Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Security + > Fundamentals of Security > Flashcards

Fundamentals of Security Flashcards

(90 cards)

Start Studying
1
Q

What is the act of protecting data & information from unauthorized access, unlawful modification and disruption, disclosure, corruption, & destruction?

A

Information Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the act of protecting the systems that hold and process the critical data?

A

Information Systems Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does C.I.A stand for?

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Confidentiality?

A

Ensures that information is only accessible to those with the appropriate authorization. Protection of information from unauthorized access & disclosure (Encryption).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrity?

A

Ensures that data remains accurate & unaltered from its original state unless modification is required by an authorized individual (Hashing).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Availability?

A

Ensures that information, systems, & resources are accessible & functional when needed by authorized users (Redundancy).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Non-repudiation?

A

Guaranteeing that a specific action or event has taken place & can’t be denied by the parties involved. Provides undeniable proof in digital transactions (Digital Signatures).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the Triple A’s of Security?

A

Authentication, Authorization, Accounting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Authentication?

A

The process of verifying the identity of a user or system. Ensures individuals or entities who claim to be during a communication or transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Authorization?

A

Defines what actions or resources a user can access. The permissions and privileges granted to users or entities after they have been authenticated (Rules & Policies).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Accounting?

A

The act of tracking user activities & resource usage, typically for audit or billing purposes. A security measure that ensures all user activities are properly tracked & recorded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Security Controls?

A

Measures or mechanisms put in place to mitigate risks and protect the confidentiality, integrity, and availability of information Systems and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Zero Trust?

A

A security model that operates on principle that no one, inside or outside the organization, should be trusted by default.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Control Plane?

A

Consists of the adaptive identity, threat scope reduction, policy-driven access control, and secured zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Data Plane?

A

Focuses on the subject/system, policy engine, policy administrator, and establishing policy enforcement points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Threat?

A

Anything that could cause harm, loss, damage, or compromise to information technology systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Vulnerability?

A

Any weakness in the system design or implementation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Risk Management?

A

Finding ways to minimize the likelihood of an outcome occurring & achieving the desired outcomes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why is Confidentiality important?

A
  1. Protect personal Privacy
  2. Maintain a business advantage
  3. Achieve regulatory compliance (PII, PHI, Financial Data)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are 5 methods to maintain Confidentiality?

A
  1. Encryption
  2. Access Controls
  3. Data Masking
  4. Physical Security Measures
  5. Training & Awareness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Encryption?

A

The Process of converting data into code to prevent unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Access Controls?

A

Ensures only authorized personnel can access or modify certain types of data, reducing the risk of unintentional or malicious alterations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Data Masking?

A

Obscuring data within a database to make it inaccessible for unauthorized users while retaining the real data’s authenticity and use for authorized users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Physical Security Measures?

A

Ensures confidentiality for physical types of data and for digital information contained on servers and workstations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Training & Awareness?
Regular training on security awareness best practices that employees can use to protect the organization's sensitive data.
26
Why is Integrity important?
1. To ensure Data Accuracy 2. Maintain Trust 3. Ensures System Operability
27
Hashing?
The process of converting data into a fixed-size value.
28
Hash Digest?
A digital fingerprint for any given piece of data to prove its integrity.
29
Digital Signatures?
Use encryption to ensure integrity & Authenticity.
30
Checksums?
Method to verify the integrity of data during transmission.
31
Regular Audits?
Involve reviewing logs & operations to ensure that only authorized changes have been made & any discrepancies are addressed.
32
3 Nines (99.9%)?
8,760 hours are available & can only be down for a maximum of 8.76 hours.
33
5 Nines (99.999%)
The gold standard. System guarantees a downtime of no more than 5.26 minutes in a year.
34
99% Up time?
3.5 Days of downtime per year.
35
Why is Availability important?
1. Ensures Business Continuity 2. Maintains Customer Trust 3. Upholds Organization's Reputation
36
Redundancy?
The duplication of critical components or functions of a system with the intention of enhancing its reliability.
37
What are the 4 types of Redundancy?
1. Server 2. Data 3. Network 4. Power
38
Server Redundancy?
Using multiple servers in a load balance so if one is overloaded or fails, the other servers can take over the load to continue supporting end users.
39
Data Redundancy?
Involves storing data in multiple places.
40
Network Redundancy?
If one network path fails, the data can travel through another route.
41
Power Redundancy?
Using backup power sources to ensure an organization's systems remain operational during periods of power disruption or outages within a local service area.
42
How is a Digital Signature created?
By first hashing a particular message or communication to be digitally signed & encrypting the hash Digest with the user's private key using asymmetric encryption.
43
Why is non-repudiation important?
1. Confirms the Authenticity of Digital Transactions 2. Ensures the Integrity of Communications 3. Provides accountability in digital processes.
44
What are the 5 Authentication methods?
1. Something you know 2. Something you have 3. Something you are 4. Something you do 5. Somewhere you are (K.P.I.A.L)
45
What is Two-factor Authentication (2FA)?
Combining two Authentication methods for verification & security access.
46
What is Multi-factor Authentication (MFA)?
Security process that requires users to provide multiple methods of identification to verify their identity (two or more methods).
47
Why is Authentication important?
1. Prevents Unauthorized Access 2. Protects User data & Privacy 3. Ensures resource validity
48
Why is Authorization important?
1. It protects sensitive data 2. Maintains system integrity in organizations 3. Creates more streamlined user experiences.
49
Audit Trail?
Provides chronological record of all user activities that can be used to trace changes, unauthorized access, or anomalies back to a specific user or point in time.
50
Regulatory Compliance?
Maintains a comprehensive record of all the users' activities.
51
Forensic Analysis?
Uses detailed accounting and event logs that can help cyber security experts understand what happened, how it happened, & how to prevent similar incidents from occurring again in the future.
52
Resource Optimization?
Organizations can optimize system performance & minimize costs by tracking resource utilization & allocation decisions.
53
User Accountability?
Ensures users' actions are monitored and logged, deterring potential misuse & promoting adherence to organization's policies.
54
Syslog Servers?
Used to aggregate logs from various network devices & systems so that system administrators can analyze them to detect patterns or anomalies in the organization's systems.
55
Network Analyzers?
Used to capture & analyze network traffic to gain detailed insights into all the data moving within a network.
56
S.I.E.M (Security Information & Event Management)?
Provides real-time analysis of security alerts generated by various hardware & software infrastructures in an organization.
57
What are the 4 categories of Security Control?
1. Technical 2. Managerial 3. Operational 4. Physical
58
Technical Controls?
The technologies, hardware, & software mechanisms that are implemented to manage & reduce risks.
59
What are examples of Technical Controls?
1. Antivirus Software 2. Firewalls 3. Encryption Processes 4. Intrusion Detection Systems
60
Managerial Controls?
Involve the strategic planning & governance side of security. It encompasses security policies, training programs, & incident response strategies.
61
Operational Controls?
Procedures & measures that are designed to protect data on a day-to-day basis & are mainly governed by internal processes & human actions.
62
What are examples of Operational control?
1. Backup Procedures 2. Account Reviews 3. User Training Programs
63
Physical Controls?
Tangible, real-world measures taken to protect assets.
64
What are the 6 types of Security Control?
1. Preventative 2. Deterrent 3. Detective 4. Corrective 5. Compensating 6. Directive
65
Preventative Controls?
Proactive measures implemented to thwart potential security threats or breaches.
66
Deterrent Controls?
Aim to discourage potential attackers by making the effort seem less appealing or more challenging.
67
Detective Controls?
Monitor & alert organizations to malicious activities as they occur or shortly thereafter.
68
Corrective Controls?
Mitigate any potential damage & restore the systems to their normal state.
69
Compensating Controls?
Alternative measures that are implemented when primary security controls are not feasible or effective.
70
Directive Controls?
Rooted in policy or documentation & sets the standards for behavior within an organization.
71
Zero Trust?
Demands verification for every device, user, & transaction within the network, regardless of origin. "Trust nothing, verify everything."
72
What are the two things needed to create a Zero Trust architecture?
1. Control Plane 2. Data Plane
73
Control Plane?
The framework & set of components responsible for defining, managing, & enforcing the policies related to user & system access within an organization.
74
What are the key elements of the Control Plane?
1. Adaptive Identity 2. Threat Scope Reduction 3. Policy-driven Access Control 4. Secured Zones
75
Adaptive Identity?
Rely on real-time validation that takes into account the user's behavior, device, location, and more.
76
Threat Scope Reduction?
Limit the users' access to only what they need for their work tasks because this drastically reduces the network's potential attack surface.
77
Policy-Driven Access Control
Developing, managing, & enforcing user access policies based on their roles & responsibilities.
78
Secured Zones?
Isolated environments within a network that are designed to house sensitive data.
79
What does the Control Plane use to make decisions about (policy-driven) access?
1. Policy Engine 2. Policy Administrator
80
Policy Engine?
Cross-references the access request with its predefined policies.
81
Policy Administrator?
Used to establish & manage the access policies.
82
What does the Data Plane consist of?
1. Subject/System 2. Policy Enforcement Point
83
Subject/System?
Refers to the individual or entity attempting to gain access.
84
Policy Enforcement Point
Allow or restrict access, & it will effectively act as a gatekeeper to the sensitive areas of the systems or networks.
85
Gap Analysis?
The process of evaluating the differences between an organization's current performance & its desired performance.
86
What are the steps to Gap Analysis?
1. Define the Scope of Analysis 2. Gather data on the current state of the organization 3. Analyze the data to identify the gaps 4. Develop a plan to bridge the gap(s)
87
What are the two types of Gap Analysis?
1. Technical Gap Analysis 2. Business Gap Analysis
88
Technical Gap Analysis?
Evaluating an organization's current technical infrastructure & identifying any areas where it falls short of the technical capabilities required to fully utilize their security solutions.
89
Business Gap Analysis?
Evaluating an organization's current business processes & identifying any areas where they fall short of the capabilities required to fully utilize cloud-based solutions.
90
Plan of Action & Milestones (POA&M)?

CompTIA Security + (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions