundancy?
A
To remove each single point of failure (SPOF)
23
Q
Some fault tolerance and redundancy techniques:
A
Disk redundancies
Server redundancies
Load balancing
Site redundancies
Backups
Alternate power
Cooling systems
24
Q
Define disk redundancies:
A
fault-tolerant disks allow a system to continue to operate even if a disk fails
25
RAID-1:
mirroring
26
RAID-5:
striping with parity
27
RAID-10:
striping with a mirror
28
Define server redundancies:
Failover clusters include redundant servers and ensure a service will continue to operate, even if a server fails
Virtualization can also increase availability of servers by reducing unplanned downtime
29
Load balancing uses:
multiples servers to support a single service
30
Site redundancies provide:
an alternate site when a site can no longer function due to a disaster
31
Alternate power:
Uninterruptible power supplies (USPs) and power generators can provide power to key systems even if commercial power fails.
32
Cooling systems:
heating, ventilation, and air conditioning (HVAC) systems improve the availability of systems by reducing outages from overheating
33
One of the basic goals of implementing IT security is to:
reduce risk.
34
Define Risk:
the possibility or likelihood of a threat exploiting a vulnerability resulting in a loss.
35
Define Threat:
any circumstance or event that has the potential to compromise confidentiality, integrity, or availability.
36
Define Vulnerability:
a weakness in either the hardware, software, configuration, or even the users operating the system.
37
When can a security incident occur?
When a threat exploits a vulnerability.
38
Define security incident:
an adverse event or series of events that can negatively affect the confidentiality, integrity, or availability of an organization's information technology (IT) systems and data.
39
Risk mitigation:
reduces the chances that a threat will exploit a vulnerability.
40
Technical controls:
use technology to reduce vulnerabilities
41
Administrative controls:
use methods mandated by organizational policies or other guidelines
42
Physical controls:
are any controls that you can physically touch
43
Preventive controls:
attempt to prevent security incidents
44
Detective controls:
attempt to detect when vulnerabilities have been exploited, resulting in a security incident
45
Corrective controls:
attempt to reverse the impact of an incident or problem after it has occurred
46
Compensating controls:
are alternative controls used when a primary control is not feasible
47
Example of technical controls:
Encryption
Antivirus software
Intrusion detection systems (IDSs) and Intrusion prevention systems (IPSs)
Firewalls
Least privilege
48
Define encryption:
a strong technical control used to protect confidentiality
49
Define antivirus software:
once installed, the antivirus software provides protection against malware infection
50
Define Intrusion detection systems (IDSs) and intrusion prevention systems (IPSs):
can monitor a network or host for intrusions and provide ongoing protection against various threats
51
Define firewalls:
restrict network traffic going in and out of a network
52
Define least privilege:
specifies that individuals or processes are granted only the privileges they need to perform their assigned tasks or functions, but no more.
53
Some common administrative controls are:
Risk assessments
Vulnerability assessments
Penetration tests
54
Risk assessments help:
quantify and qualify risks within an organization so that the organization can focus on the serious risks
55
Vulnerability assessment attempts to:
discover current vulnerabilities or weaknesses
56
Penetration tests attempt to:
exploit vulnerabilities
57
Many administrative controls are also known as:
operations or management controls
58
Operational or management controls include the following families:
Awareness and training
Configuration and change management
Contingency planning
Media protection
Physical and environmental protection
59
Training helps users:
maintain password security, follow a clean desk policy, understand threats such as phishing and malware, and much more
60
Configuration management often uses:
baselines to ensure that systems start in a secure, hardened state
61
Change management helps ensure that:
changes don't result in unintended configuration errors
62
The goal of contingency planning is to:
reduce the overall impact on the organization if an outage occurs
63
Media protection includes:
physical media such as USB flash drives, external and internal drives, and backup tapes
64
Physical and environmental protection includes:
physical controls, such as cameras and door locks, and environmental controls, such as heating and ventilation systems
65
Technical and administrative controls categorize the controls based on:
how they are implemented
66
Some examples of preventative controls are:
Hardening
Security awareness and training
Security guards
Change management
Account disablement policy
67
Hardening is the practice of:
making a system or application more secure than its default configuration
68
Security guards:
prevent and deter many attacks
69
Change management ensures:
that changes don't result in unintended outages
70
Account disablement policy ensures:
that users accounts are disabled when an employee leaves
71
Some examples of detective controls are:
log monitoring
trend analysis
security audit
video surveillance
motion detection
72
Log monitoring:
record details of activity on systems and networks
73
Trend analysis:
monitor logs to detect trends
74
Security audits can:
examine the security posture of an organization
75
Video surveillance can:
record activity and detect what occurred
76
Motion detection can:
detect motion from potential intruders and raise alarms
77
What are the differences between detection and prevention controls?
A detective control can't predict when an incident will occur and it can't prevent it
Prevention controls stop the incident from occurring at all
78
Some examples of corrective controls are:
Intrusion prevention system (IPS)
Backups and system recovery
79
Backups ensure:
that personnel can recover data if it is lost or corrupted
80
System recovery procedures ensure:
administrators can recover a system after a failure
81
Deterrent controls attempt to:
discourage a threat
82
Some physical security controls used to deter threats:
Cable locks
Hardware locks
83
Cable locks deter:
thieves from stealing the laptops
84
Hardware locks:
locks such as locked doors securing a wiring closet or a server room
85
Compensating controls are:
alternative controls used instead of a primary control
86
Virtualization allows you to:
host one or more virtual systems, or virtual machines (VMs), on a single physical system
87
Hypervisor is:
the software that creates, runs, and manages the VMs
88
VM Host is:
the physical system hosting the VMs
89
VM Guest is:
the operating systems running on the host system
90
Host elasticity and scalability refer to:
the ability to resize computing capacity based on the load
91
Type I hypervisors run:
directly on the system hardware
92
Type II hypervisors run:
as software within a host operating system
93
Application cell or container virtualization runs:
services or applications within isolated application cells (or containers)
94
A benefit of container virtualization is that is uses:
fewer resources and can be more efficient than a system using a traditional Type II hypervisor virtualization
95
A drawback of container virtualization is that:
containers must use the operating system of the host.
96
VMs can provide:
segregation, segmentation, and isolation of individual systems
97
Snapshot provides:
you with a copy of the VM at a moment in time, which you can use as a backup
98
When do administrators commonly take snapshots of systems?
Prior to performing any risky operation
99
Risky operations include:
applying patches or updates
testing security controls
installing new applications
100
In a Virtual desktop infrastructure (VDI) or Virtual desktop environment (VDE) a:
user's desktop operating system runs as a VM on a server
101
One benefit of using a VDI/VDE is that:
user PCs can have limited hardware resources
102
Persistence or non-persistence
In a persistent virtual desktop, each user has a custom desktop image
In a non-persistent virtual desktop, the users use the same desktop from a preconfigured snapshot for all users
103
Risks associated with virtualization:
VM escape
VM Sprawl
Loss of confidentiality
104
VM escape is:
an attack that allows an attacker to access the host system from within the virtual system
105
VM sprawl occurs:
when an organization has many VMs that aren't managed properly
106
Kali Linux is:
a free Linux distribution used by many security professionals for penetration testing and security auditing.
107
Ping is:
a basic command used to test connectivity for remote systems
108
What else can you use ping for?
to verify a system can resolve valid host names to IP addresses
test the NIC
Check the security posture of a network
109
How does the ping command check connectivity?
by sending Internet Control Message Protocol (ICMP) echo request packets
110
What is the command that verifies that your computer can connect with another computer on your network?
ping 192.168.1.1
111
Ping on Windows systems:
ping -t 192.168.1.1
112
Windows ping on a Linux system:
ping -c 4 192.168.1.1
113
How to get IP address from Windows command prompt?
ping getcertifiedgetahead.com
114
The ipconfig (Internet Protocol configuration) command shows:
the Transmission Control Protocol/Internet Protocol (TCP/IP) configuration information for a system
115
What is included in the Transmission Control Protocol/Internet Protocol (TCP/IP)?
computer's IP address
subnet mask
default gateway
MAC address
the address of a Domain Name System (DNS) server
116
Linux-based systems use what instead of ipconfig?
ifconfig (short for interface configuration)
117
The netstat command:
allows you to view statistics for TCP/IP protocols on a system
gives you the ability to view active TCP/IP network connections
118
The tracert command:
lists the routers between two systems. In this context, each router is referred to as a hop
119
Windows-based systems use tracert and Linux-based systems use:
traceroute
120
Tracing internet path Windows command prompt:
tracert blogs.getcertifiedgetahead.com
121
Arp is related to:
the Address Resolution Protocol (also ARP)
122
The arp command is used to:
view and manipulate the ARP cache
123
Some of the common state of connections are:
Established
Listen
Close_Wait
Time_Wait
Syn_Sent
Syn_Received
124
Established State:
the normal state for the data transfer phase of a connection
125
Listen State:
indicates the system is waiting for a connection termination request
126
Time_Wait State:
indicates the system is waiting for enough
| time to pass to be sure the remote system received a TCP-based acknowledgment of the connection
127
Close_Wait State:
indicates the system is waiting for a connection termination request
128
Syn_Sent State:
indicates the system sent a TCP SYN (synchronize) packet as the first part of the SYN, SYN-ACK (synchronize-achknowledge), ACK (acknowledge) handshake process and it is waiting for the SYN-ACK response.
129
Syn_Received State:
indicates the system sent a TCP SYN-ACK packet after receiving a SYN packet as the first part of the SYN, SYN-ACK, ACK handshake process
