Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Security+ > Lists to Memorize > Flashcards

Lists to Memorize Flashcards

Procedures/Things to remember under concepts. (58 cards)

Start Studying
1
Q

CIA Triad

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CIANA Pentagon

A

Confidentiality
Integrity
Availability
Non-Repudiation
Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AAA of Security

A

Authentication
Authorization
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Security Control Categories

A

Technical
Managerial
Operational
Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Types of Security Controls

A

Preventative
Deterrent
Detective
Corrective
Compensating
Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

4 Kinds of Redundancy

A

Server
Data
Network
Power

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

5 Methods of Authentication

A

Something you know: Knowledge Factor
Something you have: Possession Factor
Something you are: Inherence Factor
Something you do: Action Factor
Somewhere you are: Location Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

5 Steps of Accounting

A
  1. Audit Trail
  2. Regulatory Compliance
  3. Forensic Analysis
  4. Resource Optimization
  5. User Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Steps of Gap Analysis

A
  1. Define the scope of the analysis.
  2. Gather data on the current state of the organization.
  3. Analyze the data to identify the gaps.
  4. Develop a plan to bridge the gap.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

6 Triggers of Social Engineering

A
  1. Authority
  2. Urgency
  3. Social Proof
  4. Scarcity
  5. Likability
  6. Fear
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

6 Kinds of Phishing Attacks

A
  1. Phishing
  2. Vishing
  3. Smishing
  4. Whaling
  5. Spear Phishing
  6. Business Email Compromise (BEC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

10 Types of Computer Viruses

A
  1. Boot Sector
  2. Macro
  3. Program
  4. Multipartite
  5. Encrypted
  6. Polymorphic
  7. Metamorphic
  8. Stealth
  9. Armored
  10. Hoax
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Operating System Rings

A

Ring 0 = Kernel
Ring 1 = Administrator
Ring 2 = Between Administrator and User
Ring 3 = User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

9 Indications of Malware Attacks

A
  1. Account Lockouts
  2. Concurrent Session Utilization
  3. Blocked Content
  4. Impossible Travel
  5. Resource Consumption
  6. Resource Inaccessibility
  7. Out-of-Cycle Logging
  8. Missing Logs
  9. Published or Documented Attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Commercial Data Classifications

A

Public
Private
Confidential
Critical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Government Data Classifications

A

Unclassified
Sensitive but Unclassified
Confidential
Secret
Top Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Forms of Data Ownership

A

Data Owner
Data Controller
Data Processor
Data Steward
Data Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

3 States of Data

A

Data-at-Rest
Data-in-Transit
Data-in-Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Types of Data

A

Regulated Data
Personal Identification Information (PII)
Protected Health Information (PHI)
Trade Secrets
Intellectual Property (IP)
Legal information
Financial information
Human-readable vs. Non-human readable data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Loss Prevention (DLP) Systems

A

Endpoint DLP System
Network DLP System
Storage DLP
Cloud-based DLP System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Symmetric Algorithms

A

Data Encryption Standard (DES)
Triple DES (3DES)
International Data Encryption Algorithm (IDEA)
Advanced Encryption Standard (AES)
Blowfish
Twofish
Rivest Cipher (RC4)
Rivest Cipher (RC5)
Rivest Cipher (RC6)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Asymmetric Algorithms

A

Digital Signature = Private Key Hash to verify authorship
Diffie-Hellman (DH) = Secure Key Exchange Method
Rivest, Shamir, and Adleman (RSA)
Elliptic Curve Cryptography (ECC)
Elliptic Curve Diffie-Hellman (ECDH)
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
Elliptic Curve Digital Signature Algorithm (ECDSA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Hashing Algorithms

A

MD5 = Susceptible to hash collisions, insecure
SHA-1 = Outdated first version
SHA-2 = SHA-256 is most secure version, all other versions are insecure
SHA-3 = Most recent family, all versions are secure
RIPEMD (RACE Integrity Primitive Evaluation Message Digest) = Hash family that competes against SHA
RIPEMD-160 = Competitor to SHA-256
HMAC (Hash-based Message Authentication Code) = Protocol that checks messages to validate authenticity
Digital Security Standard (DSS) = Hash algorithm used by government

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Digital Certificates

Study These Flashcards
A

Digital Certificate
Wildcard Certificate
Single-Sided Certificate
Dual-Sided Certificate
Self-Signed Certificate
Third Party Certificate

25
Risk Assessment Frequencies
Ad-Hoc Recurring One-Time Continuous
26
Risk Register Components
Risk Description Risk Impact Risk Likelihood Risk Outcome Risk Level Cost Risk Tolerance/Acceptance Risk Appetite
27
4 Elements of Vendor Due Diligence
Financial Stability Operational History Client Testimonials On-the-ground Practices
28
List of Contracts
Basic Contract Service-Level Agreement (SLA) Memorandum of Agreement (MOA) Memorandum of Understanding (MOU) Master Service Agreement (MSA) Statement of Work (SOW) Non-Disclosure Agreement (NDA) Business Partnership Agreement (BPA)
29
GRC Triad
Governance Risk Compliance
30
Governance Structures
Boards Committees Government Entities Centralized Structures Decentralized Structures
31
Forms of Access Control
Discretionary Access Control (DAC) Mandatory Access Control (MAC) Role-Based Access Control (RBAC) Rule-Based Access Control (RBAC) Attribute-Based Access Control (ABAC)
32
3 Forms of Mobile Asset Deployment
Bring Your Own Device (BYOD) Corporate-Owned, Personally Enabled (COPE) Choose Your Own Device (CYOD)
33
4 Different Types of Pentesting
Physical Offensive (Red Teaming) Defensive (Blue Teaming) Integrated (Purple Teaming)
34
Different forms of RAID
RAID 0 RAID 1 RAID 5 RAID 6 RAID 10
35
5 Power Conditions
Surges Spikes Sags Undervoltage Events Full Power Loss Events
36
4 Power Systems
Line Conditioners Uninterruptible Power Supply Systems (UPS) Generators Power Distribution Centers (PDC)
37
The Steps of Data Recovery
Selection of the backup Initiating the recovery process Data validation Testing and validation Documentation and reporting Notification
38
Different Kinds of Redundant Sites
Hot Warm Cold Mobile Virtual
39
Elements of Cloud Computing
Servers Storage Databases Networking Software Analytics Intelligence
40
Cloud Security Threats
Shared Physical Server Vulnerabilities: Can lead to vulnerabilities if one user's data is compromised. Inadequate Virtual Environment Security: Can lead to unauthorized access, data breaches, and other security incidents. User Access Management: Can lead to unauthorized access to sensitive data and systems. Lack of Up-to-Date Security Measures: Can lead to leaving the system vulnerable to new threats. Single Point of Failure: Can lead to a complete system outage affecting all users. Weak Authentication and Encryption Practices: Can lead to allowing unauthorized users to gain access to cloud systems. Unclear Policies and Data Remnants: Lack of unclear guidelines or procedures for various security aspects. Data Remnants: Residual data left behind after deletion or erasure processes.
41
Different Kinds of Ports
Inbound Outbound Well-Known Registered Dynamic/Private
42
Different Kinds of Firewalls
Screened Subnet (Dual-Homed Host) Packet Filtering Stateful Proxy Circuit Level Proxy Application Level Proxy Kernel Proxy Next-Generation Firewall (NGFW) Unified Threat Management (UTM) Web Application Firewall (WAF)
43
3 Kinds of IDS/IPS Systems
Network based Host Based Wireless Based
44
4 Kinds of Network Appliances
Load Balancers Proxy Servers Sensors Jump Servers
45
Different Tools of Port Security
Content Addressable Memory (CAM) Table Persistent (Sticky) MAC Learning 802.1x Protocol EAP-MD5 EAP-TLS EAP-TTLS EAP-FAST PEAP LEAP
46
3 Methods to Secure Network Communications
1. Virtual Private Networks (VPN) 2. Transport Layer Security (TLS) 3. Internet Protocol Security Suite (IPSec)
47
Infrastructure Considerations
1. Correct placement of devices 2. Security zones and screened subnets 3. Understanding the attack surface 4. Determining connectivity methods 5. Understanding device attributes 6. Configuring the failure mode
48
6 Steps to Federation
Login Initiation Redirection to an Identity Provider Authenticating the User Generation of an Assertion Returning to the Service Provider Verification and Access
49
3 Parts of Privileged Access Management (PAM)
Just-in-Time Permissions Password Vaulting Temporal Accounts
50
Hardware Vulnerabilities
Firmware End-of-Life Systems Legacy Systems Unsupported Systems Unpatched Systems Hardware Misconfiguration
51
Bluetooth Vulnerabilities
Insecure Pairing Device Spoofing On-Path Attacks
52
Bluetooth Attacks
Bluejacking Bluesnarfing Bluebugging Bluesmack Blueborne
53
OS Vulnerabilities
Unpatched Systems Zero-day Vulnerabilities Misconfigurations Data Exfiltration Malicious Updates
54
Race Condition Attacks
Time-of-Check (TOC) Time-of-Use (TOU) Time-of-Evaluation (TOE)
55
Denial-of-Service (DoS) Attacks
Denial-of-Service (DoS) Flood Attack Ping Flood SYN Flood Permanent Denial of Service (PDoS) Fork Bomb Distributed Denial of Service (DDoS) DNS Amplification Attack
56
Domain Name System (DNS) Attacks
DNS Cache Poisoning (DNS Spoofing) DNS Amplification DNS Tunneling Domain Hijacking (Domain Theft) DNS Zone Transfer Attack
57
Indicators of Compromise (IoC)
Account lockouts Concurrent session usage: One user having multiple sessions. Blocked content Impossible travel Resource consumption Resource inaccessibility Out-of-cycle logging: Logging events happening at odd times when no one is supposed to be active. Articles or documents on security breach Missing logs
58

CompTIA Security+ (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions