Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security + > Test Prep > Flashcards

Test Prep Flashcards

1
Q

MOU

A

Memorandum of understanding - preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve monetary exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Rules of engagement

A

define how that testing is to occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CRLF Injection

A

software application coding vulnerability that occurs when an attacker injects a CRLF character sequence where it is not expected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

MOA

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CSRF

A

malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Full Disk Encryption

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data Masking

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

LDAP

A

Lightweight directory access protocol: uses a client-server model for mutual authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Directory Traversal

A

allows attackers to access restricted directories and execute commands outside the web server’s root directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NTLM

A

Creates a 128-bit fixed output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RIPEMD

A

160-bit, 256-bit, or
320-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Air Gaps

A

designed to remove connections between two networks to create physical segmentation between them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Symmetric encryption

A

Private key : encryption algorithm in which both the sender and the receiver must
know the same secret using a privately-held key, 1 key

example: DES, IDEA, AES, RC4, RC5, Blowfish

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Asymmetric encryption

A

Public key: Encryption algorithm where different keys are used to encrypt and
decrypt the data, 2 keys are needed.

Example: Diffie-Hellman, RSA, ECC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Stream cipher

A

Utilizes a keystream generator to encrypt data bit by bit using a
mathematical XOR function to create the ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Block Cipher

A

Breaks the input into fixed-length blocks of data and performs the
encryption on each block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DES

A

Data encryption standard: Encryption algorithm which breaks the input into 64-bit blocks and uses
transposition and substitution to create ciphertext using an effective key
strength of only 56-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

3DES

A

Triple DES: uses three separate symmetric keys to encrypt, decrypt, then encrypt the plaintext into ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IDEA

A

International Data Encryption Algorithm: Symmetric block cipher which uses 64-bit blocks to encrypt plaintext into
ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

AES

A

Advanced encryption standard: uses 128-bit, 192-bit, or 256-bit blocks and a
matching encryption key size to encrypt plaintext into ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Blowfish

A

uses 64-bit blocks and a variable length
encryption key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Twofish

A

uses 128-bit blocks
and a 128-bit, 192-bit, or 256-bit encryption key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

RC4

A

Rivest Cipher: 40-bits to 2048-
bits that is used in SSL and WEP, this is the only stream cipher on the exam

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Diffie-Hellman

A

Diffie-Hellman is used for the establishment of a VPN tunnel using IPSec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
RSA
RSA is widely used for key exchange, encryption, and digital signatures RSA can use key sizes of 1024-bits to 4096-bits
26
One-time pad
A stream cipher that encrypts plaintext information with a secret random key that is the same length as the plaintext input
27
Steganography
The science and art of hiding messages within other messages
28
Ephemeral
A cryptographic key that is generated for each execution of a key establishment process
29
Homomorphic Encryption
An encryption method that allows calculations to be performed on data without decrypting it first
30
MD5
Algorithm that creates a fixed-length 128-bit hash value unique to the input file
31
SHA-1
creates a fixed-length 160-bit hash value
32
SHA-2
SHA-224, SHA-256, SHA-348, and SHA512
33
SHA-3
creates hash digests between 224-bits and 512-bits
34
Pass the Hash
allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LM hash instead of requiring the associated plaintext password, Mimikatz tool helps to automate the harvesting of hashes
35
PKI
Public key infrastructure: n entire system of hardware, software, policies, procedures, and people that is based on asymmetric encryption
36
Wildcard certificates
Public key certificate that can be used with multiple subdomains of a domain.
37
BER
Basic encoding rules: original ruleset governing the encoding of data structures for certificates where several different encoding types can be utilized
38
CER
Canonical Encoding Rules: only allows the use of only one encoding type
39
DER
Distinguished encoding rules: allows one encoding type and has more restrictive rules for length, character strings, and how elements of a digital certificate are stored in X.509
40
GLBA
Gramm-Leahc-Biliey Act - Financial institutions and how they are to protect their customers private information
41
SOX
Sarbanes-Oxley - federal law that sets new or expanded requirements for all US public company boards, management, and public accounting firm
42
FERPA
governs the access to educational information and records
43
WPA
Wi-Fi protected access (WPA) is an improved encryption scheme for protecting Wi-Fi communications that was designed to replace WEP
44
WPA3
Most secure - Wi-Fi protected access version 3 (WPA3) has replaced WPA2 as the most secure wireless encryption method
45
WEP
Least secure - Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption.
46
WPA2
Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard
47
Protected Health Information
defined as any information that identifies someone as the subject of medical and insurance records, plus their associated hospital and laboratory test results. requires notification of the individual, the Secretary of the US Department of Health and Human Services (HHS), and the media (if more than 500 individuals are affected)
48
PII - Personally Identifiable Information
any data that can be used to identify, contact, or impersonate an individual
49
syslog
a way network devices can use a standard message format to communicate with a logging server
50
Proxy Server
server application that acts as an intermediary between a client requesting a resource and the server providing that resource.
51
Port 389
LDAP - This includes the active directory
52
Port 3389
RDP - Remote desktop protocol
53
Port 21
FTP - File transfer protocol
54
MAC
Mandatory access control - requires all access to be predefined based on system classification, configuration, and authentication
55
Diamond Model of Intrusion Analysis
constructed around a graphical representation of an attacker's behavior.
56
OpenIOC
contains a depth of research on APTs but does not integrate the detection and mitigation strategy.
57
Data Protection Officer (DPO)
ensure that her organization processes the personal data of its staff, customers, providers, or any other individuals
58
Passive Reconnaissance
focuses on collecting information that is widely and openly available from publicly available sources.
59
ICS/SCADA network
machines utilize very specific commands to control the equipment and to prevent malicious activity
60
SPI
Sensitive Personal Information: information about an individual's race or ethnic origin
61
One-time use pad
Provides the strongest and most secure encryption - ensures that every message is encrypted with a different shared key that only the two owners of the one-time use pad would know.
62
Port 445
SMB service
63
Port 23
TELNET
64
Port 69
TFTP
65
Port 53
DNS
66
EDM
Exact Data Match: a pattern matching technique that uses a structured database of string values to detect matches
67
BeEF
penetration testing tool that focuses on the web browser.
68
SSO
Single Sign On
69
SAML
XML-based framework for exchanging security-related information such as user authentication, entitlement, and attributes
70
PKI
Public key infrastructure: an entire system of hardware, software, policies and procedures that is based on asymmetric encryption
71
SSL
Secure socket layer: Cryptographic protocols that provide secure internet communications for web browsing, email and many other services. Should NOT USE
72
SSH
Secure Shell: A protocol that can create a secure channel between two computers or network devices, one device takes control of another device.
73
Port 22
SSH
74
Port 1723
PPTP: Port to port tunneling protocol, A protocol that encapsulates PPP packets and ultimately sends data as encrypted traffic
75
Port 1701
L2TP: Layer 2 tunneling protocol
76
Redundant Power Supply
An enclosure that provides two or more complete power supplies
77
UPS
Uninterruptible Power Supply: Combines the functionality of a surge protector with that of a battery backup
78
RAID
Redundant array of independent disks: Allows the combination of multiple physical hard disks into a single logical hard disk drive
79
RAID 0
Provides data striping across multiple disks to increase performance
80
RAID 1
Provides mirroring the data identically into two hard disks, least amount of down time
81
RAID 5
Striping data and parity data across the disk drives, three physical disks needed.
82
RAID 6
Striping data and double parity data across the disk drives, requires 4 physical disks
83
RAID 10
Two mirrored RAIDS combines RAID 1 and RAID 0
84
TLS
Transport Layer Security: Symmetric tunnel between the private keys
85
Port 25
SMTP: Secure mail transfer protocol
86
Incident response (IMPORTANT TO KNOW)
PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons learned
87
SIEM
Security Information and Event Monitoring: combination of different data sources into one tool that provides real time analysis of security alerts generated by applications and network hardware
88
Tracert
displaying possible routes and measuring transit delays of packets across an Internet Protocol network
89
nmap
An open-source network scanner that is used to discover hosts and services on a computer network
90
Shimming
Alters the external behavior of an application and at the same time does not introduce any changes to application code
91
Refactoring
The practice of modifying an applications code without changing its external behavior
92
RFID
Radio Frequency Identification: wireless system comprised of tags and readers
93
VM Escape
Attack that allows an attacker to break out of a normally isolated VM
94
subnetting
Act of creating subnetworks through manipulating IP addresses.

Security + (32 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions