Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner > Security+ > Flashcards

Security+ Flashcards

1
Q

Another name for Symmetric algorithm

A

Private Key Algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Another name for Asymmetric algorithm

A

Public Key algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Advantage of asymmetric algorithm

A

Overcomes multiple key issue associated with symmetric algorithms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Hybrid encryption implementation

A

Use asymmetric encryption to establish connection, then exchange symmetric keys for continued communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Advantage of symmetric algorithm

A

Faster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Stream cipher

A

Encrypt data one byte (or bit) at a time
Used for securing real-time data streams
Tend to be symmetric algorithms
Tend to be hardware encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Block cipher

A

Breaks input into fixed lengths for encryption
Padding added if data is less than fixed length
Easier to implement than stream cipher
Tend to be software encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

DES algorithm

A

Data Encryption Standard
Symmetric algorithm
deprecated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

3DES

A

Triple DES
Symmetric algorithm
3 symmetric keys - encrypt, decrypt, encrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IDEA

A

International Data Encryption Algorithm
Symmetric algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

AES

A

Advanced Encryption Standard
Symmetric algorithm
Current symmetric standard, most commonly used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Blowfish

A

Symmetric algorithm
Intended to replace DES
open source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Twofish

A

Symmetric algorithm
open source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

RC4

A

Rivest Cipher 4
Symmetric stream cipher
Used in SSL and WEP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

RC5

A

Rivest Cipher 5
Symmetric block cipher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RC6

A

Rivest Cipher 6
Symmetric block cipher
Introduced to replace DES; superceded by AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Public key cryptography

A

Asymmetric algorithm
For confidentiality: Anyone can encrypt with public key, but only private key can decrypt
For non-reputiation: sender should sign messiage with private key, reader should read with public key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Digital Signature

A

Hash digest for message sent with sender’s private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Diffle-Hellman (DH) algorithm

A

Asymmetric algorithm
Used to distribute keys of unsecure network
Often used for create VPN tunnels; part of IPSec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Rivest, Shamir and Adleman (RSA) Algorithm

A

Asymmetric algorithm
Relies on difficulty of factoring prime numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Elliptic Curve Cryptography (ECC)

A

Asymmetric algorithm
Heavily used on mobile devices
More efficient than RSA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Hashing

A

one way cryptographic function that outputs unique message digest
always the same length per the algorithm in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Pass the Hash attack

A

login with stored hash rather than plaintext password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Rainbow table

A

Precomputed table for reversing cryptographic hash functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Wildcard certificate

A

Allows all subdomains to use same public key and have it display as valid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Subject Alternate Name (SAN) Field

A

Certificate field that specifies what additional domains and IP addresses are going to be supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Single-Sided Certificate

A

Only requires server to be validated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Dual-Sided Certificate

A

Requires both server and user to be validated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Self-signed certificate

A

certificate is signed by same party whose identity it certifies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Third-Party Certificate

A

Certificate issued and signed by a trusted certificate authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Certificate Signing Request

A

Block of encoded text containing information about the entity requesting the certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

OSCP

A

Online Certificate Status Protocol
Allows to determine the revocation status of any digital certificate using its serial number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

OSCP Stapling

A

Allows the certificate holder to get OCSP record from the server at regular intervals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

TPM

A

Trusted Platform Module
Dedicated microcontroller designed to secure hardware through integrated cryptographic keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

HSM

A

Hardware Security Module
Physical device that manages digital keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Secure Enclave

A

Co-processor integrated into the main processor of some devices, designed with the sole purpose of ensuring data protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Steganography

A

Hiding secret data in non-secret files or messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Tokenization

A

substiture sensitive data elements with non-sensitive equivalents; can only be fixed by authorized systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Data Owner

A

Senior executive responsible for maintaining the confidentiality, integrity and availability of the information asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Data Controller

A

Responsible for deciding purposed and methods of data storage, collection, usage and guaranteeing legality of processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Data Processor

A

Hired by data controller to help with tasks like collecting, storing and analyzing data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Data Custodian

A

Responsible for management of system(s) on which data assets are stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Data Steward

A

Focused on quality of data and associated metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Data Privacy Officer

A

Responsible for oversight of privacy-related data (PHI, SPI, PII)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

BYOD

A

Bring your own device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

COPE

A

Corporate-Owned, Personally Enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Time-of-use (TOU)

A

Race condition that occurs when a process performs an action on a resource without verifying that it is still in the same state or value as when it was last checked. It can lead to incorrect or unauthorized actions based on invalid assumptions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Buffer Overflow

A

Type of memory corruption that occurs when a program writes more data than the allocated buffer can hold, causing it to overwrite adjacent memory locations. It can lead to crashes, code execution, or privilege escalation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Memory injection

A

Insertion of malicious code into a system’s memory, not the exploitation of a time gap between a check and use of a condition.

Memory injection is a technique that involves injecting code into a running process to alter its behavior or gain access to its memory. It can be used for malicious or legitimate purposes on mobile devices, such as debugging or hooking.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Time-of-check (TOC)

A

Race condition that occurs when a process checks the state or value of a resource before using it, but another process changes it in between. It can lead to incorrect or unauthorized actions based on outdated information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Remote Access Trojan (RAT)

A

Mimics legitimate remote control programs but operates covertly. It provides the threat actor unauthorized access to a host, enabling them to upload files, install software, or execute commands.

52
Q

Worm

A

Malware that replicate themselves to spread to other computers.

53
Q

Adware

A

Displays unwanted ads on a user’s device.

54
Q

Rootkit

A

Provides unauthorized access to a computer, but it doesn’t specifically mimic legitimate remote control programs.

55
Q

Vendor assessment

A

Involves evaluating the security measures and vulnerabilities of a vendor’s systems and infrastructure, but it does not specifically focus on ethical and legal requirements. It occurs after the vendor is chosen.

56
Q

Pretexting

A

Type of human vector/social engineering attack that involves creating a fabricated scenario or pretext to justify the request for confidential information or action from the target.

57
Q

Cloning

A

Duplication of items such as badges, access cards, or even digital identities. It’s about copying something authentic to gain unauthorized access.

58
Q

Tailgating

A

Also known as “piggybacking,” is a method where unauthorized individuals follow authorized personnel into secure locations by exploiting their courtesy or distraction. It relies on physical access rather than fabricated stories.

59
Q

Phishing

A

Attacker sends deceptive emails (or other forms of communication) to a broad audience, enticing recipients to click on malicious links, download malware, or provide sensitive information. The attacker’s goal is to trick recipients into believing the message is from a trusted source.

60
Q

Vendor selection

A

Process of evaluating and choosing vendors based on various criteria, including their alignment with the organization’s ethical and legal requirements. It occurs before the partnership begins.

61
Q

Vendor monitoring

A

Refers to continuously evaluating a vendor’s security performance and compliance with contractual requirements, but it does not directly relate to ethical and legal criteria. It occurs after the vendor is chosen.

62
Q

Master Service Agreement (MSA)

A

Agreement precisely designed to establish the overall framework for a long-term business relationship between an organization and a vendor. It provides a foundation for future agreements and contracts by outlining general terms, conditions, and responsibilities. It generally is concluded after a vendor is chosen.

63
Q

Downtime

A

Period when a system is unavailable or its performance is degraded, often due to planned maintenance or unforeseen incidents. In the scenario, the server’s unavailability during the upgrade process is a clear example of downtime.

64
Q

Service Restart

A

Act of stopping and then starting a service, often to apply changes or updates. While this can lead to downtime, the scenario specifically mentioned a system upgrade, not just a service restart.

65
Q

Maintenance Window

A

Predefined time frame during which system changes or updates are applied to minimize disruption to business operations. This indicates when changes may occur but does not specifically define the period of system unavailability.

66
Q

Change Management

A

Formalized procedure to ensure changes are reviewed and approved before implementation. This is a process but does not specifically define the time a system is unavailable.

67
Q

Sensitive Personal Data under GDPR

A

Sensitive personal data refers to specific categories of personal information that could harm an individual if made public. This includes, but is not limited to:
- religious beliefs
- political opinions
- trade union membership
- gender
- sexual orientation
- racial or ethnic origin
- genetic data
- health information

68
Q

FIPS (Federal Information Processing Standards)

A

Standards that provide important guidelines and requirements for cryptography used to secure federal information systems, except those related to national security.

69
Q

ISO/IEC 27001

A

Important standard for information security management systems. It does not set specific requirements for cryptographic modules within federal computer systems.

70
Q

PCI DSS

A

Relates to the protection of cardholder data

71
Q

Secure Enclave

A

Chip that is used only to secure encryption keys, hashes, and other important data. It is embedded in Apple and Android devices.

72
Q

Trusted Platform Module (TPM)

A

Hardware-based storage system that contains keys, digital certificates, hashed passwords, and many other types of information used for authentication. It is embedded on device motherboards that use Windows operating systems.

73
Q

Hardware Security Module (HSM)

A

Physical computing device that safeguards and manages digital keys for strong authentication. It can be a external device or on an expansion card, but it is not embedded on the motherboard.

74
Q

Key Management System

A

Process used to ensure that keys are kept secure by establishing standards of security. It is a set of policy decisions, not a chip or device.

75
Q

Side loading

A

Mobile device vulnerability that results from installing applications from sources other than the official app store, such as third-party websites, USB drives, or email attachments. It can expose the device to malware, spyware, or unauthorized access.

76
Q

Jailbreaking

A

Creates a vulnerability on mobile device by bypassing the restrictions imposed by the manufacturer or provider of a device, such as an iPhone or iPad, to gain root access and install unauthorized applications or customizations. It can expose the device to malware, spyware, or unauthorized access.

77
Q

Typosquatting

A

Human vector/social engineering attack that involves creating a fake website or domain name that resembles a legitimate one, but with slight spelling or punctuation differences.

78
Q

Business email compromise

A

Human vector/social engineering attack that involves compromising or spoofing a legitimate business email account to request fraudulent payments or transfers from unsuspecting employees or customers.

79
Q

Impersonation

A

Human vector/social engineering attack that involves pretending to be someone else, such as an authority figure or a trusted person, to persuade users to share confidential information or perform certain actions.

80
Q

Statement of Work (SOW) or Work Order (WO)

A

Document used to specify the specific tasks, deliverables, and timelines for a particular project or service. It is not intended to establish an overall framework for a long-term relationship.

81
Q

Service-level Agreement (SLA)

A

Outlines specific performance metrics, service levels, and responsibilities for ongoing services, rather than establishing an overall framework for a long-term relationship.

82
Q

Memorandum of Understanding (MOU)

A

Non-binding document used to express mutual understanding and intentions between parties. It is not typically suitable for establishing a formal framework for a long-term business relationship.

83
Q

Risk register

A

Comprehensive record that lists all identified risks, their potential impacts, assigned risk owners, and current risk status. It serves as a central repository for tracking and monitoring risks over time.

84
Q

Risk assessment

A

Initial step in the risk management process, involving the identification, analysis, and evaluation of potential risks.

85
Q

Business impact analysis

A

Assesses the potential consequences of specific risks on critical business functions, helping prioritize risk response efforts.

86
Q

Risk reporting

A

The regular communication and documentation of identified risks, their potential impact, and risk management strategies to relevant stakeholders.

87
Q

Cryptographic Downgrade Attack

A

Attacker forces network participants to resort to a weaker encryption standard, making it easier to compromise the data. It deliberately reduces the security of encrypted communications.

88
Q

Cipher Block Chaining (CBC) Attack

A

Type of side-channel attack targeting implementations of block ciphers in CBC mode.

89
Q

key exchange attack

A

Attacker aims to intercept or manipulate the key exchange process, potentially gaining access to the shared secret key.

90
Q

Resource reuse

A

Type of vulnerability that involves accessing or modifying data or communications from other virtual machines by exploiting the shared CPU between them. It can allow an attacker to execute malicious code or commands on other virtual machines.

91
Q

CPU starvation

A

Type of performance issue that occurs when a process or thread does not receive enough CPU time to perform its tasks. It can affect the responsiveness and functionality of the process or thread.

92
Q

Probability (risk)

A

Expected frequency of occurrence of a specific risk within a given time frame.

93
Q

Likelihood (risk)

A

Qualitative term used to express the chance of a risk occurring, typically described in terms of low, medium, or high.

94
Q

Exposure Factor

A

The percentage of asset loss that would occur if a specific risk is realized. It is a quantitative risk analysis metric.

95
Q

Annualized Rate of Occurrence (ARO)

A

Quantitative risk analysis metric that represents the expected number of times a specific risk occurs in a year.

96
Q

Kerberos

A

Authentication protocol that uses tickets to prevent eavesdropping and replay attacks. It relies on a trusted third-party, the Key Distribution Center (KDC), to facilitate mutual authentication between clients and services.

97
Q

LDAP

A

Protocol used to access and manage directory information over a network.

98
Q

OAuth

A

Open standard for access delegation. It allows third-party services to use account information without exposing user passwords.

99
Q

SAML

A

XML-based standard for exchanging authentication and authorization data between parties. It’s focused more on Single Sign-On (SSO) and doesn’t use the Kerberos ticketing mechanism.

100
Q

Salting

A

Technique used in cryptography to add random data to the input of a hash function to increase security.

101
Q

Key stretching

A

Method used that repeatedly hashing the password to make it more random and longer than it originally appeared. The key difference between key stretching and regular hashing or salting is the number of times the hashing is done.

102
Q

Hashing

A

Process of converting an input of any length into a fixed size string of text, using a mathematical function. Hashing doesn’t add data to the input before completing the conversion.

103
Q

Digital signature

A

Type of electronic signature that uses a specific type of encryption to ensure the authenticity and integrity of a digital message or document.

104
Q

Infrastructure Monitoring

A

Focused on ensuring the foundational IT components, like servers, data centers, and networking equipment, are both functional and secure.

105
Q

Systems monitoring

A

Evaluates the hardware, operating systems, and the essential services that applications run on but not the broader foundational structures of IT.

106
Q

Applications monitoring

A

Pertains to overseeing individual software solutions and ensuring their security and performance.

107
Q

Risk appetite

A

Refers to an organization’s willingness to take on risk in pursuit of its business objectives. It reflects the organization’s strategic approach to risk and how much risk it is willing to undertake to achieve specific goals.

108
Q

Risk tolerance

A

Extent to which an organization is comfortable with the level of risk it is willing to take. It represents the organization’s ability to withstand potential losses or disruptions.

109
Q
A

Risk acceptance means that an organization understands the level of risk that in involved in an activity and is willing to accept the outcomes of taking the risk. The risk is either accepted or not, there aren’t levels of risk acceptance.

110
Q

Risk deterrence

A

Taking measures to reduce or mitigate the impact of an event.

111
Q

MTTR

A
  • mean time to repair
  • refers to the measure of the time taken to repair a system or process after it experiences a failure or disruption.
  • average time it takes to restore functionality
112
Q

RTO

A
  • recovery time objective
  • measure of the maximum time it takes to recover a system or process after a disruption
  • represents the time within which normal operations need to be restored
113
Q

MTBF

A
  • mean time between failures
  • the measure of the average time between two consecutive failures of a system or component
  • represents the average reliability or time between incidents.
114
Q

RPO

A
  • recovery point objective
  • measure of the maximum amount of data loss an organization is willing to tolerate in the event of a disruption
  • determines the point in time to which data must be restored after recovery.
115
Q

Technical debt

A
  • future cost of rectifying present-day shortcuts or less optimal solutions. It can arise when known inefficiencies aren’t addressed due to various constraints, like time.
116
Q

Complexity

A

Primarily denotes the intricacy of a system or process.

117
Q

Single point of failure

A

Refers to a vulnerable component whose failure can disrupt an entire system, not the consequence of avoiding known system inefficiencies.

118
Q

Cost

A

Pertains to the financial considerations of a decision or action, not the implications of deferring system improvements.

119
Q

Virtualization

A

Technology that allows creating multiple isolated environments on a single physical device. It can offer benefits such as resource optimization, isolation, flexibility, and security.

120
Q

Industrial control systems (ICS)

A

Systems that are designed to monitor and control physical processes in industrial environments, such as power plants, factories, or water treatment facilities, not creating multiple isolated environments on a single physical device.

121
Q

Containerization

A

Technology that allows running applications in isolated environments called containers, not creating multiple isolated environments on a single physical device.

122
Q

Software-defined networking (SDN)

A

Network technology that involves dynamically configuring and managing network devices and services through software, not creating multiple isolated environments on a single physical device.

123
Q

Capability

A

Pertains to a threat actor’s proficiency in devising new exploit techniques and tools. It can range from using commonly found attack tools to creating zero-day exploits in various systems. Those with the highest capabilities can even deploy non-cyber tools, such as political or military assets.

124
Q

Sophistication

A

Relates to the level of intricacy and advancement of a threat actor’s methods and tools, but does not directly address their skill in crafting novel exploits.

125
Q

SRTP

A

Secure Real-time Transport Protocol
- provides encryption, message authentication, and integrity for voice communications over IP
- designed to protect Real-time Transport Protocol (RTP) and RTP Control Protocol (RTCP) traffic.

126
Q

ICMP

A
  • Internet Control Message Protocol
  • mainly used by operating systems of networked computers to send error messages
127
Q

SAML

A
  • Security Assertion Markup Language
  • login federation protocol
  • most effective approach for achieving a seamless user login experience for both internal employees and external partners
  • allows for the secure exchange of authentication and authorization data between different organizations, enabling users to log in using their own organization’s credentials while accessing resources and applications from other federated organizations without the need for separate accounts
    -simplifies identity management and enhances user experience while maintaining centralized control.

AWS Cloud Practitioner (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions