Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ (SY0-701) > Lesson 11: Enhance Application Security Capabilities > Flashcards

Lesson 11: Enhance Application Security Capabilities Flashcards

1
Q

List 3 modern email security protocols

A
  1. DomainKeys Identified Mail - DKIM
  2. Sender Policy Framework - SPF
  3. Domain-based Message Authentication, Reporting & Conformance - DMARC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

List two traditional email security protocols

A
  1. SMTPS
  2. IMAPS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What protocols are used for secure file transfers?

A

SFTP (SSH File Transfer Protocol) or FTPS (File Transfer Protocol Secure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What protocol is used for secure directory access?

A

LDAPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What protocol is used for secure DNS queries?

A

DNSSEC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Describe the formal process an organization would go through to implement a secure protocol

A

Assessing risks, reviewing policies, and evaluating the security features of different protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are two transport methods?

A

TCP and UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define ‘Transport Layer Security (TLS)’

A

Uses certificates for authentication and encryption to protect web communications and other application protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the purpose of installing a certificate on a client computer?

A

For VPNs and enterprise networks that require mutual authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What improvement was added to TLS 1.3

A

Removing the ability to perform downgrade attacks by preventing the use of unsecure features and algorithms from previous versions; Handshake protocol has less messages to speed up connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define a ‘Cipher suite’

A

Lists of cryptographic algorithms that a server and client both support and can use to negotiate a secure connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define ‘hash key derivation function’

A

Deriving a key suitable for use as input to an encryption algorithm; A password, a salt, and a cost factor as inputs then generate a password hash.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do client and server agree upon a cipher suite in TLS 1.3?

A

The client sends a hello message stating the versions of TLS and cipher suites that it can support; The server responds with a cipher suite and version that both it and the client can support as well as its certificate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does a client adjust to a servers cipher suite?

A

After accepting the servers public key certificate, it uses the Change Cipher Spec command to start using the agreed symmetric cipher and key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What ports does LDAP use?

A

Port 389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define a ‘simple bind’ authentication in the LDAP protocol

A

The client authenticates with its distinguished name (DN) and password, but these are passed as plaintext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define ‘Simple Authentication and Security Layer (SASL)’ authentication in the LDAP protocol

A

Preferred mechanism for Microsoft’s AD implementation of LDAP; The client and server negotiate the use of a supported authentication mechanism, such as Kerberos.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define ‘LDAP Secure (LDAPS)’

A

Implementing LDAP using SSL/TLS encryption; The server is installed with a digital certificate, which it uses to set up a secure tunnel for the user credential exchange.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What port does LDAP Secure (LDAPS) use?

A

Port 636

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Where should port 636 and 389 be enabled to secure LDAP?

A

LDAP port should be blocked by a firewall from access over the public interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define ‘Simple Network Management Protocol (SNMP)’

A

Application protocol used for monitoring and managing network devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What port(s) does Simple Network Management Protocol (SNMP) use?

A

UDP ports 161 and 162 by default.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the two components of Simple Network Management Protocol (SNMP)?

A

SNMP monitor and SNMP agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define a ‘SNMP agent’

A

A process (software or firmware) running on a switch, router, server, or other SNMP-compatible network device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the function of an SNMP agent?

A

Agent maintains a database called a management information base (MIB) that holds statistics relating to the activity of the device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define an ‘SNMP trap function’

A

The agent informs the management system of a notable event after reaching an established threshold.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What port does the SNMP monitor use to query data from an SNMP agent?

A

UDP port 161

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What port are SNMP traps communicated over?

A

UDP port 162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is best practice in securing an SNMP community name?

A

Use difficult to guess names, and never leave it to blank or default; Do not transport the community name over a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the most secure version of SNMP?

A

SNMPv3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are security improvements to SNMPv3?

A

Instead of community names, the agents are configured with a list of usernames and access permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define the authentication process in SNMPv3

A

SNMP messages are signed with a hash of the user’s passphrase. The agent can verify the signature and authenticate the user using its own record of the passphrase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Define ‘Secure File Transfer Protocol (SFTP)’

A

Uses a Secure Shell (SSH) tunnel as an encryption method between client and server to transfer, access, and manage files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What port does Secure File Transfer Protocol (SFTP) use?

A

TCP port 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are two protocols used to implement FTP over SSL/TLS?

A
  1. Explicit TLS (FTPES)
  2. Implicit TLS (FTPS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Define the function of Explicit TLS (FTPES)

A

Uses the AUTH TLS command to upgrade an unsecure connection established over port 21 to a secure one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Define the function of Implicit TLS (FTPS)

A

Negotiates a TLS tunnel before the exchange of any FTP commands over TCP port 990.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What version of FTP over TLS is preferred when there are firewalls between client and server?

A

Explicit TLS (FTPES)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Define ‘Simple Mail Transfer Protocol (SMTP)’

A

Application protocol used to send mail between mail servers on the Internet sent over TCP port 25.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What port does a client use to submit a message request to a mail server?

A

TCP port 587

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Define a ‘mailbox protocol’

A

Stores messages for users and allows them to download them to client computers or manage them on the server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How does a mail server locate a recipient?

A

Uses the domain name of the recipient to discover an IP address that is registered in DNS as an MX record.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are the two secure versions of Simple Mail Transfer Protocol (SMTP)?

A
  1. STARTTLS
  2. SMTPS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Define ‘STARTTLS’

A

Explicit TLS; A command that upgrades an existing unsecure SMTP connection to use TLS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Define ‘SMTPS’

A

Implicit TLS; Using PKI, establishes the secure connection before any SMTP commands are exchanged.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the preferred method of implementing SMTP over TLS?

A

STARTTLS

47
Q

Define ‘Post Office Protocol v3 (POP3)’

A

Application mailbox protocol that stores messages on a server and enables a client to download email messages from a server mailbox to a client.

48
Q

What port does Post Office Protocol v3 (POP3) use?

A

TCP port 110

49
Q

Describe the function of Post Office Protocol v3 (POP3)

A

Client application, such as Microsoft Outlook, establishes a TCP connection to the POP3 server over port 110; After authenticating with the server the mailbox is downloaded.

50
Q

What is the secure version of Post Office Protocol v3 (POP3) and the port is uses?

A

POP3S; TCP port 995 by default.

51
Q

Define ‘Internet Message Access Protocol (IMAP)’

A

Application mailbox protocol providing a means for a client to access and manage email messages stored in a mailbox on a remote server.

52
Q

What are the differences between Internet Message Access Protocol (IMAP) and Post Office Protocol v3 (POP3)?

A

IMAP supports permanent connections to a server and connects multiple clients to the same mailbox simultaneously; Clients can manage mail folders.

53
Q

What port does Internet Message Access Protocol (IMAP) use?

A

TCP port 143

54
Q

What port does IMAP over TLS use?

A

TCP port 993

55
Q

Define ‘Sender Policy Framework (SPF)’

A

A DNS record identifying hosts authorized to send mail for the domain.

56
Q

What is the purpose of Sender Policy Framework (SPF)?

A

Helps detect and prevent sender address forgery commonly used in phishing and spam emails.

57
Q

How does Sender Policy Framework (SPF) function?

A

By verifying the sender’s IP address against a list of authorized sending IP addresses published in the DNS TXT records of the email sender’s domain.

58
Q

Define ‘DomainKeys Identified Mail (DKIM)’

A

A cryptographic authentication mechanism for mail utilizing a public key published as a DNS record.

59
Q

What is the purpose of DomainKeys Identified Mail (DKIM)?

A

Leverages encryption features to enable email verification by allowing the sender to sign emails using a digital signature.

60
Q

How does DomainKeys Identified Mail (DKIM) leverage encryption?

A

The receiving email server uses a DKIM record that acts as a public key in the sender’s DNS record to verify the signature and the email’s integrity.

61
Q

Define ‘Domain-based Message Authentication, Reporting & Conformance (DMARC)’

A

Framework combining SPF and DKIM for authentication of senders; Specifies the actions to be taken when an email fails authentication; A DMARC policy is published as a DNS record.

62
Q

What actions can Domain-based Message Authentication, Reporting & Conformance (DMARC) enact when authentication fails?

A

Moving messages to quarantine or spam, rejecting them outright, or tagging the message.

63
Q

Does Domain-based Message Authentication, Reporting & Conformance (DMARC) offer reporting?

A

Yes, giving the owner of a domain visibility into which systems are sending emails on their behalf, including unauthorized activity.

64
Q

Define an ‘email gateway’

A

Control point for all incoming and outgoing email traffic.

65
Q

What is the purpose of an email gateway?

A

To audit all emails removing potential threats before they reach inboxes.

66
Q

What security measures does a typical email gateway use to secure mail?

A

Anti-spam filters, antivirus scanners, and sophisticated threat detection algorithms to identify phishing attempts, malicious URLs, and harmful attachments as well as attachment blocking, content filtering, and data loss prevention.

67
Q

Define ‘Secure/Multipurpose Internet Mail Extensions (S/MIME)’

A

Protocol for securing mail communications using encryption and digital signature to encrypt data and verify identities.

68
Q

Define ‘Data loss prevention (DLP)’

A

Software that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks.

69
Q

How can Data loss prevention (DLP) be used to secure email communications?

A

DLP scans emails and attachments for certain types of sensitive information defined by the organization’s DLP policies; If an email contains these types of information, the DLP system can take several actions based on predefined rules.

70
Q

What actions can Data loss prevention (DLP) software take to prevent data loss via email?

A

Blocking the email, alerting the sender or administrator, or automatically encrypting it before transmission.

71
Q

Define ‘DNS filtering’

A

Blocks or allows access to specific websites by controlling the resolution of domain names into IP addresses

72
Q

How does DNS filtering operate?

A

When a request is made to resolve a website URL, the DNS filter checks the request against a database of domain names; If the domain is known as malicious, or is unapproved, the filter blocks the request, preventing access to the website.

73
Q

Define a ‘DNS firewall’

A

Intercept DNS queries at the network level and applies filtering rules accordingly.

74
Q

What is best practice for securing an internal DNS server?

A

DNS servers should only accept recursive queries from local hosts and not from the internet.

75
Q

Define ‘DNS footprinting’

A

Obtaining information about a private network by using its DNS server.

76
Q

What are two ways to perform DNS footprinting?

A

Performing a zone transfer to a rouge DNS server of by querying the DNS server using nslookup/dig.

77
Q

Define ‘DNS Security Extensions (DNSSEC)’

A

Security protocol that provides authentication of DNS data and upholds DNS data integrity.

78
Q

What is the purpose of DNS Security Extensions (DNSSEC)?

A

To mitigate against spoofing and poisoning attacks by providing a validation process for DNS responses.

79
Q

How does DNS Security Extensions (DNSSEC) secure DNS records?

A

The authoritative server creates a “package” of resource records (called an RRset) signed with a private key (the Zone Signing Key).

80
Q

With DNS Security Extensions (DNSSEC) enabled, how does a non-authoritative DNS server receive DNS records?

A

The authoritative server returns the package along with its public key, which can be used to verify the signature.

81
Q

When using S/MIME, which key is used to protect the confidentiality of a message?

A

The recipient’s public key; The public key is used to encrypt a symmetric session key.

82
Q

What is the purpose of input validation?

A

Used in software and web development that addresses the issue of untrusted input to defeat injection attacks.

83
Q

Define ‘untrusted input’

A

Specially crafted data supplied to an application to manipulate its behavior.

84
Q

What are different forms of input validation?

A

Allowlisting, Blocklisting, Data type and range checks, regular expressions, encoding.

85
Q

Define Allowlisting input validation

A

Permits inputs that match a predetermined and approved set of values or patterns.

86
Q

Define Blocklisting input validation

A

Explicitly blocks known harmful inputs, such as certain special characters or patterns commonly used in attacks.

87
Q

Define ‘data type check’ input validation

A

Checks to ensure the input data is of the expected type, such as a string, integer, or date.

88
Q

Define ‘range check’ input validaiton

A

Validates that numeric inputs fall within expected ranges.

89
Q

Define ‘Regular expression/regex’ input validation

A

Used to match input to expected patterns or signs of malicious activity.

90
Q

Define ‘encoding’ input validation

A

Prevent special characters from being interpreted as executable commands or scripts.

91
Q

Define a ‘cookie’

A

A text file stored on a computer by a web browser while accessing a website.

92
Q

What is the purpose/function of a cookie?

A

Maintain session states, remember user preferences, and track user behavior and other settings.

93
Q

How can cookies be exploited if not properly secured?

A

Attacks such as session hijacking or cross-site scripting.

94
Q

What is the purpose of static code analysis?

A

Identify potential vulnerabilities, errors, and noncompliant coding practices before the program is finalized.

95
Q

Define ‘Code sigining’

A

The method of using a digital signature to ensure the source and integrity of software code.

96
Q

How does software become digitally signed?

A

The signer uses a private key to encrypt a hash or digest of the code to form the digital signature.

97
Q

How is the code verified once digitally signed?

A

Requires using a certificate issued by a trusted certificate authority (CA) and the client uses the cert to verify the signature of the code.

98
Q

Define ‘data exposure’

A

A fault that allows privileged information (such as a token, password, or personal data) to be read without being subject to the appropriate access controls.

99
Q

Define an ‘error/exception’ in software development

A

An application vulnerability that is defined by how an application responds to unexpected events/processes that can lead to holes in the security of an app.

100
Q

What are errors/exceptions that could occur in software?

A

Invalid user input, a loss of network connectivity, another server or process failing, and so on.

101
Q

How can errors/exceptions be handled in a good manner?

A

By a programmer implementing a structured exception handler (SEH) to dictate what the application should then do.

102
Q

Define a ‘structured exception handler (SEH)’

A

A mechanism to account for unexpected error conditions that might arise during code execution.

103
Q

What is the purpose of implementing to code?

A

To reduce the chances that a program could be exploited.

104
Q

What is the difference between an error and an exception?

A

An error is a condition that the process cannot recover from; An exception is a type of error that can be handled by a block of code without the process crashing.

105
Q

Define ‘cloud hardening’

A

Fortify the cloud infrastructure, reducing its attack surface.

106
Q

What should be implemented in the cloud to restrict access to cloud resources?

A

Least privilege access.

107
Q

How do modern web browsers implement sandboxing/sandbox envrionments?

A

If a website or browser extension in one browser tab attempts to run malicious code, it is confined within that tab’s sandbox to prevent malicious code from impacting the entire browsers or the OS.

108
Q

How do mobile phone OS’s implementing sandboxing?

A

They use sandboxing to limit each app’s actions; An app in a sandbox can access its own data and resources but cannot access other app data or any nonessential system resources without explicit permission.

109
Q

What are examples of large scale infrastructure sandboxing?

A

Virtual machines (VMs) and containers like Docker; each VM or container can run in isolation.

110
Q

How can sandboxing be leveraged in security operations?

A

Detecting and understanding malware activities via forensic inspection.

111
Q

What is the purpose of using sandboxing in security operations?

A

To create an enclosed, controlled environment that allows the safe execution of potentially harmful software without affecting the IT environment.

112
Q

Which response header provides protection against SSL stripping attacks?

A

HTTP Strict Transport Security (HSTS)

113
Q

What are the two types of centralized logging management are available on Windows?

A
  1. Source computer initiated
  2. Collector initiated
114
Q
A

Security+ (SY0-701) (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions