Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security+ SYO-501 > Chapter 8 > Flashcards

Chapter 8 Flashcards

Using Risk Management Tools

1
Q

Threat

A

Any circumstance or event that has the potential to compromise confidentiality, integrity, or availability

Compare with risk and vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Malicious Human threats

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Accidental Human Threats

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Environmental Threats

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Threat Assessment

A

An evaluation of potential threats

Some common types of threat assessments are environmental, man made, internal, and external

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Environmental

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Manmade

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Internal

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

External

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Vulnerability

A

A weakness

It can be a weakness in the hardware, the software, the configuration, or even the users operating the system

Compare with Risk and Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Risk Management

A

The practice of identifying, monitoring, and limiting risks to a manageable level

It includes risk response techniques, qualitative risk assessments, and quantitative risk assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Risk Response Techniques

A

Methods used to manage risks

Common risk response techniques are accept, transfer, avoid, and mitigate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Risk Assessment

A

A process used to identify and prioritize risks

It includes quantitative risk assessments and qualitative risk assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Asset Value

A

An element of a risk assessment

It identifies the value of an asset and can include any product, system, resource, or process

The value can be a specific monetary value or a subjective value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Quantitative Risk Assessment

A

A risk assessment that uses specific monetary amounts to identify cost and asset value

It then uses the SLE and ARO to calculate the ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SLE

A

Single loss expectancy

The monetary value of any single loss

It is used to measure risk with ALE and ARO in a quantitative risk assessment

The calculation is SLE x ARO = ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ARO

A

Annual (or annulaized) rate of occurance

The number of times a loss is expected to occur in a year

It is used to measure risk with ALE and SLE in a quantitative risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

ALE

A

Annual (or annualized) loss expectancy

The expected loss for a year

It is used to measure risk with ARO and SLE in a quantitative risk assessment

The calculation is SLE x ARO = ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Qualitative Risk Assessment

A

A risk assessment that uses judgement to categorize risks

It is based on impact and likelihood of occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Likelihood of Occurence

A

The probability that something will occur

It is used with impact in a qualitative risk assessment

Compare with Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Impact

A

The magnitude of harm related to a risk

It is the negative result of an event, such as the loss of confidentiality, integrity, or availability of a system or data

Compare with likelihood of occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Web Server

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Library Computer

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk Register

A

A document listing information about risks

It typically includes risk scores along with recommended security controls to reduce the risk scores

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Supply Chain Assessment
An evaluation of the supply chain needed to produce and sell a product It includes raw materials and all the processes required to create and distribute a finished product
26
Password Cracker
A tool used to discover passwords
27
Network Scanner
A tool used to discover devices on a network, including their IP addresses, their operating system, along with services and protocols running on the devices
28
Ping Scan
Filler
29
ARP Ping Scan
Filler
30
SYN Stealth Scan
Filler
31
Port Scan
Filler
32
Service Scan
Filler
33
OS Detection
Filler
34
Network Mapping
A process used to discover devices on a network, including how they are connected
35
Wireless Scanners
A network scanner that scans wireless frequency bands Scanners can help discover rogue APs and crack passwords used by wireless APs
36
SSIDs
Service set identifier is the name of a wireless network SSIDs can be set to broadcast so users can easily see it Disabling SSID broadcast hides it from casual users
37
MAC Addresses
Filler
38
Signal Strength
Filler
39
Channels
Filler
40
Channel Widths
Filler
41
Security
Filler
42
Vulnerability Scanner
A tool used to detect vulnerabilities A scan typically identifies vulnerabilities, misconfigurations, and a lack of security controls It passively tests security controls
43
Open Ports
Filler
44
Weak Passwords
Filler
45
Default Accounts and Passwords
Filler
46
Sensitive Data
Filler
47
Security and Configuration Errors
Filler
48
Configuration Compliance Scanner
A type of vulnerability scanner that verifies systems are configures correctly It will often use a file that identifies the proper configuration for systems
49
Penetration Testing
A method of testing targeted systems to determine if vulnerabilities can be exploited Penetration tests are intrusive Compare with Vulnerability Scanner
50
Passive Reconnaissance
A penetration testing method used to collect information It typically uses open-source intelligence Compare with Active Reconnaissance
51
Active Reconnaissance
A penetration testing method used to collect information It sends data to system and analyzes responses to gain information on the target Compare with passive reconnaissance
52
Pivot
One of the steps in penetration testing After escalating privileges, the tester uses additional tools to gain additional information on the exploited computer or on the network
53
Black Box Testing
A type of penetration test Testers have zero knowledge of the environment prior to starting the test Compare with gray box test and white box test
54
White Box Testing
A type of penetration test Testers have full knowledge of the environment prior to starting the test Compare with black box test and gray box test
55
Gray Box Testing
A type of penetration test Testers have some knowledge of the environment prior to starting the test Compare with black box test and white box test
56
Exploitation Frameworks
Tools used to store information about security vulnerabilities They are often used by penetration testers (and attackers) to detect and exploit software
57
Protocol Analyzer
A tool used to capture network traffic Both professionals and attackers use protocol analyzers to examine packets A protocol analyzer can be used to view data sent in clear text
58
Nmap
A command-line tool used to scan networks It is a type of network scanner
59
Netcat
A command-line tool used to connect to remote systems
60
Transferring Files
Filler
61
Port scanner
Filler
62
Application
Filler
63
System
Filler
64
Antivirus Logs
Filler
65
Application Logs
Filler
66
Performance Logs
Filler
67
SIEM
Security information and event management A security system that attempts to look at security events throughout the organization
68
Aggregation
Filler
69
Correlation Engine
Filler
70
Automated Alerting
Filler
71
Automated Triggers
Filler
72
Time Synchronization
Filler
73
Event Deduplication
Filler
74
Logs/WORM
** Worm is a Self-replicating malware that travels through a network Worms do not need user interaction to execute
75
Permission Auditing Review
An audit that analyzes user privileges It identifies the privileges (rights and permissions) granted to users, and compares them against what the users need

Security+ SYO-501 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions