GCGA Ch. 5 Implementing Secure Systems (ST)

Question 1

Endpoints

Answer 1

computing devices such as servers, desktops, laptops, mobile devices, or Internet of Things (IoT) devices.

Question 2

EDR

Answer 2

Endpoint detection and response (EDR) provides continuous monitoring of endpoints. Extended detection and response (XDR) includes other types of devices and systems.

Question 3

Hardening

Answer 3

the practice of making an operating system or application more secure from its default installation.

Question 4

Configuration management practices

Answer 4

help organizations deploy systems with secure configurations. A master image provides a secure starting point for systems. Master images are typically created with templates or other baselines to provide a secure starting point for systems. Integrity measurement tools detect when a system deviates from the baseline.

Question 5

Patch management procedures

Answer 5

ensure operating systems, applications, and firmware are kept up to date with current patches. This ensures they are protected against known vulnerabilities.

Question 6

Change management policies

Answer 6

define the process for making changes and help reduce unintended outages from changes. An application allow list identifies authorized software but blocks all other software. An application block list blocks unauthorized software but allows other software to run.

Question 7

Full disk encryption (FDE)

Answer 7

encrypts an entire disk. A selfencrypting drive (SED) has the encryption circuitry built into the drive.
TPM: A Trusted Platform Module (TPM) is a chip included with many desktops, laptops and some mobile devices, and it supports full disk encryption, a secure boot process, and supports remote attestation. TPMs have an encryption key burned into them and they provide a hardware root of trust.

Question 8

HSM

Answer 8

A hardware security module (HSM) is a removable or external device used for encryption. An HSM generates and stores RSA encryption keys and can be integrated with servers to provide hardware-based encryption. A microSD HSM is a microSD chip with an HSM device installed on it.

Question 9

Protecting confidentiality

Answer 9

The primary method of protecting the confidentiality of data is with encryption and strong access controls. File system security includes the use of encryption to encrypt files and folders.

Question 10

Database encryption methods

Answer 10

You can encrypt individual columns in a database (such as credit card numbers), entire databases, individual files, entire disks, and removable media.

Question 11

DLP

Answer 11

Data loss prevention (DLP) techniques and technologies help prevent data loss. They can block transfer of data to USB devices and analyze outgoing data via email to detect unauthorized transfers.

Question 12

Data exfiltration

Answer 12

the unauthorized transfer of data outside an organization.