Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security + > Fundamentals of Security > Flashcards

Fundamentals of Security Flashcards

(60 cards)

Start Studying
1
Q

What is Information Security?

A

The act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure and corruption, and destruction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Information Systems Security?

A

The act of protecting the systems that hold and process the critical data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the CIA Triad?

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define Confidentiality in the context of the CIA Triad

A

Confidentiality is ensuring that information is only accessible to those with the appropriate authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define Integrity in the context of the CIA Triad

A

Ensure that data remains accurate and unaltered unless modification is required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Availability in the context of the CIA Triad

A

Ensure that information and resources are accessible and functional when needed by authorized users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is non-repudiation?

A

Guaranteeing that a specific action or event has taken place and cannot be denied by the parties involved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is AAA?

A

Authentication, Authorization, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is authentication?

A

Authentication is the process of verifying the identity of a user or system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is authorization?

A

Authorization defines what actions or resources a user can access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is accounting in the context of cyber security?

A

Accounting is the act of tracking user activities and resource usage, typically for audit or billing purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are Security Controls?

A

Security Controls are measures or mechanisms put in place to mitigate risks and protect the confidentiality, integrity, and availability of information systems and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Zero Trust?

A

A security model that operates on the principle that no one, whether inside or outside the organization, should be trusted by default.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 4 Security Control Categories?

A

Technical, Managerial, Operational, Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the 6 types of Security Controls?

A

Preventative, Deterrent, Detective, Corrective, Compensating, Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What 2 planes do we use to achieve Zero Trust?

A

The Control plane and the Data plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the Control Plane?

A

The control plane consists of the adaptive identity, threat scope reduction, policy-driven access control, and secured zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the Data Plane?

A

The data plane is focused on the subject/system, policy engine, policy administrator, and establishing policy enforcement points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a Threat?

A

A threat is anything that could cause harm, loss, damage, or compromise to our information technology systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Where can Threats come from?

A

Natural disasters, cyber-attacks, data integrity breaches, disclosure of confidential information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a Vulnerability?

A

A vulnerability is any weakness in the system design or implementation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Where can Vulnerabilities come from?

A

Software bugs, misconfigured software, improperly protected network devices, missing security patches, lack of physical security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Risk Management?

A

Risk management is finding different ways to minimize the likelihood of an outcome and achieve the desired outcome

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the 5 methods we use to ensure Confidentiality?

A

Encryption, Access Controls, Data Masking, Physical Security Measures, Training and Awareness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Define Encryption
Encryption is the process of converting data into a code to prevent unauthorized access.
26
What are Access Controls?
Access Controls allow us to set strong user permissions, ensuring that only authorized personnel can access certain data.
27
What is Data Masking?
The obfuscation of specific data within a database to make it inaccessible for unauthorized users while retaining authenticity for authorized users.
28
What are the 5 methods we use to ensure data Integrity?
Hashing, Digital Signatures, Checksums, Access Controls, Regular Audits
29
What is Hashing?
Hashing is the process of converting data into a fixed-size value.
30
How do digital signatures help in securing data?
Digital signatures ensure that the data is intact and authentic.
31
What is a checksum?
Checksums are a method to verify the integrity of data during transmission.
32
What is redundancy?
Redundancy is the duplication of critical components or functions of a system with the intention of enhancing its reliability.
33
What are the 4 types of redundancy you need to consider when designing your systems and networks?
Server, Data, Network, and Power.
34
What is the best tool to establish non-repudiation in a digital transaction?
Digital Signatures
35
How is a digital signature created?
A digital signature is created by first hashing a particular message or communication that you want to digitally sign, and then it encrypts that hash digest with the user's private key using asymmetric encryption.
36
What are the 5 commonly used authentication methods?
Something you know, something you have, something you are, something you do, and somewhere you are.
37
What is Multi-Factor Authentication?
A security process that requires users to provide multiple methods of identification to verify their identity.
38
What is a SIEM?
A SIEM is a Security Information and Event Management system. It provides real-time analysis of security alerts generated by various hardware and software infrastructure in an organization.
39
What are Technical Controls?
Technologies, hardware, and software mechanisms that are implemented to manage and reduce risks.
40
What are Managerial Controls?
The strategic planning and governance of security within an organization.
41
What are Operational Controls?
Procedures and measures that are designed to protect data on a day-to-day basis.
42
What are Physical Controls?
Tangible, real-world measures taken to protect assets.
43
Define Preventative Controls
Proactive measures implemented to thwart potential security threats or breaches.
44
Define Deterrent Controls
Discourage potential attackers by making the effort seem less appealing or more challenging.
45
Define Detective Controls
Monitor and alert organizations to malicious activities as they occur or shortly thereafter.
46
Define Corrective Controls
Mitigate any potential damage and restore our systems to their normal state.
47
Define Compensating Controls
Alternative measures that are implemented when primary security controls are not feasible or effective.
48
Define Directive Controls
Guide, inform, or mandate actions. Typically rooted in policy and procedure that sets the standard for behavior within an organization.
49
What is Adaptive Identity?
Adaptive Identity relies on real-time validation that takes into account the user's behavior, device, location and more.
50
What is Threat Scope Reduction?
Threat Scope Reduction limits the users' access to only what they need for their work tasks to reduce the network's potential attack surface.
51
What is Policy-Driven Access Control?
Policy-Driven Access Control entails developing, managing, and enforcing user access policies based on their roles and responsibilities.
52
What are Secured Zones?
Secured Zones are isolated environments within a network that are designed to house sensitive data.
53
What is a Policy Engine?
The Policy Engine cross-references the access request with its predefined policies.
54
What is the Policy Administrator?
The Policy Administrator is used to establish and manage the access policies.
55
What is the Subject/System in regards to the Data Plane?
The Subject/System refers to the individual or entity attempting to gain access to data or resources.
56
What is the Policy Enforcement Point?
The Policy Enforcement Point is where the decision to grant or deny access is actually executed.
57
What are the 2 types of Gap Analysis?
Technical and Business.
58
What is involved in a Technical Gap Analysis?
Evaluating an organizations current technical infrastructure and identifying any areas where it falls short in meeting the technical requirements of its security solutions.
59
What is involved in a Business Gap Analysis?
Evaluating an organizations current business processes to identify any areas where they fall short of the capabilities required to fully utilize cloud-based solutions.
60
What is a POA&M?
Plan of Action and Milestones. The POA&M outlines the specific measures to address each vulnerability, allocates resources, and establishes timelines for remediation.

Security + (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions