Upgrade to remove ads
Only $35.99/year

Security + Course

Terms in this set (119)

What is a security baseline used for?
The baseline provides the input needed to design, implement, and support a secure network.
What component of an IPS or IDS collects data from the data source and passes it to the analyzer for analysis?
Sensor
A vendor is promoting a collection of software products and services that combine security information management (SIM) and security event management (SEM) features to provide real-time analysis of security alerts generated by network hardware and applications. What term would be used to describe these products?
Security information and event management (SIEM)
Which type of security includes access control, authentication, and security topologies after network installation is complete?
Operational Security
What are events that aren't really incidents but that trigger the same alarms?
False positives
What are the four most common security zones that you will likely encounter?
Internet, intranet, extranet, and DMZ (demilitarized zone)
Is implementing RAID-5 a method for providing high availability? What is another term for this?
Yes; fault tolerance
What does SLE x ARO equal?
ALE. The single loss expectancy, when multiplied by the annual rate of occurrence, equals the annual loss expectancy.
Having your main database server on a DMZ isn't secure. However, if your web server needs current data that is contained on that database server, what are two of your options?
You can configure a second DB server on the DMZ and periodically replicate data to it from the main DB server on the LAN, and you can also have the web server request data from the internal DB server.
What type of controls lay out guidelines and expectations for upgrades, monitoring, backups, and audits?
Administrative policies
What is a VLAN?
A virtual local area network (VLAN) allows you to create groups of users and systems and segment them on the network.
What is the measurement of how long it takes to repair a system or component once a failure occurs?
MTTR (mean time to repair/restore)
What is DNS?
The Domain Name System (DNS) converts domain names or host names into IP addresses.

Instead of having to remember a host's IP address, DNS allows you to use a friendly name to access the host. For example, it is easier to remember http://www.cisco.com than 198.133.219.25.
Which calculation is used to estimate how expensive loss (due to theft, damage, or other cause) could be to the company each year?
ALE (Annualized Loss Expectancy)
On what part of the network should public web servers be placed?
The DMZ
The permission access that grants the most restrictive access to a user while allowing them to do their work is known as what?
Least privilege
What is the difference between a certificate suspension and certificate revocation?
Suspension places the certificate on hold without permanently revoking it. It can be put back into service without being reissued. A revocation is permanent.
What is a security zone?
An area in a building where access is individually monitored and controlled.
List some of the common types of servers that you might find on a DMZ.
Web, mail, and DNS
What is an agreement between you (or your company) and a service provider (typically a technical support provider) know as?
Service-level agreement (SLA)
What are the three types of cloud computing implementation?
Platform as a Service, Software as a Service, and Infrastructure as a Service
What is ARO?
Annualized rate of occurrence is the likelihood, often drawn from historical data, of an event occurring within a year.
What is the port number for Post Office Protocol 3 (POP3)?
110
Identify a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance
Valois Counter Mode (GCM)
True or False: In a banking transaction system, such as that done at an ATM, no repudiation is very important.
True
In terms of cryptography, what does the acronym HOTP stand for?
Hash-based message authentication code (HMAC)-based one-time password
What type of attack exploits the troubleshooting and developer hooks (which often circumvented normal authentication) that were left in a system by those who created it?
Backdoor attack
What allows a transport protocol to be sent across the network and used by the equivalent service or protocol at the receiving host?
Encapsulation
What is bluejacking?
Bluejacking is the sending of unsolicited messages over a Bluetooth connection.
What is Blowfish?
Blowfish is a symmetric block cipher that can use variable-length keys.
What is the gaining of unauthorized access through a Bluetooth connection known as?
Bluesnarfing
What hardware device is used to create remote access VPNs?
VPN concentrator
What does the acronym ASLR represent?
Address space layout randomization
What is SFTP?
A secure form of FTP accomplished using the Secure Shell (SSH)
What is a combination of white-box testing and black-box testing aimed at searching for system weaknesses—if any—due to improper structure or improper usage of applications known as?
Gray Box
What port does L2TP use?
UDP 1701
MD2, MD4, and MD5 are all examples of what?
Hashing algorithms
Documentation and the chain of custody are important when you're collecting evidence. What else is important?
The preservation of evidence and using care not to alter or taint the evidence
Harmful programs can try to attack Windows by attempting to run/execute code from system memory locations reserved for Windows and other authorized programs. What is the category of security features that can help prevent damage to your computer from viruses and other security threats attempting this?
Data execution prevention (DEP)
What type of virus will change form in order to avoid detection?
Polymorphic
In disaster recovery, a hot site would be preferable to a cold site. What technique could be used to make an affordable hot site available?
You could use an existing branch office and then add the infrastructure, servers, and offsite backup that would allow it to act as a hot site.
What feature is built into many firewalls to tweak the tolerance for unanswered login attacks and reduce the likelihood of a successful DoS/DDoS attack?
Flood guard
What is the term used for someone being so close to you when you enter a building that they are able to come in right behind you without needing to use a key, a card, or any other security device?
Tailgating
When it comes to malware, what term is used for a piece of software that allows a remote operator to control a system as if they have physical access to that system?
Remote administration tool (RAT)
What type of IPS/IDS system uses algorithms to analyze the traffic passing through the network?
A heuristic system
What two protocols does HTTP/S use for connection security, and what TCP port does it operate on by default?
HTTP/S uses SSL (Secure Sockets Layer) or TLS (Transport Layer Security) and port 443.
In information systems and software engineering, what is the term used to describe a process for planning, creating, testing, and deploying an information system?
Software development life cycle (SDL)
What is an integrated circuit that integrates all components of a computer or other electronic systems into a single entity?
System on chip (SoC)
What is a computer that has been designated as a target for computer attacks called?
Honeypot
What technology allows you to take any single physical device and hide its characteristics from users—in essence allowing you to run multiple items on one device and make them appear as if they are standalone entities?
Virtualization
What tool does a hacker commonly use to look for an avenue of entry through a router or a firewall?
A port scanner
What type of filtering is based on the physical ID of each workstation
MAC Filtering
What is the RACE Integrity Primitives Evaluation Message Digest more commonly known as?
RIPEMD
What is a general term that encompasses many types of control systems and associated instrumentation used in industrial production technology (including SCADA, DCS, and others)?
Industrial control systems (ICS)
You're looking for evidence of activity on the network that might have led to a malicious act. Where should you search first?
The log files
What are the port numbers for FTP?
20 and 21
What is software running on zombie computers often known as?
Botnet
What is the job title commonly given to the most senior executive in an enterprise responsible for the information technology and computer systems that support enterprise goals?
Chief Information Officer (CIO)
What is multifactor authentication?
An authentication method that uses two or more methods of authenticating the individual
In terms of cloud-based computing, what does the acronym MaaS stand for?
Monitoring as a Service
Where are revocation lists maintained?
On a certificate authority (CA) server
What port would you close to prevent Telnet attacks?
Port 23
What do you call a certificate infrastructure that has intermediate certificate servers that directly handle requests for certificates on behalf of the CA root server?
The registration authority (RA) and local registration authority (LRA)
What malicious attack can a hacker initiate with a buffer overflow?
The hacker can execute a code attack in the leftover shell of a program with system privileges.
What is the standard on which PKI certificates are based?
X.509 v3 is the certificate standard.
What is an attack strategy in which an attacker guesses or observes which websites the intended victim often uses and infects one or more of them with malware known as?
Watering hole attack
What is the term used when a hole is found in a web browser or other software and attackers begin exploiting it the same day it is discovered (bypassing the one-to-two-day response time many software providers need to put out a patch once the hole has been found)?
Zero-day exploit
You notice that someone has placed a small USB device on your office computer and suspect that it is recording the keys struck on your keyboard. What type of device is this?
Keylogger
SHA and MD are two standards of what?
Hashing
What is the port number for LDAPS?
636
The acronym MAC has multiple meanings. What are some of them?
Mandatory access control

Media access control

Message authentication code
Not giving restore permission to the person with backup permission is an example of what?
Separation of duties
Nessus is one of the better-known examples of what type of security tool?
Vulnerability scanner
What is an advanced persistent threat (APT)?
A network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time.
What type of attack is the ping of death?
Denial-of-service—either DoS or DDoS (distributed denial-of-service), depending on the number of computers involved
What is the term for a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes?
Rainbow table
What is the difference between DoS and DDoS attacks?
A DDoS attack uses multiple computers, all focused on one target. A DoS attack uses a single computer to attack a target.
What type of attack uses IP spoofing and broadcasting to send a ping to a group of hosts in a network?
Smurf attack
What is it known as when you combine phishing with Voice over IP (VoIP)?
Vishing
An individual pretending to be a network administrator calls a user in the company to confirm their username and password. This is an example of what type of attack?
Social engineering
What port does PPTP use?
TCP 1723
Would using fiber optics as opposed to UTP be considered hardening?
Yes
What is RTBH an acronym for?
Remotely triggered black hole
What does the acronym ABAC stand for?
Attribute-based access control
What does IPS stand for?
Intrusion prevention system
What two general security terms describe a TCP sequence number attack?
Man-in-the-middle attack and TCP/IP hijacking
What type of testing involves trying to get access to your system from an attacker's perspective?
Penetration testing
Retinal scans and thumbprint readers are examples of what type of authentication?
Biometric authentication
Under mandatory access control, can a creator/owner (who isn't an administrator) of a resource set the permissions on the resource?
No. Under mandatory access control (MAC), only the administrator can set the permissions. Users and owners have limited freedom, and the system determines the access based on the mandatory rules.
If a certificate is compromised, what is one of the first steps that should be taken?
The certificate should be put on the Certificate Revocation List (CRL).
What is a mantrap?
A room, area, or device that requires visual identification, as well as authentication, to gain access. Mantraps are usually designed to retain an unauthorized person until authorities arrive.
Should SNMP and SNMP traps be logged?
Yes. SNMP messages and SNMP traps can record valuable information regarding a network's condition.
What type of virus attacks your system in multiple ways, such as attempting to infect your boot sector, infect all of your executable files, and destroy your application files in the hope that you won't be able to correct all of the problems and will allow the infestation to continue?
Multipartite virus
Creating an account named Administrator, giving the account no rights or permissions, and setting up auditing on the account is an example of what?
A good security policy and the creation of a honeypot
What is the minimum number of keys used for PKI?
Two
What root server or organization is responsible for issuing and maintaining certificates?
A certificate authority (CA)
On certain sites, users are often asked to identify something from an image and either click on it or type it in. This is done to differentiate users from scripts and bots. What is this known as?
CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart)
What does LDAP stand for?
Lightweight Directory Access Protocol, which is used in Microsoft's Active Directory
Why would you use network tools to simulate an attack?
You could use them to test network vulnerability.
How could DHCP server hardening be accomplished?
Leasing IP addresses only to clients with reservations based on a MAC address
List four of the principle components of public key infrastructure (PKI).
Certificate authority (CA), registration authority (RA), RSA, and digital certificates
What protocol was created to provide encryption, message authentication and integrity, and replay protection to RTP data in both unicast and multicast applications?
Secure Real-Time Protocol (SRTP)
Phishing or spear phishing for big users instead of lower-access individuals is known as what?
Whaling
What does the acronym TSIG represent?
Transaction signature
What network media is the most susceptible to RF interference and eavesdropping?
WiFi
What is the port number for SFTP?
22
Which type of network firewall is typically the easiest to configure and the fastest in operation?
A packet filter network firewall
What type of security involves the protection of your assets and information from physical access by unauthorized personnel?
Physical security
What is required for nonrepudiation?
An asymmetric algorithm and digital signatures
What type of malware are software programs that have the ability to hide certain things from the operating system?
Rootkits
Where does physical security come into play in a certificate system?
The root certificate or the server issuing it should be kept under lock and key. In a distributed system, the CA server can be taken offline and locked away.
What term is used for information such as medical history, lab results, and insurance information collected by a healthcare professional?
Personal health information (PHI)
Why are removable media, such as flash drives and DVDs, a security concern?
Removable media can be a source of data theft or a point of virus infection.
What type of plan should contain detailed guidance and procedures for restoring a damaged system?
IT Continuity/Contingency Plan (ITCP)
What does the acronym PII stand for?
Personally identifiable information
What term is used for a short-range wireless connectivity standard that uses magnetic field induction to enable communication between devices when they're touched together or brought within a few centimeters of each other?
Near-field communication (NFC)
A logic bomb is a program inserted into a system. It's set to activate when a logical condition exists at some later time. What is the most common vehicle used to insert a logic bomb?
An explicit internal user act or a virus designed to plant the logic bomb
What protocol was designed to protect applications from using forged or manipulated DNS data, such as that created by DNS cache poisoning?
DNSSEC
IPv4, though widely used, has limitations. What is replacing it?
IPv6
Recommended textbook solutions

Operations Management: Sustainability and Supply Chain Management

12th Edition•ISBN: 9780134163451 (3 more)Barry Render, Chuck Munson, Jay Heizer
1,698 solutions

Service Management: Operations, Strategy, and Information Technology

7th Edition•ISBN: 9780077475864James Fitzsimmons, Mona Fitzsimmons
103 solutions

Operations Management

13th Edition•ISBN: 9781259667473William Stevenson
980 solutions

Operations Management: Sustainability and Supply Chain Management

12th Edition•ISBN: 9780134165325Barry Render, Chuck Munson, Jay Heizer
1,698 solutions