Glossary Flashcards
Be able to define all terms associated with CompTIA Sec+
1
Q
Define 3DES
A
Digital Encryption Standard version 3 is a type of Symetric encryption algorythm use to encrypt data at block ciphers of 64-bit, also provides confidentiality
2
Q
What is AAA?
A
Authorization, Authentication, Accounting
Authentication verifies identity.
Authorization verifies accesibility to asstets.
Accounting tracks user access with logs.
3
Q
What is ABAC?
A
Attribute-based access control, An access control model based on attributes of its subjects and objects.
4
Q
Define AUP?
A
Accessible Use Policy defines proper system usage and rules of behavior for employees within an organization. This can include the purpose of system or a network, how users interact with them and the responsabilities of the users when accessing a system.
5
Q
What are Access Points?
A
A device that provides an extension of WiFi signal or generates a WiFi signal. Sometimes called WAP (Wireless Access Point)
6
Q
Define Accounting
A
The process of tracking the activity of users and recording this activity in logs, by the use of audit logs that create an audit trail.
7
Q
What are Access Control Lists?
A
List of rules used by routers and stateless firewalls. These devices use the ACL to control traffic based on networks, subnets, IP addresses, ports and some protocols.
8
Q
What is Active Reconnaissance?
A
Penetration Testing method used to collect information. It sends data into systems and analyzes responds to gain information on the target.
9
Q
Define Ad Hoc
A
A connection used by wireless devices without an AP. When wireless devices connect through an AP, they are using infrastructure mode.
10
Q
Whate are Administrative Controls?
A
Security controls implemented via administrative or management methods.
11
Q
Define AES
A
Advanced Encryption Standard, a strong Symmetric block cipher that encrypts data in 128 bit block. AES can use key sizes 128, 192, 256.
12
Q
Affinity is?
A
A scheduling method used with load balancers. It uses the client’s IP address to ensure client is redirected to the same server during a session.
13
Q
Aggregation Switch is?
A
A switch used to connect multiple switches together into a network. Switches connect to the aggregation switch and it connects to a router.
14
Q
What is Agile?
A
A software development life cycle model that focuses on interaction between, customers, developers and testers.
15
Q
Define AH
A
Authentication Header. An option within IPSec to provide authentication and integrity.
16
Q
What is airgap?
A
A physicical security control that provides physical isolation. Systems seperated by an airgap dont typically have any physical connections to other systems.
17
Q
What is ALE?
A
Annual loss expectancy. The expected loss for a year. It is used to measure risk with ARO (Annual Rate of Occurance) and SLE (Single Loss Expectancy) in a quantitative risk assessment. The equation goes:
SLE x ARO = ALE
18
Q
Amplification Attack is?
A
An attack that increases the amount of bandwidth sent to a victim.
19
Q
Anomaly is?
A
Type of monitoring on intrusion detection and intrusion prevention systems. It detects attacks by comparing operations against baseline. It is also known as heuristic detection.
20
Q
Define ANT
A
Propietary wireless protocol used by some mobile devices. It is not an acronym.
21
Q
What is Antispoofing
A
A method used on some routers to protect against spoofing attacks. A common configuration is to implement specific rules to block certain traffic.
22
Q
Antivirus is?
A
Software that protects systems from malware.
23
Q
Define Application Blacklist
A
A list of applications that a system blocks. Users are unable to install or run any applications on the list.
24
Q
what is Application cell ?
A
Also known as application container. A virtualization technology that runs services or applications within isolated application cells or container. Each container shares the kernel of the host.
25
Application Whitelist is:
A list of applications that a system allows. Users are only able to install or run applications on the list.
26
APT is
Advanced Persistent Threat. A group that has both capability and intent to launch sophisticated and targeted attacks.
27
Define ARO
Annual Rate of Occurence. The number of times a loss is expected to occur in a year. It is used to measure risk with ALE and SLE in a quantitative risk assessment.
SLE x ARO = ALE
28
What is arp?
A command-lline tool used to show and manipulate the address resolution protocol.
29
Define ARP poisoning
An attack that misleads systems about the actual MAC address of a system.
30
What is Asset Value?
An _element of a risk assessment_. It identifies the _value of an asset_ and can include any _product, system, resource, or process_. The value can be a _specific monetary value_ or a _subjective value_.
31
Assymetric Encryption is?
A type of encryption using two keys to encrypt and decrypt data. It uses a public key and a private key.
32
Audit trail is?
A _record of events_ recorded in one or more logs. When security professionals have access to all the logs, they can recreate the events that occured leading up to a security incident.
33
What is authentication?
The process that occurs when a _user proves an identity_, such as _with a password_.
34
Define Availaibility
_One_ of the three _main goals of information security_ known as the CIA security triad. Availaibility _ensures that systems and data are up and operational when needed_.
35
Explain the term backdoor
An _alternate method of accessing a system_. Malware often adds a backdoor into a system it infects it.
36
What is a background check
A _check into a person's history_, typically to determine eligibility for a job.
37
Banner grabbing is:
A _method_ used t_o gain information about a remote system_. If identifies the operating system and other details on the remote system.
38
Bycrypt is
_A key stretching algorithm_. It is _used to protect passwords_. _Bycrypt salts passwords with additional bits before encrypting them with Blowfish_. This thwarts rainbow tables attacks.
39
BIOS is:
Basic Input/Output System. _A computer's firmware used to manupulate different settings_ such as the date and time, boot drive and access passwords. UEFI is the designated replacement for BIOS.
40
What is birthday?
A password attack named after the birthday paradox, in probability theory. The paradox states that for any random group of 23 people, there is a 50% chance that 2 of them have the same birthday.
41
Define Black Box Test:
A _type of penetration test_. Testers have _zero knowledge of the environment prior_ to starting the test.
42
Block Cipher is:
An _encryption method_ that encrypts data in _fixed size blocks_.
43
Define Blowfish:
A _strong symmetric Encryption_ method. It encrypts data _in 64-bit blocks_ and supports _key sizes between 32 bits and 448 bits_.
44
Bluejacking is:
An attack agains Bluetooth devices. It is a practice of sending unsolicited messages to nearby Bluetooth devices.
45
What is Bluesnarfing:
An _attack against Bluetooth devices. Attackers gain unauthorized access_ to Bluetooth devices and can access all the data on the device.
46
Bollards are?
Short _vertical posts that act as a barricade_. Bollards block vehicles, _not people_.
47
Bots
Software robots that function automatically. A botnet is a gorup of computers that are joined together. Attackers often use malware to join computers to a botnet, and then use the botnet to launch attacks.
48
BPA is:
Business Partner Agreement, A written agreement that details the relationship between business partners, including their obligations toward the partnership.
49
Bridge is
A network device used to connect multiple networks together. It can be used instead of a router.
50
Define Brute Force:
_A password attack that attempts to guess a password_. Online brute force attacks guess passwords of online systems. Offline attacks guess passwors contained in a file or database.
51
Buffer Overflow is:
An error that occurs _when an application receives more input, or different than it expects_. It exposes system memory that is normally inaccessible.
52
Define BIA:
Business Impact Analysis is a process by which an organization identfies critical systems and components that are esential to the ornganization's success.
53
What is BYOD?
Bring Your Own Device, _A mobile device deployment model_. Employees can connect their personally owned device to the network.
54
CA is
Certificate Authority an organization that _manages, issues and signs certificates_. A _CA is a main element of PKI._
55
Define CAC
Common Access Card. A specialized type of smart card used by the US dept. of Defense. It includes photo identification and provides confidentiality, integrity, authentication and non-repudiation.
56
Captive Portal is
A _technical solution that forces wireless clients using web browsers to complete a process before accessing a network_. It is often used to ensure users afree to an acccestable use policy or pay for accessn.
57
What is Carrier Unlocking
A process of unlicking a mobile phone from specific cellular provider.
58
Define CBC:
Cipher Block Chaining. A _mode of operation_ used for encryption that effectively converts a block cipher into a stream cipher. It _uses a IV for the first block_ and each subsequent block is combined with the previous block.
59
Define CCMP
Counter Mode w/ Cipher Block Chaining Message Protocol. An encryption protocol based on AES and used with WPA-2 for wire;ess security.It is more secure than TKIP was used with the original release of WPA.
60
What is CER
Canonical Encoding Rules, a base format for PKI. They are binary encoded files.
61
Define certificate
A digital file used for encryption, authetntication, digital signatures and more. Public certificates include a public key use dfor asymmetric encryption.
62
What is certificate chaining?
A process that combines ll certificates within a trust model. It includes all the certificates in the tust chain from the root ca down to the certificate issued to the end user.
63
What is a chain of custody?
A process that provides assurance that evidence has been controlles and handled properly after collection. Forensic experts establish a chain of custody when they first collecte evidence.
64
change management is:
The process used to prevent unauthorized changes. Unauthorized chanes often result in unintended outages.
65
Define CHAP
Challenge Handshake Authentication Protocol. An Authentication mechanism where server challenges a client.
66
chroot is:
A linux command used to change the root directory. It is often used for sandboxing.
67
Define ciphertext
The result of encryptiing plaintext. Ciphertext is no in an easily readable format unitl decrypted.
68
What is clean desk policy?
A security policy requiring employees to keep thheir areas orazined and free of papers. The goal is to reduce threats of security incidents by prtecting sesitive data.
69
What is clickjacking?
An attack that tricks users into clicking something other than what they think they're clicking.
70
Cloud Access Security Broker (CASB)?
A software toool or service that enforces cloud-based security requirements. It is placed between the organization's resources and the cloud, monitors all network traffic and can enforce security policies.
71
What is Cloud deployement model:
Cloud model types that identify who has access to cloud resources.
72
Code signing is:
The process of assigning a certificate to code. The certificate includes a digital signature and validetes the code.
73
What is a Cold Site?
An alternate location for operations. A cold site will have power and connectivity needed for activation and validates the code.
74
What is collision?
A hash vulnerability, that can be used to discover passwords. A hash collision occurs when two different passwords create the same hash.
75
What are compensating controls?
Security controls that are alternative controls used when a primary security control is no feasible.
76
Compiled code is:
Code that has been optimized by an application and converted into an executed file. Compare with runtime code.
77
What is confidential data:
Data meant to be kept secret among a certain group of people. As an example, salary data is meant to be kept secret and not shared with everyone within a company.
78
Define Confidendiality
One of the three main goals of information security known as the CIA security triad. Confidentiality ensures that unauthorized entities cannot aces data. Ecryption and access controls help protect against the loss of confidentiality.
79
Configuration compliance scanner is:
A type of vulnerability scanner that verifies systems are configured correctly. It will often use a file that identifies the proper configuration for systems.
80
Confusion is
A cryptography concept that indicates ciphertext is significantly different than plaintext.
81
Containerization is:
A method used to isolate applications in mobile devices. It isolates and protects the application, onclding any data used by the application.
82
Context-aware-authentication is:
An authentication method using multiple elements to authenticate a user and a mobile device. It can include an identity, geolocation, the device type and more.
83
Continuity of operations planning
The planning process that identifies an alternate location for operations after a critical outage. It can include a hot site, cold site, or a warm site.
84
Control diversity is:
The use of different security control types, such as technical controls administrative controls, and pshysical controls.
85
Define Controller-based AP:
An AP that is managed by a controller. Also called a thin AP.
86
COPE
Corporate Owned, Personally Enabled. A mobile device deployment model. The organization purchases and issues devices to employees.
87
What are corrective controls?
Security controls that attempt to reverse the impact of a security incident.
88
What is Cross-Over Error Rate?
The point where the false acceptance rate crosses over with the false rejection rate. A lower CER indicates to an employee more a more accurate biometric system.
89
CRL is:
Certificate Revocation List. A list of certificates that a CA has revoked Certificates are commonly revoked if they are compromised, or issued to an employee who has left the organization.
90
Define XSRF:
Cross-site Request Forgery is a web application attack. XSRF attack tick users into peforming actions on websites, such as making purchases.
91
Define XSS
A web application vulnerability. Attackers embed malicious HTML or AjavaScript code into a web site's code which executes when the user vists the site.
92
What is cypto-malware:
A type of ransomware that encypts the user's data.
93
What is crypto module?
A set of hardware, software, and/or firmware that implements cryptographic functions.
94
What is Crypto Service Provider?
A software library of cryptographic standards and algorithms. These libraries are typically distributed within crypto modules.
95
Define CSR:
Certificate Signining Request. A method of requesting a certificate from a CA. It starts by creating an RSA-Based private/public key pair and then including the public key in the CSR.
96
Define CTM:
Counter Mode. A mode of operation used for encryption that combines an IV with a counter. The combined result is used to encrypt blocks.
97
Custom firmware:
Mobile device firmware other than the firmware provided wiht the device. People sometimes use custom firmware to root Android devices.
98
Cyber-incident response team is:
A group of experts who respond to seucrity incidents. also known as CIRT.
99
Define CYOD:
Choose Your Own Device. A mobile device deployment model. Employees can connect personally owned device to the network as long as the device is on a prepaproved list.
100
DAC is:
Discretionary Access Control. An access control model where all objects have owners and owners can modify permissions for the objects (file and folres). Microsoft NTFS uses teh DAC model.
101
Data at rest is:
Any data stores on media. Its common to encrypt sinsitve data at rest.
102
Define DEP:
A security feature that prevents code from executing in memory reguins marked as nonexecutable. It helps block malware.
103
What is Data exfiltration?
The unauthorized transfer of data outside an organization.
104
Data retention policy is:
A security policy specifying how long data should be kept retained.
105
Data sovereignity is:
A term that referes to the legal implications of data sotred in different countries. It is primarily a concern related to backups sotred in alternate locations via the cloud.
106
DDos
Distributed Denial of Service Attack. An attack on a system launched from multiple sources intended to make computers resources or services unavailable to users. DDos attacks typically include sustained, abnormally high netork traffic. Compare with DoS.
107
What is Dead Code?
Code that is never executred or used. It is often caused by logic errors.
108
Defense in depth is:
The use of multiple layers of security to protect resources. Control diversity and vendor diverisyt are two methods organizations implement to provide defense in depth.
109
What is degaussing?
The process of removing data from magnetic media using a very powerful electronic magnet. Degaussing is somtimes used to remove data from backup tapes or to destroy hard disks.
110
Define DER
Distinguished Encoding Rules. A base format for PKI certificates. They are BASE 64 ASCII econded files. Compare with CER.
111
Define DES
Data Encryption Standard. A legacy symmetric encryption standards used to provide confidentiality. IT hgas been compromised and AES or DES should be used instead.
112
Detective controls
Security controls that attempt to detect secuiry incidents after they have occured.
113
What is a Dictionary?
A password attack that uses a file of words and character comninations. The attack tries every entry within the file when trying to guess a password.
114
What is a differential backup?
A type of back up that backs up all the data that has changed or is different since the last full backup.
115
Define DH:
Deffie-Hellmann, An asymmetric algorithm used to privetly share symmetric keys. DH Ephemeral (DHE) uses ephemeral keys, which are re-created for each session. Elliptic Curve - DHE (ECDHDE) uses elliptic curve cyprtography to generate ecryption keys.
116
What is difussion?
A cyrptography concept that ensures that small changes in plaintext result in significant changes in ciphertext.
117
What is dig?
A command-line tool used to dest DNS on Linux Systems.
118
Digital Signature is:
An encrypted hash of a message, encrypted with the sender's private key. It provides authentication, non-repudiation and integrity.
119
Disablement Policy is:
A policy that identifies when administratods shoulddisable user accounts.
120
Disassociation Attacks are:
An attack that removes wireleess clients from wirtelss network.
121
What is a dissolvable agent:
A nac Agent that runs on a client, but deletees itslef later. It checks the clien for health. Compare with permanent agent.
122
DLL Injection is:
An attack that injects a Dynamic link library into memory and runs it. Attackers rewrite the DLL, inserting malicious code.
123
What is DLP:
Data Loss Prevention. A gorup of techonologies used to prevent data loss. They can block the use of USB devices, monitor outgoing email to detech and block unauthorized data transfers, and monitor data stores in the cloud.
124
What is DMZ?
Demilitrized Zone, A buffer zone between the internet and the internal network. Internet clients can access the services hosted on servers in the DMZ, but the DMZ provides a layer protection for the internal network.
125
Define DNS:
Domain Name System, a Aservice used to resolve host names to IP addresses. DNS zones inlcude records such as A records for IPv4 addresses and AAAA records for IPv6 addresses.
126
What is DNSSEC?
Domain Name System Security Extensions, A suite of extension to DNS used to protect the integrity of DNS records and prevent some DNS attacks.
127
DNS poisoning
An attack that modifies or corrupts DNS results. DNSSEC helps prevent DNS from the owner.
128
Domain hijacking is:
An attack that changes the registration of a domain name withough permission from the owner.
129
What is DoS
Denial of service. An attack from a single source that attempts to disrupt the services provided by the attacked system. Compare with DDoS.
130
Downgrade Attack is:
Atype of attack that forces a system to downgrade its security. The attacker then exploits the lesser security control.
131
DSA
Digital Signature Algorithm. An encrypted hash of a message used for authentication, non-repudiation and integrity. The sender's private key encrypts the hash of the message.
132
Dumpster Diving:
The practice of searching through trash looking to gain information from discarded documents. Shredding or burning papers helpsprevent the successe of dumspter diving.
133
EAP
Extensible Authentication Protocol. An authentication framework that provides general guidance for authentication methods. Variation include PEAP, EAP-TLS, EAP-TTLS, and EAP-FAST.
134
EAP FAST is:
EAP-Flexible. Authentication via Secure Tunneling EAP-FAST. A cisco designed reaplcement for Lightweight EAP (LEAP). It supports certifiates, but they are optional.
135
EAP TLS
Extensible Authentication Protocol-Transport Layer Security. An extension of EAP sometimes used witrh 802.1x. This is one of the most secure EAP standars and is widely implemented. It requires certificates on the 802/1x server and on the clients.
136
EAP-TTLS is
Extensible Autheitcation Protocol-Tunneled Transport Layer Security. An extension of EAP, sometimes used with 802.1x. It allows systems to use some older autheitcation methods such as PAP whthin TLS Tunnel. It requires a certificate on the 802.1x server but not on the clients.
137
ECB is:
Electronic CodeBook is a legacy mode ofoperation used for encryption. It is weak and should be depretacted.
138
What are embedded systems:
Any device that has dedicated function and uses a computer system to perform that function. It includes a CPU, an operating system and one or more applications.
139
EMI is
Electromagnetic Interference, which is caused by motors, powerlines and fluorescnt lights. EMI shielding prevents outside interference sources from corrupting data and prevents data from emanating outside the cable.
140
What is EMP?
Electromagnetic pulse. A short burst of energy that can potentially damage electronic equipment. It can result from electrostatic discharge (ESD), lightning and military weapons.
141
What is encryption?
A process that scrambles or ciphers data to make it unreadable. Encryption normally includes a public algorithm and a privete key. Compare with asymetcis and symmetric encyrption.
142
Enterprise is
A wireless mode that uses an 802.1x server for seuciryt. It forces users to authenticate with a Username and password. Compare with open and PSK modles.
143
ESP
Encapsulating Security Payload, an operation within IPSec, to provide confidentiality, integrity, and autentication.
144
What is an Evil Twin:
A type of rogue AP, an evil twin has the same SSID as a legitimate AP.
145
Exit interview is:
An interview conducted with departing employees, just before they leave an organization.
146
What is an exploitation framework:
Tools used to store information about the security vulnerabiliteis. They are often used by penetraion testers (and attackers), to detecht and exploit software.
147
Extranet is:
The part of an internal network shared with outside entities. Extranets are often used to provide access to authorized business partners cutomers, vendors or others.
148
Facial Recognition is:
A biometric method that identifies poeple based on facial features.
149
False Negative is:
A security inicident that isn't detected or reported. As an example, a NIDS false negativs occurs if an attack is active on the network but the NIDS does not raise the alert.
150
What is False Positive:
An alert on the event that isnt a secyruty indicent. An example, a NIDS false positive occurs if the NIDS raises an alert but activity on the network is normal.
151
FAR is:
False Acceptance Rate, also called the false match rate. A rate that identifies the percentage of ties a biometics authentication system incorrectly indicates a match.
152
What is a Faraday Cage?
A room or enclosure that prevents signals from emanting beyond the room or enclosure.
153
fat AP is:
An AP that includes everything needed to connect wireless clients to a wireless network. Fat APs, must be configured independently. Sometimes called a stand-alone AP. Comapre with thin AP.
154
what is faul tolerance?
The capability of a system to suffer a fault, but continue to operate. Said another way, the system that can tolerate a the fault as if it never occured.
155
What is FDE?
Full Disk Encyption, A method to encypt an entire disk. Compare SED
156
What is federation?
Two or more members of a federeated identity management system. Used for single sign-on.
157
Fingerprint Scanners are:
Biometric system that can fingerprint for authentication
158
What is a firewall:
A software or network device used to filter traffic. Firewall can be application-based (running on a host), or a network-based device. Stateful firewalls filter traffic using rules within an ACL. Stateless firewalls filter traffic based on its state within a session.
159
What are firmware OTA Updates?
Over-the-air updates for mobile device firmware that keep them up to date. These are typically downlodaded to the device from the internet and applied to update the device.
160
What is flood guard?
A methid of thwarting flood attacks. On swithces a flood guard thwarts MAC Flood attacks. On routers a flood guard preventes SYN flood attacks.
161
What is a framework?
A structure used to provide a foundation. Cybersecyrity frameowrks typucalle yse a structure of basic comncepts and provide guidance to professionals on how to implement security.
162
What is FRR?
False Rejection Rate, also called the false nonmatch rate. A rate that identifies the percentage of times a biometric authentication system incorrectly rejects a valid match.
163
What is a FTPs:
File Transfer Protocol Secure. An extension of FTP that uses TLS to encrypt FTP traffic. Some implementations of FTPS use TCP ports 989, 990.
164
What is Full Backup?
A type of backup that backs up all the selected data. A fill backup could be considered a Normal Backup.
165
What is a full Tunnel?
An encrypted connection used with VPNs. When a user is connected to a VPN all traffic from the user us encrypted. Compate with Split tunnel.
166
What is GCM?
Galois/Counter Mode A mode of operation used for encryption. It combines the Counter Mode (CTM), with hashing techniques for data authenticity and condifentiality.
167
What is Geofencing?
A virtual fence or geographic boundary. It uses GPS to create the boundary. Apps can then respond when a mobile device is within a virutal fence.
168
What is geolocation?
The location of adevice identified by GPS. It can help locate a lost or stolen movile device.
169
What is GPO?
Group Policy Object. A technology used withhin Microsoft Windows to amange users and computers. It is implemented on a domain controller wihin a domain.
170
GPS is:
Global Positioning System. A satellite-based navigation system that identifies the location oa device or vehicle. Mobile devices often incorporate GPS capabilities.
171
GPS Tagging is:
A process of adding geopgraphical data to files such as pictures. It typically includes latitude and longitude coordinates of the location where the picture was taken or the file was created.
172
What is gray-box test:
A type of penetration test. Testers have some knowldge of the environment prior to starting the test.
173
Group Based Access Control is:
A role-based access control method that uses groups as roles.
174
What is a Guest Account?:
A pre-created account in Windows Systems. It is disabled by default.
175
Hacktivist is:
An attacker who launches attacks as part of an activist movement or to further a cause.
176
What is a Hardware root of trust?
A known secure starting point. TPMs have a private key bruned into the hardware that provides a hardware root of trust.
177
Hash is:
A number created by executing a hashing algorithm against data, such as a file or message Hashing is commmonly used for intefrity. Common hashing algorithms are MD5, SHA1, HMAC.
178
What is Heuristic?
Also known as behavioral, A type of monitoring on intrusion detection and intrusion prevention systems. It detects attacks by comparing traffic against a baseline. It is also known as anomally detection.
179
HIDS is:
Host-Based instrusion detection system. Software installed on a system to detech attacks. It protects local resources on the host. A host-based intrusion prevention system (HIPS) is an extension of a HIDS. It is software installed on a sustem to detech and block attacks.
180
High Availaibility is:
A term that indicates a system or component remains available close to 100 of the time.
181
HMAC is:
Hash-based Message Authentication Code, A hashing algorithm used to verify integrity, and authenticity of a message with the use of a shared secret. It is typically comabines with another hashing algorithm such as SHA.
182
What's a HOAX?
A message often circulated through email, that tells of impending doom from a virus or other security threat that simply doesnt exist.
183
Home Automation is:
Smart devices used within the home that have IP Addresses. These are typically accessible via the internet and are part of the internet of things.
184
Honeypot is:
A server designed to attackt an attacker. It typically has weakened security encouraging attackers to investigate it.
185
Honeynet is:
A group of honeypots in a network. Honeynets are often configured in virtual networks.
186
Hot and cold Aisles:
A method commonly used in data centers to keep equipment cool. Cool air flows from the front of the cainets to the back, making the fron aisle cooler and the back aisle warmer.
187
HOTP is:
HMAC Based OTP. An open standard used for creating OTP it combines a secret-key and a counter. and then uses HMAC to create a hash of the result.
188
Hot Site is:
An alternate location for operations. A hot site typically includes eveything needed to be operational within 60 minutes. Compare with cold site and warm site.
189
Define HSM:
Hardware Security Module: A removable or external device that can generate, store and manage RSA keys used in asymmetric encryption. Compare with TPM.
190
HTTPS is:
Hypertext transfer Procotol Secure. A protocol use dto encrypt HTTP traffic. HTTPS encrypts traffic with TLS using port 443.
191
What is HVAC:
Heating ventilation and air conditioning. A physical security control that increases availibility by regulating airflow within data centers and server rooms.
192
Define IaaS:
Infrastructure as a Service: A cloud computing model that allows an organization to rent access to hardware in a self-managed platform. Compare with PaaS and SaaS.
193
Define ICS:
Industrial Control System:. A system that controls large systems such as power plants or water treatment facilities. _A SCADA system controls the ICS._
194
Define Identification:
The processs that ocuurs when a user claims an identity, such as with a username.
195
IEEE 802.1X
Authentication protocol used in VPNs, wired and wireless networks. VPNs often implement it as a RADIUS server. Wired networks use it for port based authentication. Wirelesss netowrks use it in Enterprise Mode. It can be used with certificate-based authentication.
196
What is ifconfig:
A command-line tool used on Linux systems to show and manipulate settings on a netowork interface card (NIC). Similiar to IPCONFIG used on Windows Systems.
197
IMAP4
Internet Message Access Protocol version 4. A protocol used to share and manage email on servers. IMAP4 uses TCP port 143. Secure IMAP4 uses TLS to encrypt traffic.
198
What is impact?
The magnitude of harm related to a risk. It is the negative result of an event such as the loss of condidentiality, integrity, or availaiblity of a system or data. Compare, with the likelyhod of occurance.
199
Explain implicit deny:
A rule in an ACL tha blocks all traffic that hasnt been explicitly allowed. The implicit deny rules is the last rule in an ACL.
200
What is an incident response:
The process of responding to a security incident. Organizations often create an incident response plan that outlines the procedures to be used when responding to an incident.
201
IRP (Incident Response Plan) is:
The proceudres documented in an incident response policy.
202
Incident repsonse process is:
The phases of incident repsonse, incluiding preparation identification containment, eradication, recovert and lessons learned.
203
Incremental backup is:
A type of backup that backs up all the data that has changed since the last full incremental backup.
204
Injection Attack is:
An attack that injects code or commands. Common injection attacks are DLL injection commant injection, and SQL Injection attacks.
205
Explain inline:
A configuration that forces traffic to pass through a device. A NIPS is placed inline, allowing it to prevent malicious traffic from entering a network. Sometimes called in band. Compare with out-of-band.
206
What is input validation
A programing process that verifies data is valid before using it.
207
What is an Insider?
An attacker who launches attacks from within an organization, typically as an employee
208
What is Integer Overflow:
An application attack that attempts to use or create a numeric value that is so big for an application to handle. Input handling and error handling thwart the attack.
209
Define Integrity:
One of the three main foals of information security known as the CIA security triad. Integrity provides assurance that data or system configurations have not been modified. Audit logs and hashing are two mthods used to snsure intefiryt. Compare with availability and confidentiality.
210
What is Intranet:
An internal network. Poeple use an intranet to communicate and share content with each other.
211
Define IoT:
Internet of Things. The network of physical devices connected to the internet. It typically refers to smart devices with an IP adress, such as a wearable technology and home automation systems.
212
What is IP:
A command-line tool used on Linux based systems to show and manupulate settings on network interface card (NIC). Developers replaced created this to replace ifconfig.
213
What is IPCONFIG:
A command-line tool used on Windows Systems to show the configuration settings on a NIC.
214
Define IPSec:
Internet Protocol Security, A suite of protocols used to encrypt data-in-transit that can operate in both tunnel mode and transport mode. It uses tunnel mode and Transport mode in private networks.
215
IP Spoofing is:
An attack that changes the source IP Address.
216
What are Iris Scanners?
Biometric Systems that scan the iris of an eye for authentication.
217
What is an ISA?
interconnection security agreement. An agreement that specifies thecnical and security requirements for connections between two or more entities. Compare with MOU/MOA.
218
IV is:
A wireless attack that attempts to discover the Initialization Vector Legacy security protocols are susceptible to IV Attacks.
219
Define Jailbreaking:
The process of modifying an Apple movile device to remove software restrictions. It allows a user to install software from any third party source. Comparable to "rooting".
220
What is jamming?
A DoS attack agains wireless networks. It transmits noise onthe same frequency used by a wireless network.
221
Explain job rotation:
A process that ensures employees rotate through different jobs to learn the process and procedures in each job. It can sometimes detect fraudulent activity.
222
What is KDC?
Key-Distribution Center. Also known as a TFT Server. Part of the Kerberos protocol used for network authentication. The KDC issues a timestamped tickets that expire.
223
What is Kerberos?
A network authentication mechanism used with WindowsActiv Directory domains and some Unix enviromentmts known as "realms". It uses a KDC to issue tickets.
224
What is kernel
The central par of the operating system. In container virtualization, guests share the kernel
225
What is a Keylogger?
Software of ardware used to capture a user's keystrokes. Keystrokes are stored in a file and can be manually retrieved or automatically sent to an attacker.
226
What is keystretching?
A technique used to incerase the strength of stored passwords. It adds additional bits (called salts) and can help thwart brute force and rainbow table attacks.
227
What is Known Plaintext?
A cryptographic attack that decrypts encrypted data. In this attack, the attacker knows the plaintext used to create ciphertext.
228
What is labeling?
The process of ensuring data tagged clearly so that users know its classification. Lables can be physical labels, such as on backup tapes, or digital labels embedded in files.
229
LDAP is:
Lightweight Directory Access Protocol, a protocol used to communicate with directoroes as Microsoft Active Directory. It identifies objects with query strings using codes such as CN=Users and DC=TestDomain.
230
LDAPS
Lightweight Directory Access Protocol Secure. A protocol used to encrypt LDAP traffic with TLS.
231
What is least functionality?
A core principle of secure systems design. Systems should be deplyed with only the applications, services and protocols needed to meet their purpose.
232
What is least privilege?
A security principle that specifies that individuals and process are granted only the rights and permissions needed to perfom assigned the tasks or functions, but not more.
233
What is a Legal Hold?
A cour order to maintain data for evidence.
234
What is the Likelihood of Occurance?
The probability that something will occur. It is used with imacpt in a qualitative risk assessment. Compare with Impact.
235
What is a Load Balancer:
A hardware or software that balances the load between two or more servers. Scheduling methods include soruce address IP affinity and round-robin.
236
What are location-based policies?
Policies that prvent users from logging on from certain locations, or require that they log on only from specific locations.
237
What is a logic bomb?
A type of malware that executes in response to an event. The event might be a specific date or time, or user action such as when
238
What is loop prevention?
A method of preventing switching loop or bridge lopp problems. Both stp and rstp prevent switching loops.
239
What is MAC (Mandatory Access Control)?
Mandatory Access Control. An access control model that uses sensitivty lables assigned to objects. and subjects MAC restrics access based on a need to know.
240
MAC (Media Access Control) is:
A 48-bit address used to identify network interface cards. It is also called a hardware address or a physical address.
241
What is MAC Filtering?
A form of network access control to allow or block acces based on the MAC address. It is configured on siwtches for port security or on APs for wireless security
242
MAC Spoofing is:
An attack that changes soruce MAC Address.
243
What is a Mail Gateway?
A server that examines and processes all incoming and outgoing email. It typically incldes a spam filter and DLP capabilities. Some gateways also provide encryption services.
244
What is malware?
Malicious software. It includes a wide range of software that has malicious intent, such as viruses worms, ransomware, rootkits logic bombs and more.
245
What is a mandatory vacation?
A policy that forces emplyees to take vacation The goal is to deter malicious activity, such as a fraud and embezzelment and detect malicious activity whrn it occurs.
246
What is a man-in-the-browser?
An attack that ionfects vulnerable web brosers. Ir can allow the to capture session data including keystrokes.
247
Man-in-the-middle (MITM) is?
An attack using active interception or eavesdropping. It uses a third computer to capture browser session data, incldugin keystrokes.
248
What is a Mantrap?
A physical secyrity mechanism designed to control access to a secure area, a Mantrap prevents tailgating.
249
Define MD5:
Message Digest version 5, A haching function used to provide integrity. MD5 creates a 128-bit hashes, which are also referred to as MD5 checksums. Experts consider MD5 cracked.
250
Mobile Device Management is
A group of application and/or technologies used to manage devices. MDM tools can monitor mobile devices and ensure they are in complience with security policies.
251
What is a memory leak?
An application flaw that consumes memory without releasing it.
252
MFD is?
Multufuntion devices. Any device that performs multiple funtions. As an example, many printers are MFds because they can print, scan and copy documents. Many also include faxing capabilities.
253
What is MMS?
Multimedia Messaging Service. A method used to send text messages. It is an extension of SMS and supports sending multimedia content.
254
What is a MOA/MOU?
Memorandum of understanding of memorandum of agreement. A type of adreement that defines responsabilities of each party. Compare with ISA.
255
Define MS-CHAPv2:
Microsoft Challenge Handshake Authentication Protocol version 2. Microsoft implementation of CHAP. MS-CHAPv2 provides mutual authentication. Compare with CHAP and PAP.
256
What is MTBF?
Mean Time between failures. A metric that provides a measrue of a system's reliability an is usually represented in hours. The MTBF identifies the average time between failures.
257
What is MTTR?
Mean Time to Recover. A metric that identifies the average time it takes to restore a failed system. Organizations that have maintenance contracts often specify the MTTR as part of the contract.
258
Multifactor Authentication is:
A type of authentication that uses methods from more that one factor of authentication.
259
What is NAC?
Network Access Control A system that inspects clients to ensure they are healthy. Agents inspect clients and agents cna be permanent or dissolvable (also known as agentless).
260
What is NAT?
Network Address Translation, A service that translates public IP addresses to private IP addresses and private IP addresses to public IP Addresses.
261
What is an NDA?
Non-Disclosure Agreement, an agreement that is designed to prohibit personnel from sharing propietary data. It can be used with eomplyees within the organization and with other organizations.
262
What is NETCAT?
A command-line tool used to connect to remote systems.
263
Define netstat:
A command-line tool used to show network statistics on a system.
264
What is network mapping?
A process used to discover devices on a network, including how they are connected.
265
Explain what a Network Scanner is:
A tool used to discover on a network, including their IP Addresses, their operating system, along with services and protocols running on the devices.
266
NFC Attack is:
An attack against mobile devices that use near field communication (NFC). NFC is a gorup of standards that allow mobile devices to communicate with nearby mobile devices.
267
NIDS is:
A network based instursion detection system. A device that detects attacks and raises alerts. A NIDS is installed on network devices, such as routers or firewalls, and monitors network traffic.
268
What is NIPS?
A network based intrusion prevention system. A device that detects and stops attacks in progress. A NIPS is placed inline (also called in-nad) with traffic that it can actively monitor data streams.
269
What is NIST?
National Institute of Standards and Technology. NIST is a part of the US. Department of Commenrce, and it includes an information Technology Laboratory. The ITL publishes special publicaitions related to security that are freely availaible to anyone.
270
What is NMAP?
A command-line tool used to scan networks. It is a type of network scanner.
271
Explain NONCE:
A number used once. Cyrptography elements frequently use a nonce to add randomness.
272
What is non-persistence?
A method used in virtual desktops where changes made by a user are not saved. Most (or all) users have the same desktop. Whe users log-off the destop revers to its original state.
273
Non-Repudiation is:
The ability to prevent a party from denying an action. Digital Signatures and access logs provide non repudiation.
274
What is normalization?
The process of organizing and columns in a database. Normalization reduces redundant data and improves overall database performance.
275
What is nslookup?
A command-line tool used to test DNS on Microsoft Systems. Compare with dig.
276
What is a NTLM?
New Technology LAN Manager. A suite of protocols that provide confidentiality, integrity and authentication within Windows Systems. Versions include NTLM, NTLMv2, and NTLM2 Session.
277
What is OAuth?
An open source standard used for authorization with internet-based single sign-on solutions.
278
Define Obfuscation:
An attempt to make something unclear or difficult to understand. Steganography methods use obfuscation to hide data within data.
279
What is OCSP?
Online Certificate Status Protocol, an alternative to using a CRL, it allows entities to query a CA with the serial number of certificate. The CA answers with good, revoked, or unknown.
280
What is onboarding?
The process of granting individuals access to an organizations computing resources after being hired. It typically includes giving the employee a user account with appropriate permissions.
281
What is open?
A wireless mode that doesnt use security. Compare with enterprise and PSK modes.
282
What is OpenID Connect?
An open source standard used for identification on the internet. It is typically used with OAth and it allows clients to verify the identity of end users without managing their credentials.
283
Open Source intelligence is:
A method of gathering data using public sources such as social media sites and news outlets.
284
What is order of volatility?
A term that refers to the order in which you should collect evidence. For example data in memory is more volatile than data on a disk drive. So it should be collected first.
285
What is out-of-band?
A configuration that allows a device to cllect traffic without the traffic passing through it. Sometimes called passive, compare with inline.
286
What is P7B?
PKCS#7. A common format for PKI certificates. They are DER-Based (ASCII) and commonly used to share public keys.
287
What is P12?
PKCS #12 A common format for PKI certificates. They are CER-Based (binary) and often hold certificates with the private key. They are commonly encrypted.
288
Define PaaS:
Platform as a Service. A cloud computing model that provides cloud customers with a preconfigured computing platform they can use as needed. Compare with IaaS and SaaS.
289
PAP is:
Password Authentication Protocol. An older authentication protocol where passwords or PINs are sent accreoss the network in cleartext. Compare with CHAP and MS-CHAPv2
290
Passive Recoinnassance is:
A penetration testing method used to collect information. It typically uses open source intelligence. Compare with active recoinnassance.
291
What is pass the hash?
A password attack that captures and uses the hash of a password. It attempts to log on as the user with the hash and is commonly associated with the Microsoft NTLM protocol.
292
What is a password cracker?
A tool used to discover passwords.
293
What is patch management?
The process used to keep systems up to date with current patches. It typically includes evaluating and testing patches before deploying them.
294
PBKDF2 is:
A password based Key Derivation Function 2. A key stretching techinque that adds addionationl bits to a password as a salt. It helps prevent brue force and rainbow tables attack.
295
What is PEAP?
Protected Enhanced Mail. A common format for PKI certificates. It can use either CER (ASCII) or DER(Binary) formats and can be used for almost any type of certificates.
296
What is perfect forward secrecy?
A charactieristic of encryption keys ensuring that keys are random. Perfect forward secrecy methods do not use determinist algorythms.
297
What is a Permanent Agent?
A NAC agent that is installed on a client. It checks the client with dissolvable agent.
298
What is permission auditing review?
An audit that analyzes user privileges. It identifies privileges rights and permissions granted to users, and compares them agains what the user needs.
299
What is PFX?
Personal Information Exchange. A common format for PKI certificates. It is the predecessor to P12 certificates.
300
Define PHI:
Personal Health information. PII that includes health information.
301
What is Phishing?
The practice of sending email to users with the purpose of tricking them into revealing personal infromation or clicking on a link.
302
Physical controls are?
Security controls that you can physically touch.
303
Define PII:
Personal Identifiable Information. Information about individuals that can be used to trace a persons identity, such as a full name, birth date biometric data and more.
304
What is Ping?
A command-line tool used to test connectivity with remote systems.
305
What is pinning?
A security mechanism used by some web sites to prvent web site imperonation. Web sites procide clients with a list of public key hashes. Clients store the list and use it to validate the web site.
306
Define PIV:
Personal identity verification card. A apecialized type of smart card used by US federal agencies. It includes photo identification and provides confidentiality integrity, authentication and non repudiation.
307
What is pivot?
Pivot is one of the steps in penetration testing. After escaliting privileges, the tester uses additional tools to gain additional information on the exploited computer or on the network.
308
Describe plaitext:
Text displayed in a readable format. Encryption converts plaintext to ciphertext.
309
What is a pointer dereference?
A programming practice that uses a pointer to refrence a memory area. A failed derefenrece operation can corrupt memory and sometimes even cause an application to crash.
310
What is POP3?
Post Office Porotocoll version 3. A protocol used to transfer email from mail servers to clients.
311
What is port mirror?
A monitoring port on a switch. All traffic going through the switch it also sent to the port mirror.
312
What are preventive control?
Security controls that attempt to prevent a security incident from occuring.
313
What is a Privacy Impact Assessment?
An assessment used to identify and reduce risks related to potential loss of PII. Compare with privacy threshold assessment.
314
What is Privacy Threshold Assessment?
An assessment used to help identify is a system is processing PII. Compare with Privacy Impact Assessment.
315
What is private data?
Information about an individual that shoyld remain private. Personally Identifiable Information and Personal Health Information are two examples.
316
What is a Private key?
A part of a matched key pair used in assysmetric encryption. The priavte key always stays private.
317
What is privilege escalation?
The process of gianing elevated rights and permissions. Malware typically uses a variety of techniques to gain elevated privileges.
318
Privileged Account is:
An account with elevated privileges. Such as an administrator account.
319
What is propietary Data?
Data that is related to ownershop. Common examples are information realted to parents of trade secrets.
