CompTIA A+ 1201 - 2.0 Security Flashcards
(99 cards)
1
Q
Shadow IT
A
Shadow IT is any software, hardware or IT resource used on an enterprise network without the IT department’s approval and often without IT’s knowledge or oversight.
2
Q
Share Permissions
A
Full Control - Change permissions and all else.
Change - Change but not permissions.
Read - Read only.
3
Q
Folder Permissions - Read
A
View files and subfolders including their attributes, permissions and ownership.
4
Q
Folder Permissions - Write
A
Create new folders and files, change attributes, view permissions and ownership.
5
Q
Folder Permissions - List
A
View the names of files and subfolders
6
Q
Folder Permissions - Read & Execute
A
Pass-through folders for which no permissions are assigned, plus read and list permissions.
7
Q
Folder Permissions - Modify
A
Includes read/execute and write permissions, as well as the ability to rename and delete the folder.
8
Q
Folder Permissions - Full Control
A
All previous permissions, plus changing permissions, taking ownership and deleteing files/subfolders.
9
Q
File Permissions - Read
A
Read the contents of the file and view attributes, ownership and permissions.
10
Q
File Permissions - Write
A
Overwrite the file and view attributes, ownership and permissions.
11
Q
File Permissions - Read & Execute
A
Read permissions, plus the ability to run applications.
12
Q
File Permissions - Modify
A
Includes Read/Execute and Write permissions, as well as the ability to rename and delete the file.
13
Q
File Permissions - Full Control
A
All previous permissions, plus changing permissions and taking ownership.
14
Q
Windows Server Domain Controller
A
Any Windows based server that provides domain authentication services (logon services) is reffered to as a Domain Controller.
15
Q
Active Directory Domain Services (ADDS)
A
The database that contains the users, groups, and computer accounts in a Windows Server Domain.
16
Q
Member Servers
A
Any server based system that has been configured into the domain, but do not maintain a copy of Active Diretory (Exchange, SQL, Web etc)
17
Q
Organisation Units (OU’s)
A
In WIndows Active Directory, a way of dividing up the domain into different administrative realms.
18
Q
Logon Script
A
A file containing commands that run each time a user logs onto a computer to set up the user environment.
19
Q
CIA Triad
A
Confidentiality - Keeping information and communications private and protected from unauthorized access.
Integrity - Ensuring that data is not altered or tampered with.
Availability - Ensuring that systems operate continuously and that authorized individuals can access what they need.
20
Q
Execution Control (Hardening)
A
A security technique in which the default configuration of a system is altered to protect the system against attacks.
21
Q
Logical Security
A
Controls implemented within software to create an access control system. (Firewall etc)
22
Q
Triple A
A
Authentication - A means to prove identity to computer systems.
Authorization - The process of determining what rights and priveliges a particular entity has.
Accounting - The process of tracking and recording system activities and resource access. (Auditing)
23
Q
Implicit Deny
A
Unless something has explicitly been granted access, it should be denied access. (You’re not on the list pal)
24
Q
Least Privelige
A
Something should be allocated the minimum necessary rights, priveliges or information to perform its role.
25
Symmetric Encryption
A fast, light and less intensive form of encryption that uses a single secret key for encryption/decryption.
You need to securely distribute and store the key.
26
Asymmetric Encryption
A slower, more intensive form of encryption that uses 2 keys (public & private) to encrypt/decrypt data.
The public key encrypts the data, and the private key decrypts. Both are mathematically related.
27
RSA Cipher
The first successful algorithm designed for public key encryption, named after its designers - Rivest, Shamir and Adelman.
28
Key Exchange
Two hosts need to know the same symmetric encryption key without any other host finding out what it is.
29
Cryptographic Encryption
A one-way encryption process, from which it is impossible to recover the original data.
Eg; Active Directory stores a hashed copy of your password, which it will match when you input it during logon. Means that your actual password isn't stored somewhere.
30
SHA-1 & SHA-2
Secure Hashing Algorithm. Utilized during cryptographic encryption to hash data.
Addresses possible weaknesses in the MD5 / MDA
31
MD5 / MDA
Message Digest Algorithm
Used to hash data during cryptographic encryption.
Inferior to SHA-1 & SHA-2
32
Cryptominers
An individual or a group of people that use computers or specialized hardware to participate in blockchain processing to compete for rewards paid in Cryptocurrency.
33
PKI
Public Key Infrastructure
A combination of policies, procedures and technology needed to manage digital certificates in a public key cryptography scheme.
34
CA Server
Certificate of Authority Server.
A server that can issue digital certificates and the associated public/private key pairs.
(Ie; HR gets all the private and public keys associated with their users & machines, so they can communicate securely)
35
Digital Certificate
The X.509 certificate is issued and signed by a CA Server, as a guarantee that the key belongs to the organization that issued it.
Contains a public key that is presented by the logical entity attempting to access system resources and validated by the CA.
(Papers Please)
36
Heuristic Identification
A monitoring technique that allows dynamic pattern matching based on past experience rather than relying on pre-loaded signatures.
An Artificial Intelligence approach to Anti-virus / Anti-malware monitoring that utilizes machine learning to better identify malicious code.
37
NAC
Network Access Control
An umbrella term that relates to the means with which we ensure endpoint security.
Eg; Firewalls, MAC Filtering etc
38
Endpoint
An Endpoint is a remote computing device that communicates back and forth with a network to which it is connected.
Eg; Desktops, Laptops.
39
Health Policy
Policies or profiles describing a minimum security configuration that devices must meet to be granted network access.
Checks for:
- Malware
- Patch Levels
- Personal Firewall Status
- Virus Definitions
(Gonna need to check you before you get in lad)
40
Defense in Depth
Configuring security controls on hosts as well as providing network security, physical security and administrative controls.
Eg; Multiple Firewalls (host/server), MFA
41
Port-based NAC
An IEEE 802.1x standard in which the switch (or router) performs some sort of authentication of the attached device before activating the port.
42
Supplicant
Under 802.1x, the device requesting access to a network.
43
EAPoL
Extensible Authentication Protocol over LAN
Similar to EAP, this is a network authentication protocol developed to give a generic sign on to access network resources.
44
AES Cipher
Advanced Encryption Standard (AES) is a symmetric encryption cipher.
The same key is used to encrypt and decrypt the data in play (messages etc)
45
Phishing
Phishing is when attackers attempt to trick users into doing 'the wrong thing', such as clicking a bad link that will download malware, or direct them to a dodgy website.
46
Spoofing
Faking an identity to gain access to data.
47
Spear Phishing
Spear-phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific victim, often for malicious reasons.
48
Pharming
Online fraud that directs internet users to spoofed websites in order to steal their credentials and data. Will look legitimate, but will not be.
49
Tailgating
Following someone into a restricted area.
50
Footprinting
An information gathering threat, in which the attacker attempts to learn about the configuration of the network and security systems through social engineering or software tools.
51
Network Mapping
Tools used to gather information about the way a network is built, configured and the current status of hosts.
52
Port Scanning
Software that enumerates the status of TCP and UDP ports on a target system. Port scanning can be blocked by some firewalls and IDS (Intrusion Detection System)
53
Eavesdropping
Listening in to communications sent over media - Eavesdropping attacks occur when hackers intercept, delete, or modify data that is transmitted between devices. Also known as sniffing or snooping.
54
MAC Flooding
MAC flooding is a cyberattack that targets network switches on a LAN to try and steal user data, by overloading the switches MAC cache to prevent genuine devices from connecting.
55
ARP Poisoning
ARP Poisoning (also known as ARP Spoofing) is a type of cyber attack carried out over a Local Area Network (LAN) that involves sending malicious ARP packets to a default gateway on a LAN in order to change the pairings in its IP to MAC address table.
56
Address Resolution Protocol
ARP - Port 219
Matches MAC addresses with IP addresses assigned via static/dynamic IP methods.
57
MITM attack
A man-in-the-middle attack is a cyberattack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other, as the attacker has inserted themselves between the two parties.
58
Replay Attack
An attack that involves the capture of transmitted authentication or access control information and its subsequent retransmission with the intent of producing an unauthorized effect or gaining unauthorized access.
59
Mutual Authentication
Mutual authentication is when two sides of a communications channel verify each other's identity, instead of only one side verifying the other. Mutual authentication is also known as "two-way authentication" because the process goes in both directions.
60
Rainbow Table Attack
A rainbow table attack is a password cracking method that uses a special table (a “rainbow table”) to crack the password hashes in a database.
61
Rainbow Table
A rainbow table is a precomputed table for caching the outputs of a cryptographic hash function, usually for cracking password hashes.
62
Dictionary Attack
A dictionary attack is a method of breaking into a password-protected computer, network or other IT resource by systematically entering every word in a dictionary as a password. A dictionary attack can also be used in an attempt to find the key necessary to decrypt an encrypted message or document.
63
Brute Force Attack
A brute force attack is a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys. It is a simple yet reliable tactic for gaining unauthorized access to individual accounts and organizations' systems and networks.
64
Dos (Denial of Service)
A cyberattack that causes a service to fail or be unavailable to legitimate users.
Caused by; Overloading a service, Exploiting design failures, cutting cables...
65
DDoS Attack (Distributed Denial of Service)
A DoS attack that uses multiple compromised computers (a "botnet" of "zombies") to launch the attack.
66
Botnet
A network of Zombies that aim to disrupt a service, usually by overloading it.
67
Zombie
Unauthorized software that directs a device to launch a DoS (Denial of Service) attack.
These machines are not aware of the infection.
68
Cyber Warfare
The use of IT services and devices to disrupt national, state or organizational activities in regards to military operations.
69
Zero-Day Exploit
An attack that exploits a vulnerability in software that is unknown to the software vendor and users.
70
Cross-Site Scripting (XXS)
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.
XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
71
SQL Injection
A common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. This information may include any number of items, including sensitive company data, user lists or private customer details.
72
Mantrap
Physical security method using two gates, only one of which being open at any time.
73
RFID Badge
An access card that contains a chip, read wirelessly to validate entry into secure areas.
74
Entry Control Roster
Sign-in sheet managing access into buildings.
75
Remnant Removal
The erasure of data to the point that the original data is overwritten by random data.
76
Degaussing
Exposing a disk to a powerful electromagnet that scrambles the data stored on the disk, to secure confidential data.
77
Low Level Format
Factory Reset for Storage Devices.
Creates sectors and cylinders on a disk, wiping a disk and filling the blanks with zeros.
78
Authentication Factors
Information used to identify a user.
1) Something you have
2) Something you know
3) Something you are
79
TACACS+
TACACS+ is a remote authentication protocol, which allows a remote access server to communicate with an authentication server to validate user access onto the network. TACACS+ allows a client to accept a username and password, and pass a query to a TACACS+ authentication server.
80
RADIUS
Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that authorizes and authenticates users who access a remote network.
81
Policy Implementation - LSDOE
Local, Site, Domain, OU, Enforced
From least important to the most important.
82
Information Content Management (ICM)
The process of managing information over its lifecycle, from creation to destruction.
83
Document Sensitivity Levels
Unclassified
Classified
Confidential
Secret
Top Secret
84
Personally Identifiable Information (PII)
Data that can be used to identify or contact an individual.
Eg; Social Security, Date of Birth, Email, Phone, Home Address, Biometric Data
85
Protected Health Information (PHI)
Information that identifies someone as the subject of medical and insurance records, plus associated hospital and lab test results.
86
Payment Card Industry Data Security Standard (PCI DSS)
A standard for organizations that process credit or bank card payments, which identifies steps to take if cardholder data is stored.
87
Full Disk Encryption (FDE)
Encryption of all data on a disk - Bitlocker, VeraCrypt, Best Crypt...
88
Data Loss Prevention (DLP)
Software that can identify data that has been classified and apply fine-grained user priveliges to it.
Eg; Policy Server to configure confidentiality rules; Endpoint agents to enforce policies on client computers; Network agents to scan communications at network borders
89
Incident Response Lifecycle
1) Preparation
2) Detection & Analysis
3) Containment, Eradication and Recovery
4) Post-Incident Activities
90
Computer Security Incident Response Team (CSIRT)
A team composed of various levels and departments, prepped to respond quickly to security threats to a network.
91
Virus
Code designed to infect computer files when it is activated.
92
Worm
A type of virus that spreads through memory and network connections, rather than infecting files themselves.
They are self-contained (doesn't need a host program) and can travel, targetting network app vulnerabilities and rapidly consuming network bandwidth.
93
Boot Sector Virus
These viruses attack the boot sector information, the partition table and sometimes the file system itself.
Often this results in errors loading up the operating system.
94
Macro Virus
These viruses affect Office documents by infecting Macros.
95
Spyware
Software that records information about a PC and its user.
96
Rootkit
A class of malware that modifies system files, often at the kernel level, to conceal its presence. Masquerades itself as a .DLL file and can infect multiple facets.
97
Malware Removal Process
IQDRSEE
1) Identify and Research Symptoms
2) Quarantine Infected Systems
3) Disable System Restore (in Windows)
4) Remediate infected systems (scan, remove techniques)
5) Schedule Scans and Updates
6) Enable System Restore and create a Restore Point
7) Educate End User.
98
Quarantine and Remediation Steps
1) Disconnect from network
2) Move infected system to secure area
3) Disable System Restore and other backup systems
4) Scan any removable media devices attached during infection
5) Use the Anti-Virus on system
99
Malware Infection Prevention
1) Inspect and resecure DNS configuration (flush DNS)
2) Check software firewalls for rules
3) Enable System Restore and create a clean backup.
