Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Security+ Study Guide by Mike Chapple > Chapter 6 > Flashcards

Chapter 6 Flashcards

Application Security

1
Q

Software Development Life Cycle (SDLC)

A

The steps in a model for software development throughout its life. The process of designing, creating, supporting, and maintaining that software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Software Development Phases

A

It can differ and order may vary but generally this is the order.

  1. Planning Phase
  2. Requirements Definition Phase
  3. Design Phase
  4. Coding Phase
  5. Testing Phase
  6. Training and Transition Phase
  7. Operations and Maintenance Phase
  8. Decommissioning Phase
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Planning Phase

Software Development Phases (SDLC)

A

Where initial investigations into whether the effort should occur are conducted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Requirements Definition Phase

A

Customer input is sought to determine what the desired functionality is, what the current system or application currently does and doesn’t do, and what improvements are desired.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Design Phase

SDLC

A

Where security considerations are integrated into the planning and architecture of systems, applications, or networks. This proactive approach aims to minimize vulnerabilities before they are introduced during development.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Coding Phase

A

Write and compile the actual source code based on the design. Unit testing, the testing of small components individually to ensure they function properly, may occur in this phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Testing Phase

A

Formal testing with customers or others outside of the development team. Perform various types of tests (Unit, integration, system, user acceptance testing).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Training and Transition Phase

A

Ensuring that the end users are trained on the software and that the software has entered general use. (This phase may also be called: The acceptance, installation, and deployment phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Operations and Maintenance Phase

A

The longest phase. This phase includes patching, updating, minor modifications, and other work that goes into daily support.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Decommissioning Phase

A

When a product or system reaches the end of its life. Data migration or archiving, system shutdown, security assessments, documentation updates, and post decommission review all occur in this final phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Code Deployment Environments

A

There are many environments used but these are the most common:

  • Development Environment
  • Test Environment
  • Staging Environment
  • Production Environment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Development Environment

A

Typically used for developers or other “builders” to do their work.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Test Environment

A

This is where the software or systems can be tested without impacting the production environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Staging Environment

A

A transition environment for code that has successfully cleared testing and is waiting to be deployed into production.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Production Environment

“Code Deployment Environment”

A

The live system. Software, patches, and other changes that have been tested and approved move to production.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

DevOps

A

Seeks to resolve issues of software development, quality assurance, and technology operations by bringing the three functions together in a single operational model. The word DevOps is a combination of development and operations, symbolizing that these functions must merge and cooperate to meet business requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DevSecOps

A

DevOps model that includes security as a core component.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CI/CD pipeline

A

Automates the software release process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Continuous integration (CI)

A

A development practice that checks code into a shared repository on a consistent, ongoing basis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Continuous deployment (CD)

A

Sometimes called continuous delivery; it rolls out tested changes into production automatically as soon as they have been tested.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Continuous validation

A

Closely linked to Continuous Integration (CI) and Continuous Deployment (CD). It helps developers automatically test and verify new code before it is merged into the main system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Continuous monitoring

A

A monitoring practice that uses automation to facilitate 24/7 monitoring of systems and networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Open Worldwide Application Security Project (OWASP)

A

The home of a broad community of developers and security practitioners, and it hosts many community- developed standards, guides, and best practice documents, as well as a multitude of open source tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Application Programming Interfaces (APIs)

A

Interfaces between clients and servers or applications and operating systems that define how the client should ask for information from the server and how the server will respond.

APIs allow application developers to interact directly with a web service through function calls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Fuzzing (Fuzz Testing)
Involves sending invalid or random data to an application to test its ability to handle unexpected data. The app is monitored to see if it crashes, fails, or reacts in an incorrect manner.
26
Injection Vulnerabilities
These vulnerabilities allow an attacker to supply some type of code to the web application as input and trick the web server into either executing that code or supplying it to another server to execute.
27
What is a SQL injection attack? (SQLi)
A hacking technique where malicious SQL code is inserted into input fields to exploit database vulnerabilities, giving attackers unauthorized access to sensitive data like passwords or credit card information.
28
Blind SQL Injection
Technique used to conduct an attack even when they don't have the ability to view the results directly. There are two forms of blind SQL injection: content-based and timing-based.
29
Content-Based blind SQL injection Attack
The perpetrator sends input to the web application that tests whether the application is interpreting injected code before attempting to carry out an attack.
30
Blind Timing-Based SQL Injection Attack
The attacker uses SQL commands that cause delays in the application's response. By measuring the time it takes for the application to respond, they can infer whether their query was successful.
31
Code Injection Attacks
These attack seek to insert attacker-written code into the legitimate code created by a web application developer.
32
Session Hijacking
An attack that occurs when a malicious individual intercepts part of a communication between an authorized user and a resource and then uses a hijacking technique to take over the session and assume the identity of the authorized user.
33
Cookie
A storage object maintained in the user's browser that holds variables that may later be accessed by the website that created them.
34
On-Path Attack
The attacker fools the user into thinking that the attacker is actually the target website and presenting a fake authentication form.
35
Session Replay
Once an attacker has a cookie, they may perform cookie manipulation to alter the details sent back to the website or simply use the cookie as the badge required to gain access to the site.
36
Secure cookies
A cookie that is marked with the SECURE attribute to protect against cookie theft. These are never transmitted over unencrypted HTTP connections.
37
NTLM pass-the-hash attack
Another form of replay attack that takes place against a Windows system and then harvests stored NTLM password hashes from that system.
38
Insecure Direct Object Reference (IDOR)
When a web app/API lets users see or use things like files, database entries, or user IDs without checking if they actually have permission.
39
Directory Traversal
Also known as Path Traversal, is a type of vulnerability that allows attackers to access files and directories outside the intended scope of a web application. This happens when the application fails to properly validate user input, enabling attackers to manipulate file paths and gain unauthorized access to sensitive data.
40
File Inclusion Attacks
They execute the code contained within a file, allowing attackers to fool the web server into executing arbitrary code.
41
Local File Inclusion Attacks
Seek to execute code stored in a file elsewhere on the web server.
42
Remote File Inclusion Attacks
They allow the attacker to go a step further and execute code that is stored on a remote server. They do not have to have a file stored on the local server.
43
Web Shell
Malicious scripts uploaded to a web server to give attackers unauthorized access and control. They are often written in server-supported languages like PHP or Python. Once active, webshells let attackers execute commands, steal sensitive data, or manipulate files.
44
Privilege Escalation Attacks
Seek to increase the level of access that an attacker has to a target system.
45
Application Program Interface (API)
A set of rules and tools that allows different software systems to communicate with each other. Think of it as a bridge that connects two programs, enabling them to share data or functionality.
46
Cross-Site Scripting (XSS)
These occur when web applications allow an attacker to perform HTML injection, inserting their own HTML code into a web page.
47
Request Forgery Attacks
Exploit trust relationships and attempt to have users unwittingly execute commands against a remote server.
48
Cross-Site Request Forgery (CSRF/XSRF)
Similar to XSS attacks but exploit a different trust relationship. XSRF Attacks exploit the trust that remote sites have in a user's system to execute commands on the user's behalf.
49
Server-Side Request Forgery (SSRF)
Exploit a similar vulnerability but instead of tricking a user's browser into visiting a URL, they trick a server into visiting a URL, based on user-supplied input.
50
Input Validation
The process of checking and ensuring that any data or information received, especially from users over the internet, is correct, safe, and suitable before using it.
51
Allow Listing
The developer describes the exact type of input that is expected from user and then verifies that the input matches the specification before passing the input to other processes or servers. EX (Python): age = int(input("age: ") if age > 125 or if age < 0: print("Input is invalid, must enter a number between 0-125")
52
Deny Listing
A security practice where specific items, users, or inputs are blocked because they are known to be harmful, suspicious, or unacceptable. Developers describe potentially malicious input that must be blocked.
53
Parameter Pollution
It works by sending a web application more than one value for the same input variable.
54
Web Application Firewalls (WAFs)
A security tool designed to protect web applications by filtering, monitoring, and blocking HTTP traffic between a web application and the internet. It acts as a shield to defend against common web-based threats.
55
Parameterized Queries
Instead of directly embedding user input into SQL statements, parameterized queries use placeholders for input values. This approach prevents SQL injection attacks, where malicious input could alter the structure of a query.
56
Sandboxing
The practice of running an application in a controlled or isolated environment to prevent it from interacting negatively with other system resources or applications.
57
Code Signing
Provides developers with a way to confirm the authenticity of their code to end users.
58
Dead Code
Where code is in use in an organization but nobody is responsible for the maintenance of that code and, in fact, nobody may even know where the original source files reside.
59
Scalability ## Footnote "Application Resilience"
This says that applications should be designed so that computing resources they require may be incrementally added to support increasing demand.
60
Elasticity ## Footnote "Application Resilience"
This says that applications should be able to provision resources automatically to scale when necessary and then automatically deprovision those resources to reduce capacity (and cost) when it is no longer needed.
61
Package Monitoring
This involves keeping track of all the third party libraries or packages used in your organization, understanding what they do, and being aware of any potential vulnerabilities they may have.
62
Memory leaks
Occurs when a computer program fails to release memory that is no longer needed, causing the system to gradually run out of available memory. This can lead to performance issues, such as slower response times, increased memory usage, or even application crashes.
63
Memory Pointers
An area of memory that stores an address of another location in memory.
64
Pointer Derefrencing
The process of accessing the value stored at the memory location that a pointer points to. In programming languages like C and C++, pointers are variables that store memory addresses. Dereferencing allows you to interact with the actual data at that address.
65
Buffer Overflow Attacks ## Footnote memory injection
Occur when an attacker manipulates a program into placing more data into an area of memory than is allocated for the program's use.
66
Memory Injection
A technique where malicious code is injected directly into a program's runtime memory. This allows attackers to manipulate the program's behavior or gain unauthorized access to sensitive data and system resources.
67
Integer Overflow
A variant of buffer overflow where the result of an arithmetic operation attempts to store an integer that is too large to fit in the specified buffer.
68
Race Conditions
Occur when the security of a code segment depends upon the sequence of events occurring within a system.
69
Time-of-Check (TOC) ## Footnote Race Conditions
The instance when a system verifies access permissions or other security controls.
70
Time-of-Use (TOU) ## Footnote Race Conditions
The moment when the system accesses the resource or uses the permission that was granted.
71
Target of Evaluation (TOE) ## Footnote Race Conditions
Refers to the particular component, system, or mechanism being evaluated or tested for potential vulnerabilities, such as the system's method of managing and validating access permissions.
72
Security Orchestration, Automation, and Response (SOAR)
Refers to a set of tools and services designed to improve the efficiency and effectiveness of cybersecurity operations. It integrates various security tools, automates repetitive tasks, and streamlines incident response workflows.
73
User Provisioning ## Footnote Use Cases of Automation and Scripting
Automated scripts can handle the process of adding, modifying, or removing user access to systems and networks, reducing manual efforts and human error.
74
Resource Provisioning ## Footnote Use Cases of Automation and Scripting
Scripts can automate the allocation and deallocation of system resources, ensuring optimal performance and reducing the burden on IT staff.
75
Guard Rails ## Footnote Use Cases of Automation and Scripting
Automation can be employed to enforce policy controls and prevent violations of security protocols.
76
Security Groups ## Footnote Use Cases of Automation and Scripting
Automated processes that can manage security group memberships, ensuring users have appropriate permissions.
77
Ticket Creation ## Footnote Use Cases of Automation and Scripting
Automation can streamline the ticketing process, enabling immediate creation and routing of issues to the right teams.
78
Escalation ## Footnote Use Cases of Automation and Scripting
In case of a major incident, scripts can automate the escalation process, alerting key personnel quickly.
79
Enabling/Disabling services and access ## Footnote Use Cases of Automation and Scripting
Scripts can automate the build and test process, ensuring faster and more reliable software delivery.
80
Integrations and APIs ## Footnote Use Cases of Automation and Scripting
Automated process can handle data exchange between different software applications through APIs, enhancing interoperability.
81
Benefits of Automation and Scripting
-Achieving efficiency and time savings -Enforcing baslines -Standardizing infrastructure configurations - Scaling in a secure manner - Retaining Employees - Reducing Reaction Time - Serving as a workforce multiplier

CompTIA Security+ Study Guide by Mike Chapple (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions