Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security+ SYO-501 > Chapter 7 > Flashcards

Chapter 7 Flashcards

Protecting Against Advance Attacks

1
Q

DoS

A

Denial-of-Service is and attack from a single source that attempts to disrupt the services provided by the attacked system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

DDoS

A

Distributed Denial of Service is an attack on a system launched from multiple sources intended to make a computers resources or services unavailable to users

DDoS attacks typically include sustained, abnormally high network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Escalation

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Privilege

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

MAC Spoofing

A

An attack that changes the source MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

IP Spoofing

A

An attack that changes the source IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

MITM

A

Man-in-the-Middle is an attack using active interception or eavesdropping

It uses a third computer to capture traffic sent between two other systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ARP Poisoning

A

An attack that misleads systems about the actual MAC address of a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ARP Request

A

filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ARP Reply

A

filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

DNS Poisoning

A

An attack that modifies or corrupts DNS results

DNSSEC helps prevent DNS poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DNSSEC

A

Domain Name System Security Extensions is a suite of extensions to DNS used to protect the integrity of DNS records and prevent some DNS attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Amplification Attack

A

An attack that increases the amount of bandwidth sent to a victim

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Brute Force

A

A password attack that attempts to guess a password

Online brute force attacks guess passwords of online systems

Offline attacks guess passwords contained in a file or database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Dictionary

A

A password attack that uses a file of words and character combinations

The attack tries every entry within the file when trying to guess a password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Hash

A

A number created by executing a hashing algorithm against data, such as a file or message

Hashing is commonly used for integrity

Common hashing algorithms are MD5, SHA-1, and HMAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

MD5

A

Message Digest 5 is a hashing function used to provide integrity

MD5 creates 128-bit hashes, which are also referred to as MD5 checksums

Experts consider MD5 cracked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SHA

A

Secure Hash Algorithm is a hashing function used to provide integrity

Versions include SHA-1, SHA-2, and SHA-3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Pass the Hash

A

A password attack that captures and uses the hash of a password

It attempts to log on as the user with the hash and is commonly associated with the Microsoft NTLM protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Birthday

A

A password attack named after the birthday paradox in probability theory

The paradox states that for any random group of 23 people, there is a 50 percent chance that 2 of them have the same birthday

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Collision

A

A hash vulnerability that can be used to discover passwords

A hash collision occurs when two different passwords create the same hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Rainbow Table

A

A file containing precomputed hashes for character combinations

Rainbow tables are used to discover passwords

PBKDF2 and bcrypt thwart rainbow table attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Salt

A

A random set of data added to a password when creating the hash

PBKDF2 and bcrypt are two protocols that use salts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Replay Attack

A

An attack where the data is captured and replayed

Attackers typically modify data before replaying it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Known Plaintext
A cryptographic attack that decrypts encrypted data In this attack, the attacker knows the plaintext used to create chiphertext
26
Typo Squatting
The purchase of a domain name that is close to a legitimate domain name Attackers often try to trick users who inadvertently use the wrong domain name Also called URL hijacking
27
Hosting a Malicious Website
filler
28
Earning Ad Revenue
filler
29
Reselling the domain
filler
30
Clickjacking
An attack that tricks users into clicking something other than what they think they're clicking
31
Session Hijacking
An attack that attempts to impersonate a user by capturing and using a session ID Session IDs are stored in cookies
32
Domain Hijacking
An attack that changes the registration of a domain name without permission from the owner
33
Man-in-the-Browser
An attack that infects vulnerable web browsers It can allow the attacker to capture browser session data, including keystrokes
34
Shimming
A driver manipulation method It uses additional code to modify the behavior of a driver
35
Refactoring
A driver manipulation method Developers rewrite the code without changing the driver's behavior
36
Zero-day Vulnerability
A vulnerability or bug that is unknown to trusted sources but can be exploited by attackers Zero-day attacks take advantage of zero-day vulnerabilities
37
Memory Leak
An application flaw that consumes memory without releasing it
38
Integer Overflow
An application attack that attempts to use or create a numeric value that is too big for an application to handle Input handling and error handling thwart the attack
39
Buffer Overflow
An error that occurs when an application receives more input, or different input, than it expects It exposes system memory that is normally inaccessible
40
Pointer Deference
A programming practice that uses a pointer to reference a memory area A failed dereference operation can corrupt memory and sometimes even cause an application to crash
41
DLL Injection
An attack that injects a Dynamic Link Library (DLL) into memory and runs it Attackers rewrite the DLL, inserting malicious code
42
Compiled Code
Code that has been optimized by an application and converted into an executable file Compare with runtime code
43
Runtime Code
Code that is interpreted when it is executed Compare with compiled code
44
Input Validation
A programming process that verifies data is valid before using it
45
Verifying Proper Characters
Filler
46
Implementing Boundary or Range Checking
Filler
47
Blocking HTML Code
Filler
48
Preventing the use of certain characters
Filler
49
Race Condition
A programming flaw that occurs when two sets of code attempt to access the same resource The first one to access the resource wins, which can result in inconsistent results
50
Error-Handling
A programming process that handles errors gracefully
51
Errors to users should be general
Fillers
52
Detailed information should be logged
Filler
53
Encryption
A process that scrambles, or ciphers, data to make it unreadable Encryption normally includes a public algorithm and a private key Compare with asymmetric and symmetric encryption
54
Authentication
The process that occurs when a user proves an identity, such as with a password
55
Dead Code
Code that is never executed or used It is often caused by logic errors
56
obfuscation
An attempt to make something unclear or difficult to understand Steganography methods use obfuscation to hide data within data
57
Static code analyzers
Filler
58
Dynamic Anlysis
Filler
59
Stress testing
Filler
60
Sandboxing
The use of an isolated area on a system, typically for testing Virtual machines are often used to test patches in an isolated sandbox Application developers sometimes use the chroot command to change the root directory
61
Model Verification
Filler
62
Waterfall
A software development life cycle model using a top-down approach It uses multiple stages with each stage starting after the previous stage is complete Compare with agile
63
Secure DevOps
A software development process using an agile-aligned methodology It considers security through the lifetime of the project
64
Security Automation
Filler
65
Continuous Integration
Filler
66
Baselining
Filler
67
Immutable System
Filler
68
Infrastructure as Code
Filler
69
Change Management
The process used to prevent unauthorized changes Unauthorized changes often result in unintended outages
70
Version Control
A method of tracking changes to software as it is updated
71
Apache
Filler
72
Internet Information Services (IIS)
Filler
73
Normalization
The process of organizing tables and columns in a database Normalization reduces redundant data and improves overall database performance
74
Homer Simpson
Filler
75
Stored Procedures
A group of SQL statements that execute as a whole, similar to a mini-program Developers use stored procedures to prevent SQL injection attacks
76
Injection Attack
An attack that injects code or commands Common injection attacks are DLL injection, command injection, and SQL injection attacks
77
XSS
A web application vulnerability Attackers embed malicious HTML or JavaScript code into a web site's code, which executes when a user visits the site
78
XSRF
A web application attack XSRF attacks trick users into performing actions on web sites, such as making purchases, without their knowledge
79
Framework
A structure used to provide a foundation Cyber security frameworks typically use a structure of basic concepts and provide guidance to professionals on how to implement security
80
Regulatory
Filler
81
Non-regulatory
Filler
82
National Versus International
Filler
83
Industry-Specific
Filler

Security+ SYO-501 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions