Change Management and Cryptography Quiz

CompTIA Security+ SY0-701 Course Notes

• This course covers CompTIA Security+ SY0-701 exam
• The exam is 90 minutes long and includes multiple choice and performance-based questions
• Exam topics are broken down into sections, each with a percentage weighting
• Section 1.0 covers General Security Concepts (12%)
• Section 2.0 covers Threats, Vulnerabilities, and Mitigations (22%)
• Section 3.0 covers Security Architecture (18%)
• Section 4.0 covers Security Operations (28%)
• Section 5.0 covers Security Program Management and Oversight (20%)

1.1 - Security Controls

• Security controls are crucial for mitigating risks
• Technical, managerial, operational, and physical controls are discussed
• Includes detective, corrective, and preventive controls
• Examples include firewalls, anti-virus, security policies, and physical security measures (locks, security guards)

1.2 - The CIA Triad

• Confidentiality, Integrity, and Availability are fundamental principles in security
• Keeps sensitive data safe
• Prevent unauthorized access (Confidentiality)
• Protect data integrity from modification (Integrity)
• Ensure system availability (Availability)

1.2 - Non-repudiation

• Verifies what was said/done
• Can't deny actions
• Cryptographic methods are used for verification
• Digital signatures and hashing are details about non-repudiation

1.2 - Authentication, Authorization, and Accounting

• Authentication confirms identity
• Authorization defines permitted actions
• Accounting keeps records of resource use

1.2 - Gap Analysis

• Identifies the difference between the current and desired security posture
• Examines and compares security measures
• Helps define priorities to improve security

1.2 - Zero Trust

• Assumes no implicit trust within a network
• Verifies every device, user, and application
• Applies security to everything, everywhere
• Multiple planes of operation are discussed

1.3 - Physical Security

• Protects physical assets
• Barrier control (bollards)
• Access control vestibules are used
• Security badges, security guards
• Prevent access to areas, equipment, or resources

1.3 - Deception and Disruption

• Using decoys may mislead the attackers
• Honeypots (virtual or physical systems)
• Decoy files and resources
• Can observe attacker behavior

1.4 - Digital Certificates

• Verifies the identity of an individual or device
• Public key cryptography is a crucial component
• Trust is built by using a Certificate Authority (CA)

1.4 - Encrypting Data

• Full-disk encryption
• File encryption
• Data encryption during transport protects data in motion

1.4 - Key Exchange

• Symmetric key encryption Uses the same key for encryption and decryption
• Asymetric key encryption
• Public key and private key
• Often used in conjunction with encryption

1.4 - Trusted Platform Module (TPM)

• Securely stores cryptographic keys
• Offers hardware-based security
• Helps prevent exploits

1.4 - Obfuscation

• Hiding data to make it difficult to understand
• Useful for protecting sensitive information
• Uses many different techniques to protect
• Cryptographic hash functions, steganography, etc.

1.4 - Blockchain Technology

• A distributed, immutable ledger
• Cryptographically secured
• Used to secure transactions, maintain records, etc.

2.1 - Threat Actors

• Nation-state actors
• Organized crime
• Hacktivists
• Insider threats
• Unskilled attackers
• Shadow IT actors

2.2 - Common Threat Vectors

• Message-based (phishing)
• File-based (malware)
• Voice-call vectors
• Wireless vectors
• Supply chain vectors

2.3 - Memory Injections

• Modifying memory of other applications
• Can be a way to exploit vulnerabilities

2.3 - Buffer Overflows

• Risks can occur with poorly secured code
• Vulnerability in programs
• Can cause unexpected behavior or system crash

2.3 - Race Conditions

• A vulnerability where unanticipated concurrent operation causes errors
• Attackers use timing-sensitive vulnerabilities to disrupt processes

2.3 - Malicious Updates

• Often delivered through legitimate channels
• May contain additional malware

2.3 - Operating System Vulnerabilities

• Vulnerable to exploits
• Not keeping systems updated

2.3 - SQL Injection

• Manipulating input to break into databases
• Enables access to sensitive data

2.3 - Cross-site Scripting (XSS)

• Injecting scripts into websites to steal information

2.3 - Hardware Vulnerabilities

• Attacking weaknesses in hardware devices
• Could be a potential way to bypass defenses

2.3 - Virtualization Vulnerabilities

• Potential security issues in virtualization
• The ability to escape a virtual environment
• Attackers see these as a weakness

2.3 - Cloud-Specific Vulnerabilities

• Similar attacks as on-premises, such as vulnerabilities and misconfigurations
• Security is complex
• Third-party issues can occur

2.3 - Supply Chain Vulnerabilities

• Attacking the chain between producers and consumers
• Vulnerable links can be exploited or corrupted
• Compromising a supplier can threaten the entire network

2.3 - Misconfiguration Vulnerabilities

• Leaving security settings not updated

2.4 - Cryptographic Attacks

• Exploitation of cryptographic algorithms
• Can be used to create security weaknesses

2.4 - Password Attacks

• Brute-force attacks
• Using stolen credentials or weak passwords

2.4 - Application Attacks

• Exploiting application weaknesses
• SQL injection, cross-site scripting

2.4 - On-path Attacks

• Network compromises
• Manipulating traffic when moving packets between source and destination

2.4 - Replay Attacks

• Replaying intercepted data to gain unauthorized access
• Spoofs or imitates actions

2.4 - Denial of Service (DoS)

• Attacking services to stop them from working
• Flood services with requests and data to overload them
• Distributed denial of service (DDoS) uses many computers to attack

2.4 - Wireless Attacks

• Jamming attacks
• Wireless deauthentication attacks

2.4 - Malware: Viruses, Worms, Ransomware, Trojans, Rootkits, Spyware, Bloatware

• Malware types
• How they operate and spread
• How they are used in attacks

2.4 - Other Malware Types

• Keyloggers
• Logic bombs

3.1 - Network Infrastructure Concepts

• Physical and logical separation
• Secure network designs

3.1 - Other Infrastructure Concepts

• Attackers always look for vulnerabilities
• On-premises vs. cloud security

3.2 - Secure Infrastructures

• Security zones
• Network appliances

3.2 - Intrusion Prevention System (IPS)

• Intrusion detection and intrusion prevention
• Active and passive monitoring

3.2 - Network Appliances

• Firewalls and proxies
• Multipurpose devices
• Manage network traffic

3.3 - Data Types and Classifications

• Data types and classifications
• Data at rest, data in transit and data in use
• Privacy concerns with data

3.4 - Recovery Testing

• Test recovery procedures often
• Backup
• Backup techniques

3.4 - Resiliency

• Ensure systems can withstand failures
• Recovery and backups are crucial
• Redundancy and diversity of resources help resiliency

3.4 - Capacity Planning

• Match supply with demand

4.1 - Secure Baselines

• Define secure configurations for systems
• Manage software configurations
• Secure protocols

4.2 - Asset Management

• Asset identification and tracking
• Security controls and policies

4.3 - Vulnerability Scanning

• Identify and analyze security vulnerabilities
• Test for threats

4.3 - Vulnerability Remediation

• Address security vulnerabilities
• Install security updates
• Mitigate risks

4.3 - Threat Intelligence

• Research threats and risk factors
• Use information to build security
• Analysis of data and patterns to detect threats

4.4 - Security Monitoring

• Continuous security oversight and response
• Investigate and address security issues
• Detection and response to security incidents

4.5 - Firewalls and Network Based Firewalls

• Manage traffic routing
• Separate trusted and untrusted networks
• Next-Generation Firewalls (NGFWs): Layer 7 firewalls providing more granular controls

4.5 - Web Filtering

• Monitor web traffic
• Block inappropriate or malicious content
• Reputation systems

4.5 - Secure Protocols

• Using encrypted protocols
• Secure port configurations

4.5 - Monitoring Data

• Collect and analyze data from various sources
• Identify and address issues

4.6 - Identity and Access Management (IAM)

• Centralize identity and access management
• Manage credentials
• Control access

4.7 - Scripting and Automation

• Use automation for repetitive tasks
• Security configuration management
• Orchestrate and automate processes

4.8 - Incident Response

• Plan for security incidents
• Identify, contain, eradicate
• Respond to incidents properly

5.1 - Security Policies

• Develop and implement policies
• Address risks

5.1 - Security Standards

• Conform to existing standards
• Maintain consistent security policies

5.2 - Risk Management

• Evaluate risks
• Develop mitigation strategies

5.2 - Risk Analysis

• Identify risk factors
• Evaluate potential impacts
• Choose a method for risk assessment

5.3 - Third-party Risk Assessments

• Evaluate third-party risks
• Secure policies and procedures required for mitigation

5.4 - Compliance

• Meet legal and regulatory requirements
• Manage risks for compliance

5.5 - Audits and Assessments

• Verify compliance and security status
• External and internal assessments
• Use audits to improve security controls

5.6 - Security Awareness Training

• Educate users about security threats and risks
• Train users on security best practices
• Implement awareness programs