Comptia Security + SYO-701 > General Security Concepts > Flashcards

General Security Concepts Flashcards

(90 cards)

Study These Flashcards
1
Q

Which term refers to someone providing information that proves they are who they say they are?
A. Authentication
B. Authorization
C. Accounting

A

A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

True or False: The AAA framework consists of three parts and they are: Authentication, Availability, and Accounting

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

authentication

A

providing information that proves someone is who they say they are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

authorization

A
  • the amount of access someone has based on their identification and authentication
  • the process of giving someone access to resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CA/Certificate Authority

A

the entity that signs a certificate authority for a specific device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

certificate authentication

A

a certificate included on a device as an authentication factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CIA Triad

A

A combination of principles that includes confidentiality, integrity, and availability
- confidentiality: sensitive data should be protected
- integrity: statse that data should be accurate and unaltered
- availability: states that data should always be accessible to those who are authorized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

compensating

A

a security control type that attempts to make up for the shortcomings of other controls and prevent the exploitation of a weakness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

corrective

A

a security control type used to minimize negative impact of an incident; fire suppression system, antivirus software, security training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

detective

A
  • only triggered during or after an incident has occurred
  • examples: smoke alarm detecting smoke, an intrusion detection system, motion detectors, a video surveillance camera
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

deterrent

A

a security control type that discourages threats from trying to exploit a vulnerability; examples include security guards, login banners,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

directive

A

a weak security control type that directs a subject towards security compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

identification

A

this describes who someone claims to be

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

integrity

A
  • part of CIA triad
  • means that information can’t be modified without detection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

managerial

A

security control category enforced by management and implemented by employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

operational

A

a security control category that translate managerial policies into routine work. they are the repeatable steps people follow to keep systems secure, detect problems, and restore services when needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

physical security controls

A

security control category implemented to prevent unauthorized physical access to facilities and resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

preventative security controls

A

a security control type that exists to not allow an action to happen; examples include firewalls, fences, and access permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Proof of Origin

A

proof that a message was not changed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

technical

A

security control category implemented through technology to protect systems and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

True or False: It is possible for a security control to fall into or have more than just one category?
A. True
B. False

A

A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which refers to the five types of security controls?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the six types of security controls?

A
  1. Preventative
  2. Detective
  3. Deterrent
  4. Directive
  5. Corrective
  6. Compensating
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the four security control categories?

A
  1. Managerial
  2. Operational
  3. Technical
  4. Physical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What type of security control category would an electric fence fall under?
Physical
26
What does zero trust mean?
It means that authentication is required and nothing is inherently trusted: verification is required at every part of the interaction
27
True or False: Threat scope reduction and policy driven access control are two methods to control trust
True
28
Policy Enforcement Point
Part of the policy enforcement matrix
29
Plane of Operations
How components are split within zero trust framework
30
policy decision point
in the policy driven access control process, this contains the policy engine and policy administrator the process for making an authentication decision (determining whether to grant or deny access to resources)
31
policy engine
in the policy driven access control process, this is in the policy decision point and evaluates each access decision based on policy and other information sources
32
policy administrator
In the policy driven access control process, this is responsible for writing the rules that say who can do what, when, where, on which device, and under what risk level.
33
access control vestibules
secure entry areas that consist of two interlocking doors, ensuring that one door must close before the other opens
34
fencing
this is a physical security control that people sometimes use for their yards in the suburbs
35
video surveillance
this type of physical security control describes things like CCTV cameras
36
security guard
this describes a person whose job it is to ensure that only authorized personnel can get into an area
37
lighting
a way of providing security that provides a well-lit area so cameras can see better; effectiveness depends on how bright it is and the angles it is implemented with
38
sensors
this describes a physical security control that uses things like motion detection hardware to ensure a location is physically safe
39
infrared
this describes a physical security control that uses rays that are invisible to the human eye to determine the presence and heat of someone; not good for a large area
40
pressure
a sensor that can identify a change in force
41
microwave
detects movement across large areas (similar to infrared)
42
ultrasonic
sending soundwaves (when is it best to use soundwaves)
43
access badge
a type of physical security control that ensures only authorized personnel can enter/leave an area
44
honeypot
a way to attract an attacker to a system 🍯
45
honeyfiles
files with fake information; good to have an alert when someone accesses it
46
honeytoken
a way to track malicious actors; something traceable like an api key, or fake email addresses
47
honeynet
this is an entire computer network that serves as a trap for potential attackers
48
Change Management
49
change management
the act of ensuring any operational changes are planned thoroughly with reduced risks to systems; actions include upgrading software, patch an application, change firewall configuration, modify switch ports
50
company
a business entity that needs to make an update
51
owner
in change management, this is the team that actually makes the update
52
stakeholder
anyone impacted by a change in an organization; can be an individual or a group
53
54
allow list
this is a list that states nothing runs unless it’s approved; very restrictive
55
deny list
nothing on the bad list can be executed (anti-virus) is a deny-list
56
downtime
a period when services may be unavailable, best when scheduled around company operations
57
restarts
rebooting the system; something that might be required in the event of technical change management; can be problematic if the application is a legacy application
58
dependencies
when one situation requires changing another variable
59
documentation
the process of creating something that keeps track of with changes within an organization
60
version control
tracking changes between versions of operation systems
61
Which refers to **a framework that enables the creation, management, distribution, and revocation of digital certificates, which are used to verify the identity of users and devices in secure communications. It utilizes public-key cryptography to ensure the confidentiality and integrity of data exchanged over networks**? A. IKE B. PKI C. KDC D. KEK
B
62
When something is encrypted with the key and decrypted with the same key, this is called A. Symmetric Encryption B. Asymmetric Encryption
A
63
asymmetric encryption
the process of creating two or more mathematically related keys where the private key is kept private but the public key is what anyone can see and give away **key considerations** * -private key is the only key that can decrypt data encrypted with public key * you cannot derive private key from the public key
64
key stretching/strengthening
the process of encrypting a key value multiple times to reduce the likelihood that a user will correctly brute force the password for it
65
What abbreviation represents a symmetric‑key block cipher adopted as the U.S. federal standard for encrypting data; supports 128‑, 192‑, and 256‑bit keys? A. SHA B. AES C. DES
AES
66
What abbreviation refers to a key used to encrypt/wrap other cryptographic keys, facilitating secure key storage and distribution? A. KDC B. IKE C. KEK D. PSK
C. KEK/Key Encryption Key
67
What abbreviation refers to a protocol used to set up a security association (SA) in IPsec, handling mutual authentication and key generation A. KDC B. IKE C. KEK D. PSK
B. Internet Key Exchange
68
True or False: TKIP is an encryption protocol used in early Wi‑Fi security (WPA) that was designed to replace WEP; now considered deprecated
True
69
What is the name of a tool that that establishes root of trust for single computing platform and provides secure storage of keys and attestation of platform’s state?
TPM/Trusted Platform Module
70
What abbreviation refers to a device that is used in large environments and securely stores and backups thousands of cryptographic keys? A. KDC B. HSM C. PKI
B. Hardware Security Module
71
What are the three things you should know about a security enclave?
1. It's a protected area for secrets 2. It's often implemented as a hardware proessor 3. It can do several different things including boot ROM, monitoring system boot, random number generation, real-time encryption, root crypto key generation, and aes encryption
72
What four kinds of steganography techniques and their definitions?
1.** network based:** the process of embedding messages in tcp packets 2. **audio steganography:** the process of hiding messages within in audio track or an audio file 3.** video steganography:** the process of hiding messages within a video 4. **tokenization**: replacing sensitive data with a non-sensitive placeholder that can be reversed
73
hash collision
occurs when you have two different inputs and the encrypted version of each match’ happened with MSD5
74
salted hash
when hash + salted+hash replaces an actual password, which is never shared.
75
salt
random data added to password when hashing
76
rainbow tables
won't work with salted hashes; additional random value added to original password
77
distributed ledger
something that is used to keep track of transactions across computers in a way that ensures data is secure, transparent, and immutable
78
public key certificate
a certificate that binds a public key and other detaills about a keyholder, with a with a digital signature that adds trust
79
digital certificate information
information contains serial number, version, signature, algorithm, issuer, name of cert holder, public key, extensions, and more….
80
Root Of Trust
an inherently trusted component that provides trust for a specific system
81
Certificate Authority
something that has digitally signed a website certificate
82
Wildcard Certificate
A digital certificate that can secure any sub‑domain of a given domain name, using a single private key. The subject name contains a leading asterisk (*).
83
Certificate Revocation List/CRL
a digitally signed list published by a certificate authority that enumerates certificates revoked before their expiration
84
Online Certificate Status Protocol/OCSP | A
A protocol that enables the on demand querying of the status of a digital certificate
85
Symmetric Encryption
One key is used
86
Asymmetric Encryption
Two or more mathematically created where one encrypts and is accessible by all and the private key is kept secret
87
Full Disk Encryption/FDE
Encrypting all of the files on a disk; prevents unauthorized access if computer is lost or stolen - physical equivalent would be locking the front door
88
Partition Encrypting
Encrypting a single storage partition on a device; provide greater flexibility that disk encryption but also less security
88
Volume Encryption
Encrypting several storage partitions on a device - physical equivalent is locking the room
89
Algorithms
AES/Advanced Encryptytio
Comptia Security + SYO-701
flashcards
Decks in class (7)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions