Terms Deck 2

Question 1

refactoring

Answer 1

A practice for software developers that involves identifying ways to make code more efficient through better design.

Question 2

pass-the-hash attack

Answer 2

A type of replay attack in which the attacker provides the hashed password to an accepting authentication scheme.

Question 3

evil twin

Answer 3

A situation in which an unauthorized wireless access point has been set up to mount on-path attack.

Question 4

rogue access point

Answer 4

An unauthorized wireless access point.

Question 5

bluesnarfing

Answer 5

A Bluetooth attack that can expose or alter a user’s information.

Question 6

bluejacking

Answer 6

An attack used to generate messages that appear to be from the device itself, leading users to follow obvious prompts and establish an open Bluetooth connection to the attacker’s device.

Question 7

jamming

Answer 7

An attack on a wireless network that is performed by setting up a nearby access point and using a dedicated wireless jamming device.

Question 8

radio frequency identification (RFID)

Answer 8

A wireless technology that was initially common to supply-chain and inventory tracking.

Question 9

near-field communication (NFC)

Answer 9

A set of standards for contactless communication between devices.

Question 10

initialization vector (IV) attack

Answer 10

A fixed-size input of a random or pseudo-random value used with block cipher modes.

Question 11

man-in-the-middle (MITM) attack

Answer 11

An attack in which a hacker attempts to intercept data in a network stream and then insert his or her own data into the communication. The goal is to disrupt or take over communications.

Question 12

Address Resolution Protocol (ARP) poisoning

Answer 12

An attack in which a perpetrator tricks a device into thinking any IP address is related to any MAC address. In addition, perpetrators can broadcast a fake or spoofed ARP reply to an entire network and poison all computers.

Question 13

MAC spoofing

Answer 13

An attack that involves spoofing the hard-coded Media Access Control (MAC) address of a network card.

Question 14

domain hijacking

Answer 14

An attack that occurs when a domain is taken over without the original owner’s knowledge or consent.

Question 15

DNS poisoning

Answer 15

An attack that involves redirecting legitimate traffic by changing the IP record for a specific domain.

Question 16

domain reputation

Answer 16

Protection for registered domains that provides monitoring and threat intelligence.

Question 17

distributed denial of service (DDoS) attack

Answer 17

An attack that originates from multiple systems simultaneously, causing even more extreme consumption of bandwidth and other resources than a DoS attack.

Question 18

advanced persistent threat (APT)

Answer 18

A threat that is rooted in the capability to infiltrate a network and remain inside while going undetected. This access often provides the means for a more strategic target or defined objective, including the capability to exfiltrate information over a long period of time.

Question 19

threat actor

Answer 19

An individual, a group, or an entity that contributes to an incident—or, more simply, a person or an entity that executes a given threat.

Question 20

open-source intelligence (OSINT)

Answer 20

Information available for collection from publicly available information sources.

Question 21

dark web

Answer 21

A part of the web that can’t be accessed like regular websites but that requires the use of special software that provides secure communications.

Question 22

indicator of compromise (IOC)

Answer 22

Evidence that indicates a security breach or event has occurred.

Question 23

automated indicator sharing (AIS)

Answer 23

An initiative from the U.S. Department of Homeland Security that enables the exchange of cybersecurity threat indicators.

Question 24

Structured Threat Information eXpression (STIX)

Answer 24

A standardized and structured language that represents threat information in a flexible, automatable, and easy-to-use manner.

Question 25

Trusted Automated eXchange of Indicator Information (TAXII)

Answer 25

A specification for machine-to-machine communication that allows organizations to share information with others, as desired.

Question 26

zero-day attack

Answer 26

An attack that exploits a vulnerability that is unknown to others—possibly even to the software developer.

Question 27

threat hunting

Answer 27

A proactive approach to finding an attacker before alerts are triggered.

Question 28

vulnerability scan

Answer 28

A scanning method that identifies vulnerabilities, misconfigurations, and lack of security controls.

Question 29

CVE/CVSS

Answer 29

Common Vulnerabilities and Exposure/Common Vulnerability Scoring System - A list of publicly known vulnerabilities that provides descriptions and references, along with severity ratings.

Question 30

security information and event management (SIEM)

Answer 30

A set of tools that collects, correlates, and displays data feeds that support response activities.

Question 31

security orchestration, automation, and response (SOAR)

Answer 31

A set of tools that aggregates intelligence from internal and external sources to provide fusion analysis and advanced security analytics and operations.

Question 32

white box

Answer 32

A testing method in which the assessor has knowledge about the inner workings of the system or knowledge of the source code. Also called clear box or glass box testing.

Question 33

black box

Answer 33

A test conducted when the assessor has no information or knowledge about the inner workings of the system or knowledge of the source code.

Question 34

gray box

Answer 34

A testing method that combines white box and black box techniques. It can be thought of as being translucent as the tester has some understanding of or limited knowledge of the inner workings of the system being tested.

Question 35

persistence

Answer 35

An exploitation technique that enables the tester to gain additional compromising information.

Question 36

teaming (red, blue, white, purple)

Answer 36

Security team exercises conducted with teams with color names that represent different goals, such as attackers and defenders.

Question 37

data loss prevention (DLP)

Answer 37

Security services that identify, monitor, and protect data during use, storage, or transfer between devices. DLP software relies on deep inspection of data and transactional details for unauthorized access operations.

Question 38

hashing

Answer 38

A methodology used to calculate a short, secret value from a data set of any size (usually for an entire message or for individual transmission units). This secret value is recalculated independently on the receiving end and is compared to the submitted value to verify the sender’s identity.

Question 39

hardware security module (HSM)

Answer 39

A dedicated crypto-processor that is specifically designed for the protection of transactions, identities, and applications by securing cryptographic keys.

Question 40

cloud access security broker (CASB)

Answer 40

A Gartner-created term that describes a cloud cybersecurity layer focused on visibility, compliance, data security, and threat protection.

Question 41

Secure Sockets Layer (SSL)

Answer 41

An Internet protocol that uses connection-oriented, end-to-end encryption to ensure that client/server communications are confidential (encrypted) and meet integrity constraints (message digests). Because SSL is independent of the application layer, any application protocol can work with SSL transparently. SSL can also work with a secure transport layer protocol, which is why the term SSL/TLS appears frequently.

Question 42

Transport Layer Security (TLS)

Answer 42

An end-to-end encryption protocol originally specified in ISO Standard 10736 that provides security services as part of the transport layer in a protocol stack.

Question 43

hot site

Answer 43

A physical site that is immediately available for continuing computer operations if an emergency arises. It typically has all the necessary hardware and software loaded and configured, and it is available continuously. Compare this with warm and cold sites.

Question 44

cold site

Answer 44

A remote site that has electricity, plumbing, and heating installed, ready for use when enacting disaster recovery or business continuity plans. At a cold site, the company enacting the plan supplies all other equipment, systems, and configurations. Compare this with hot and warm sites.

Question 45

warm site

Answer 45

A backup site that has some of the equipment and infrastructure necessary for a business to begin operating at that location. Typically, companies or organizations bring their own computer systems and hardware to a warm site, and the site usually already includes a ready-to-use networking infrastructure. It also might include reliable power, climate controls, lighting, and Internet access points. Compare with hot and cold sites.