CISCO CCST Cybersecurity > Endpoint Security Concepts > Flashcards

Endpoint Security Concepts Flashcards

3.1. Describe operating system security concepts • Windows, macOS, and Linux; security features, including Windows Defender and host-based firewalls; CLI and PowerShell; file and directory permissions; privilege escalation 3.2. Demonstrate familiarity with appropriate endpoint tools that gather security assessment information • netstat, nslookup, tcpdump 3.3. Verify that endpoint systems meet security policies and standards • Hardware inventory (asset management), software inventory, progr (75 cards)

Study These Flashcards
1
Q

How is risk mathematically calculated in cybersecurity?

A

Risk = Threat x Vulnerability x Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What term defines a weakness in a system or design that can be exploited by a threat?

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the specific tool or code used to take advantage of a system weakness?

A

Exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which strategy involves placing multiple, redundant security controls throughout an IT infrastructure?

A

Defense-in-Depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the three core goals of the CIA Triad?

A

Confidentiality, Integrity, and Availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which component of the CIA Triad focuses on ensuring data is accurate and has not been improperly modified?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What type of attacker is primarily motivated by financial gain through activities like ransomware?

A

Organized Crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which step of the AAA framework involves verifying the identity of a user?

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In the AAA framework, what is the process of tracking and logging user actions called?

A

Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why are two different passwords considered a single factor of authentication?

A

They both belong to the same category (something you know).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the primary difference between symmetric and asymmetric encryption?

A

Symmetric uses one shared key, while asymmetric uses a public/private key pair.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data that is currently being processed in RAM or by the CPU is in what state?

A

Data in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which secure protocol is the encrypted replacement for Telnet for remote management?

A

SSH (Secure Shell)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What vulnerability allows an attacker to hijack traffic by sending false MAC-to-IP mappings?

A

ARP Spoofing (or ARP Poisoning)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which network segment is used to host public-facing services like web and email servers?

A

DMZ (Demilitarized Zone)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the fundamental difference in action between an IDS and an IPS?

A

An IDS only alerts administrators, while an IPS can actively block or drop traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which wireless encryption standard is the most current and secure?

A

WPA3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What technology authenticates and authorizes a device’s health before allowing it to join a network?

A

Network Access Control (NAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which operating system security model relies on NTFS permissions and Group Policy for control?

A

Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In the Linux file permission system, what does the ‘rwx’ notation represent?

A

Read, Write, and Execute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the highest-privilege administrative account in a Linux system?

A

Root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What term describes an attack where a user gains higher access rights than they were intended to have?

A

Privilege Escalation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Why are Linux and macOS generally considered more secure “out of the box” than Windows?

A

They operate with lower default user permissions (non-administrator accounts).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the primary function of a host-based firewall?

A

To control traffic for and protect a specific, individual machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Why do attackers often use PowerShell for fileless malware attacks?
It is a powerful administrative tool that can execute commands directly in memory.
26
Which command-line tool displays active network connections and listening ports on a host?
netstat
27
What is the purpose of the 'nslookup' or 'dig' command?
To query the DNS system for domain name or IP address mappings.
28
Which tool acts as a command-line packet sniffer to capture and analyze network traffic?
tcpdump
29
What is the first critical step in endpoint security compliance?
Maintaining an accurate hardware and software inventory.
30
What are the components of the '3-2-1 Rule' for data backups?
3 copies of data, 2 different media types, and 1 copy stored off-site.
31
Which regulation focuses on protecting credit card holder data?
PCI DSS
32
What is the primary goal of the HIPAA regulation?
To protect patient health information (PHI).
33
Which European Union regulation protects personal data and privacy?
GDPR (General Data Protection Regulation)
34
What technology is used to manage and secure personal devices in a BYOD environment?
MDM (Mobile Device Management)
35
What is the purpose of patch management?
The systematic process of identifying, testing, and deploying software updates to fix vulnerabilities.
36
Why are firmware updates considered critical for endpoint security?
Firmware exploits can grant attackers deep, persistent access to hardware.
37
Which Windows tool provides a centralized location for system, application, and security logs?
Event Viewer
38
What standard protocol do network devices and Linux systems use to send logs to a central server?
Syslog
39
In log analysis, what is the term for a deviation from normal baseline behavior?
Anomaly
40
What is the first step in the malware removal process?
Scanning the system with anti-malware tools.
41
What is the purpose of 'Quarantine' in malware remediation?
To isolate infected files or systems and prevent the malware from spreading.
42
What is the final step in a malware remediation process to ensure security is restored?
Post-incident review and log analysis.
43
What does a CVE (Common Vulnerabilities and Exposures) identifier represent?
A unique identifier and description for a publicly known cybersecurity vulnerability.
44
What is the difference between active and passive reconnaissance?
Active recon involves direct interaction with the target; passive recon uses indirect sources.
45
How is a 'Port Scan' used during the reconnaissance phase?
To identify which services are listening on a target host's ports.
46
Which risk management plan focuses on keeping the entire business operational during a disaster?
Business Continuity Plan (BCP)
47
Which risk management plan focuses specifically on restoring IT infrastructure after a disaster?
Disaster Recovery Plan (DRP)
48
What is the purpose of a SIEM system?
To centrally collect, correlate, and analyze security logs for real-time threat detection.
49
Which model tracks the seven stages of a cyber attack from reconnaissance to actions on objectives?
The Cyber Kill Chain
50
In digital forensics, what is the 'Chain of Custody'?
A documented history of the handling and possession of evidence to ensure its integrity.
51
What is the 'Principle of Least Privilege'?
Granting a user only the minimum access levels necessary for their job function.
52
Which risk mitigation strategy involves moving the potential loss to a third party like an insurance provider?
Risk Transfer
53
Which risk mitigation strategy involves discontinuing an activity to eliminate its associated risk?
Risk Avoidance
54
Under GDPR, within what timeframe must an organization report a data breach to authorities?
72 hours
55
What is the numerical Linux permission value for a file with read (4) and write (2) access only?
6
56
Which tool provides automated execution of playbooks for security incident response?
SOAR (Security Orchestration, Automation, and Response)
57
Which attack involves flooding a server with SYN requests to exhaust its connection limits?
TCP SYN Flood
58
What is the primary security flaw of MAC filtering in wireless networks?
MAC addresses are easily spoofed by attackers.
59
Which protocol translates domain names into IP addresses and is vulnerable to poisoning?
DNS (Domain Name System)
60
What is the primary function of a proxy server in network security?
To act as an intermediary, filtering content and hiding internal client IP addresses.
61
What does a vulnerability scanner check systems against to identify flaws?
A database of known vulnerabilities (CVEs).
62
Which component of the CIA Triad is addressed by using data redundancy and backups?
Availability
63
What is 'Spear Phishing'?
A targeted phishing attack directed at a specific individual or organization.
64
Which tool displays the Process ID (PID) for active connections when using the command 'netstat -ano'?
Windows Command Prompt / PowerShell
65
What type of control is a firewall primarily considered?
Preventive Control
66
What is the name of the built-in antivirus protection for Windows systems?
Windows Defender (or Windows Security)
67
Which protocol provides reliable, connection-oriented delivery but is susceptible to SYN floods?
TCP (Transmission Control Protocol)
68
What is the primary purpose of asset management in a security context?
To ensure you know what needs protection, as "you can't protect what you don't know you have."
69
In the NIST Incident Response lifecycle, what is the first phase?
Preparation
70
Which wireless standard deprecated WEP due to it being easily cracked?
WPA (and subsequent versions like WPA2/WPA3)
71
What is the term for unauthorized software that encrypts data and demands payment?
Ransomware
72
What is the purpose of hashing a password before storing it?
To protect the password's integrity and ensure the original plaintext cannot be easily recovered.
73
Which command-line interface is commonly used on Linux systems for security administration?
Bash (or CLI)
74
Which regulation applies specifically to student education records in the United States?
FERPA
75
What is the role of an 'Audit Log' in establishing accountability?
It provides a record of which user or process performed a specific action.
CISCO CCST Cybersecurity
flashcards
Decks in class (5)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions