Comptia Security+ (Sy0-401) - Agr

Front 1

Looking for potential risks

Back 1

Vulnerability Assessment

Front 2

Confirms or denies vulnerabilities

Back 2

Penetration Testing

Front 3

HTTPS port

Back 3

443

Front 4

Someone with knowledge and privilege from within the organization

Back 4

Insider Threat

Front 5

Someone trying to access an organization's resources from outside the organization

Back 5

External Threat

Front 6

FTP port

Back 6

21

Front 7

SSH port

Back 7

22

Front 8

TFTP port

Back 8

69

Front 9

HTTP port

Back 9

80

Front 10

POP3

Back 10

110

Front 11

Telnet port

Back 11

23

Front 12

SMTP port

Back 12

25

Front 13

SNMP port

Back 13

161

Front 14

DNS port

Back 14

53

Front 15

System placed within a DMZ or private network that is designed to lure malicious users away from production environments

Back 15

Honeypots

Front 16

Entire network designed to attract attackers away from production environments

Back 16

Honeynets

Front 17

Used to identify potential threats and weaknesses within a network infrastructure

Back 17

Vulnerability Scanners

Front 18

Multi-platform scanner

Back 18

GFI LANguard

Front 19

Patch, configuration and compliance auditing

Back 19

Nessus

Front 20

Identify IT exposures and prioritize remediation

Back 20

Retina

Front 21

Locates application-level vulnerabilities

Back 21

IBM ISS Internet Scanner

Front 22

Specifically designed to help monitor the behavior and health of the Mac OS-X system

Back 22

X-Scan

Front 23

Security Auditors Research Assistant - Carries out multi-vendor system-level tests instead of application-level tests

Back 23

SARA

Front 24

Performs assessments using a web-based tool

Back 24

QualysGuard

Front 25

Uncovers areas of weakness and recommends fixes

Back 25

SAINT

Front 26

Provides a streamlined method to identify missing security updates and common misconfigurations

Back 26

MBSA

Front 27

Vulnerability scan that will not directly attack a system

Back 27

Passive Vulnerability Assessment

Front 28

Vulnerability scan that can disrupt normal network operations and trigger alerts

Back 28

Active Vulnerability Assessment

Front 29

Evaluate security posture using the same techniques employed by cyber criminals

Back 29

CORE Impact Pro

Front 30

Hundreds of exploits on automated exploitation system and development framework

Back 30

CANVAS

Front 31

Helps verify vulnerabilities and manage security assessments

Back 31

Metasploit

Front 32

Ability to know and fully understand how your network should be performing day-to-day

Back 32

Network Baseline

Front 33

TCP/IP Model Layer 1

Back 33

Network Access

Front 34

TCP/IP Model Layer 2

Back 34

Internet

Front 35

TCP/IP Model Layer 3

Back 35

Transport (TCP/IP)

Front 36

TCP/IP Model Layer 4

Back 36

Application (TCP/IP)

Front 37

OSI Model Layer 1

Back 37

Physical

Front 38

OSI Model Layer 2

Back 38

Data Link

Front 39

OSI Model Layer 3

Back 39

Network

Front 40

OSI Model Layer 4

Back 40

Transport (OSI)

Front 41

OSI Model Layer 5

Back 41

Session

Front 42

OSI Model Layer 6

Back 42

Presentation

Front 43

OSI Model Layer 7

Back 43

Application (OSI)

Front 44

Layer 4 Encapsulation Units

Back 44

Segments

Front 45

Layer 3 Encapsulation Units

Back 45

Packets

Front 46

Layer 2 Encapsulation Units

Back 46

Frames

Front 47

Layer 1 Encapsulation Units

Back 47

Bits

Front 48

A company wants to know what damage can occur from an attacker who has access to network and application data

Back 48

White Box Test

Front 49

A company wants to know what damage can occur when an attacker has gained no prior knowledge of their network

Back 49

Black Box Test

Front 50

A company wants to know what damage can occur when an attacker has taken the time to research available information

Back 50

Gray Box Test

Front 51

A company wants to find out how attackers can use company information in an attempt to attack the network

Back 51

Blind Test

Front 52

A company wants to find out how attackers can use network design vulnerabilities can be exploited if attackers know the network

Back 52

Targeted Testing

Front 53

A company runs a test without telling very many people

Back 53

Double-Blind Test

Front 54

Organization avoids risk altogether

Back 54

Risk Avoidance

Front 55

Placing responsibility of the risk on someone else

Back 55

Risk Transfer

Front 56

Organization approaches the vulnerability as a must fix scenario.

Back 56

Risk Mitigation

Front 57

Vulnerability has been identified, but due to the nature and the business necessity, is accepted

Back 57

Risk Acceptance

Front 58

An organization warns of retaliation if affected

Back 58

Risk Deterrence

Front 59

Does not include fault tolerance

Back 59

RAID 0

Front 60

Data is mirrored

Back 60

RAID 1

Front 61

Disk striping with parity

Back 61

RAID 5

Front 62

Involves individuals sitting around a table with a facilitator discussing situations that could arise and how best to respond to them

Back 62

Tabletop Exercise

Front 63

This is a monetary measure of how much loss you could expect in a year.

Back 63

Annual Loss Expectancy (ALE)

Front 64

Monetary value representing how much you expect to lose at any one time

Back 64

Single Loss Expectancy (SLE)

Front 65

The likelihood of an event occurring within a year

Back 65

Annualized Rate of Occurrence (ARO)

Front 66

Measure of the anticipated incidence of failure for a system or component

Back 66

Mean Time Between Failures (MTBF)

Front 67

The average time to failure for a nonrepairable system

Back 67

Mean Time to Failure (MTTF)

Front 68

Measurement of how long it takes to repair a system or component once a failure occurs

Back 68

Mean Time to Restore

Front 69

Hosting services and data on the Internet instead of hosting it locally

Back 69

Cloud Computing

Front 70

Vendors allow apps to be created and run on their infrasturcture

Back 70

Platform as a Service (PaaS)

Front 71

Applications are remotely run over the web.

Back 71

Software as a Service (SaaS)

Front 72

Utilizes virtualization and clients pay an outsourcer for resources used

Back 72

Infrastructure as a Service (IaaS)

Front 73

This attack occurs when information is captured over a network and used at a later time

Back 73

Replay Attack

Front 74

Process of trying to guess passwords with the use of a password cracker

Back 74

Brute-force Attack

Front 75

Process of manipulating traffic by sending users who think they are accessing a specific host to a different host

Back 75

Pharming Attack

Front 76

Involves using software on the victim's computer to allow the attacker to gain access to the computer without logon credentials

Back 76

Backdoor Attack

Front 77

Newer algorithm that is not supported by NTLM. It is one of the more secure encryption algorithms used.

Back 77

Advanced Encryption Standard (AES)

Front 78

Hash algorithm used by NTLM

Back 78

Message Digest Algorithm (MD4)

Front 79

An older block cipher that uses a 56-bit key

Back 79

Data Encryption Standard (DES)

Front 80

Designed to ensure the integrity of a message. It is a one-way hash that provides a 256-bit hash value that can be used with an encryption protocol

Back 80

Secure Hash Algorithm (SHA-256)

Front 81

Given as part of a security posture assessment that provides a starting point from which changes will be made

Back 81

Baseline Configuration

Front 82

Part of a security posture assessment that places emphasis on ensuring that the current environment is continuously monitored for security

Back 82

Continuous Security Monitoring

Front 83

Information that only an individual shoud know, such as a PIN

Back 83

Something You Know

Front 84

Uses character-based authentication, which is based on the physical traits of individuals

Back 84

Something You Are

Front 85

Is ownership-based, whereby you possess a physical item or device

Back 85

Something You Have

Front 86

Authentication factor is based on an individual's actions or behaviors

Back 86

Something You Do

Front 87

Based on an individual's geographic location (geolocation) during the authentication process

Back 87

Somewhere You Are

Front 88

First step when establishing business impact analysis (BIA)

Back 88

Identify Critical Functions

Front 89

Second step when establishing business impact analysis (BIA)

Back 89

Identify Dependencies

Front 90

Third step when establishing business impact analysis (BIA)

Back 90

Determine Maximum Allowable Downtime

Front 91

Fourth step when establishing business impact analysis (BIA)

Back 91

Identify Possible Threats

Front 92

Fifth step when establishing business impact analysis (BIA)

Back 92

Determine Mitigation Techniques

Front 93

Designed to avoid discovery by actively seeking out antivirus programs and attempting to disable or infect them

Back 93

Retrovirus

Front 94

System Characterization

Back 94

NIST SP 800-30

Step 1: Define the scope of the system and identify critical data

Front 95

Threat Identification

Back 95

NIST SP 800-30

Step 2: Note all human, natural, and environmental hazards to the system

Front 96

Vulnerability Identification

Back 96

NIST SP 800-30

Step 3: Assess systems and applications in terms of their ability to withstand hazards

Front 97

Control Analysis

Back 97

NIST SP 800-30

Step 4: Assess technical and non-technical measures to strengthen systems against attack

Front 98

Likelihood Determination

Back 98

NIST SP 800-30

Step 5: Consider vulnerabilities, threat sources, and existing or planned controls to rate the probability of threat realization

Front 99

Impact Analysis

Back 99

NIST SP 800-30

Step 6:

Front 100

Risk Determination

Back 100

NIST SP 800-30

Step 7:

Front 101

Control Recommendations

Back 101

NIST SP 800-30

Step 8:

Front 102

Results Documentation

Back 102

NIST SP 800-30

Step 9:

Front 103

Requests

Back 103

Change Control Management

Step 1:

Front 104

Impact Assessment

Back 104

Change Control Management

Step 2:

Front 105

Accept or Reject

Back 105

Change Control Management

Step 3:

Front 106

Build and Test

Back 106

Change Control Management

Step 4:

Front 107

Notification

Back 107

Change Control Management

Step 5:

Front 108

Implementation

Back 108

Change Control Management

Step 6:

Front 109

Validation

Back 109

Change Control Management

Step 7:

Front 110

Documentation

Back 110

Change Control Management

Step 8:

Front 111

A sudden and unexpected event causing a great loss of life, damage, hardship, or business failure.

Back 111

Disaster

Front 112

The responsibility between the service provider and the client

Back 112

Service-level agreements

Front 113

When an asset has been designed in such a way that when an event causes the computing component to fail, a backup component or procedure immediately takes its place with no loss of service

Back 113

Fault Tolerance