Test your basic knowledge |

Comptia Security +: Vocab

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Once authenticated - the level of access you have to a system






2. Being able to control access to individuals very specifically - instead of lower in the OSI model where you cant set it so specifically






3. Hardware - software - and firmware elements of a TCB that implement the fundamental security procedures for controlling access to system resources






4. A hidden communications channel on a system that allows for the bypassing of the system security policy






5. In computing - Secure Shell or SSH is a set of standards and an associated network protocol that allows establishing a secure channel between a local and a remote computer. It uses public-key cryptography to authenticate the remote computer and (opti






6. Motivational tools for employee awareness to get them to report security flaws in an organization






7. In cryptography - it is one of the simplest and most widely-known encryption techniques. It is a type of substitution cipher in which each letter in the plaintext is replaced by a letter some fixed number of positions further down the alphabet.






8. A network entity that provides a single entrance / exit point to the Internet.






9. Identifying risks and assessing the possible damage that can be caused in order to justify security safeguards






10. Someone who hacks using programs that they can download from the Internet. This person usually doesn't find new exploits - but simply exploits vulnerabilities that others have found.






11. In a separation of duties model - this is where code is checked in and out






12. The process of reducing your risks to an acceptable level based on your risk analysis






13. Encompasses Risk Analysis and Risk Mitigation






14. Grabs an image of the finger which is then stored in a database and then works in a one-to-many database






15. Refers to the formal acceptance by organization executive management that they accept the residual risk associated with using a formally certified information system.






16. A type of hash function used to produce a checksum - which is a small - fixed number of bits - against a block of data. This is used to detect errors after transmission or storage.






17. Virtual memory is an area of 'memory' that is not in physical memory (RAM) but on the disk system to allow for extra 'memory' processing area above what is available through RAM. This is the pagefile.sys file on a Windows system. Many Windows OSs req






18. The art of breaking code. Testing the strength of an algorithm.






19. A SSO technology that extends Kerberos functionality and improve upon its weaknesses.






20. Motive - Opportunity - and Means. These deal with crime.






21. Same as AES Advanced Encryption Standard (AES) - also known as Rijndael - is a block cipher adopted as an encryption standard by the US government. It is expected to be used worldwide and analyzed extensively - as was the case with its predecessor -






22. This is the file on a UNIX system where usernames to password MD5 hash outputs are stored. The system uses this file to determine if the password entered for a given username is correct.






23. A denial-of-service attack is an attack on a computer system or network that causes a loss of service to users - typically the loss of network connectivity and services by consuming the bandwidth of the victim network or overloading the computational






24. A mechanism by which connections to TCP services on a system are allowed or disallowed






25. A spoofing attack - a kind of attack in data communication - in which a third party tries to mislead the communication participants using forged information.






26. The practice of following someone with a security code or keycard through a security door - generally in workplaces.






27. Refers to any of the various programs by which a computer controls aspects of its operations - such as those for translating data from one form to another - as contrasted with hardware - which is the physical equipment comprising the installation.






28. Disclosure - Alteration - Destruction. These things break the CIA triad






29. The process of training end users / employees in the ways and processes of security. This helps to mitigate risk to the company (if the employees know what to do) and also helps the employees to know what is expected of them security-wise - so that t






30. Issued by the United States National Computer Security Center (NCSC - an arm of the NSA) as 'Trusted Computer System Evaluation Criteria' - a DOD standard 5200.23-STD in December 1985 superseding CSC-STD-001-83 - the TCSEC (frequently referred to as






31. Scanning the airwaves for radio transmissions






32. Class A (1-126.x.x.x) - Class B (128-191.x.x.x) - Class C (192-223.x.x.x)






33. Rotating employee's job duties so that things can be checked that they are doing to make sure nothing fraudulent is occurring.






34. 0 = striping without parity 1 = mirroring 3 = striping with parity (parity on single drive) 5 = striping with parity (parity striped across all drives)






35. After implementing countermeasures - accepting risk for the amount of vulnerability left over






36. A form of binary to text encoding that originated as a Unix program for encoding binary data for transmission over the uucp mail system. The name 'uuencode' is derived from 'Unix-to-Unix encoding'. Since uucp converted characters between various comp






37. Personal - Network - and Application






38. Chief Information Officer






39. False Acceptance Rate - False Rejection Rate - Crossover Error Rate






40. Internet Architecture Board. This board is responsible for protecting the Internet.






41. Countermeasure to put fake stuff into a database so if someone is reading it they will get the wrong info.






42. Federal law with many aspects designed to curb terrorist activities; impacts real estate transactions because of disclosure requirements imposed on escrow agents regarding transfer of title and deposits of cash; imposes new disclosure and signature r






43. The apparent simultaneous performance of two or more tasks by a computer's central processing unit.






44. In cryptanalysis - this attack is a method of defeating a cryptographic scheme by trying a large number of possibilities; for example - exhaustively working through all possible keys in order to decrypt a message. In most schemes - the theoretical po






45. In cryptanalysis - a brute force attack is a method of defeating a cryptographic scheme by trying a large number of possibilities. In most schemes - the theoretical possibility of a brute force attack is recognised - but it is set up in such a way th






46. This is an open international standard for applications that use wireless communications.






47. Network devices that operate at layer 3. This device separates broadcast domains.






48. Dynamic Host Configuration Protocol.






49. Object Linking and Embedding. The ability of an object to be embedded into another object.






50. A hash function (or hash algorithm) is a way of creating a small digital 'fingerprint' from any kind of data. The function chops and mixes the data to create the fingerprint - often called a hash value. The hash value is commonly represented as a sho