Test your basic knowledge |

Comptia Security +: Vocab

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Entails planning and system actions to ensure that a project is following good quality management practices






2. A network that uses standard protocols (TCP/IP)






3. (OLE) is a distributed object system and protocol developed by Microsoft. OLE allows an editor to 'farm out' part of a document to another editor and then reimport it. Its primary use is for managing compound documents - but it is also used for trans






4. Someone who hacks






5. Testing a company's network to test for vulnerabilities in their systems so that weaknesses can be fixed. This testing does not actually fix anything.






6. An attack that is similar to smurf but instead of using ICMP (ping) it uses UDP as its weapon of choice. It broadcasts a spoofed UDP packet to the amplifying network.






7. The physical part of a computer - as distinguished from the computer software that executes within the hardware.






8. Virtual memory is an area of 'memory' that is not in physical memory (RAM) but on the disk system to allow for extra 'memory' processing area above what is available through RAM. This is the pagefile.sys file on a Windows system. Many Windows OSs req






9. A form of binary to text encoding that originated as a Unix program for encoding binary data for transmission over the uucp mail system. The name 'uuencode' is derived from 'Unix-to-Unix encoding'. Since uucp converted characters between various comp






10. An instance of a scripting language






11. The most popular computer language used to create - modify - retrieve and manipulate data from relational database management systems. The language has evolved beyond its original purpose to support object-relational database management systems. It i






12. In cryptography - encryption is the process of obscuring information to make it unreadable without special knowledge.






13. An AAA (Authentication - Authorization - and Accounting) protocol for applications such as network access or IP mobility. It is intended to work in both local and roaming situations.






14. A RFC standard. A mechanism for performing commands on a remote system






15. They all deal with objects or identifiers that are used during authentication. They provide information that will allow the authentication to happen. There are many types.






16. Trusted Computing Base. Comprised of the hardware - software - and firmware of the system.






17. Using ICMP to diagram a network






18. In cryptanalysis and computer security - this attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching a large number of possibilities. In contrast with a brute forc






19. Internet Architecture Board. This board is responsible for protecting the Internet.






20. CISSPs subscribe to a code of ethics for building up the security profession






21. A specialized version of a data warehouse. Like data warehouses - data marts contain a snapshot of operational data that helps business people to strategize based on analyses of past trends and experiences. The key difference is that the creation of






22. Not a picture - but rather vectors of your finger geometry with an acceptable variance built in to provide for slight changes.






23. A form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it - possibly as part of a masquer






24. In cryptography - it is one of the simplest and most widely-known encryption techniques. It is a type of substitution cipher in which each letter in the plaintext is replaced by a letter some fixed number of positions further down the alphabet.






25. This deals with differences between plaintext password storage and transmission - versus encrypted password storage and transmission.






26. The process of training end users / employees in the ways and processes of security. This helps to mitigate risk to the company (if the employees know what to do) and also helps the employees to know what is expected of them security-wise - so that t






27. A spoofing attack - a kind of attack in data communication - in which a third party tries to mislead the communication participants using forged information.






28. The art of breaking code. Testing the strength of an algorithm.






29. Driving around enumerating wireless networks with the proper equipment (antennas and the like)






30. Rotating employee's job duties so that things can be checked that they are doing to make sure nothing fraudulent is occurring.






31. If an employee is suspected of wrongdoing - sending them away from work for a while so that their actions can be audited.






32. Accepting all packets






33. Diffie-Hellman (D-H) key exchange is a cryptographic protocol which allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure communications channel. This key can then be used to encrypt s






34. The study of automated methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits. In information technology - biometric authentication refers to technologies that measure and analyze human physical and beh






35. Refers to a cryptographic signature - either on a document - or on a lower-level data structure that signs an item electronically.






36. A hidden value or set of values that allows access to a program - computer system - or data. It is sometimes erroneously confused with a backdoor - which (in a computer system) is a method of bypassing normal authentication or securing remote access






37. 'If you cant see it - its secure'. Bad policy to live by.






38. In a distributed attack - the attacking computer hosts are often zombie computers with broadband connections to the Internet that have been compromised by viruses or Trojan horse programs that allow the perpetrator to remotely control the machine and






39. In cryptanalysis - a brute force attack is a method of defeating a cryptographic scheme by trying a large number of possibilities. In most schemes - the theoretical possibility of a brute force attack is recognised - but it is set up in such a way th






40. In the context of computer software - a Trojan horse is a malicious program that is disguised as or embedded within legitimate software.






41. An attacker spoofs the source IP in a packet header - to make a ping request appear to have originated from the future victim's network - then the responding network responds in full force to these requests and brings down the victim's network.






42. The EU spec. If databases exist - users are allowed to check data into them - allowed to change them if wrong - etc.






43. Disclosure - Alteration - Destruction. These things break the CIA triad






44. Network devices that operate at layer 3. This device separates broadcast domains.






45. A hash function (or hash algorithm) is a way of creating a small digital 'fingerprint' from any kind of data. The function chops and mixes the data to create the fingerprint - often called a hash value. The hash value is commonly represented as a sho






46. A person able to exploit a system or gain unauthorized access through skill and tactics. This usually refers to a black hat hacker. There are also white hats (ethical hackers) - and grey hats.






47. Basic Input/Output System






48. Identifying risks and assessing the possible damage that can be caused in order to justify security safeguards






49. Software designed to infiltrate or damage a computer system - without the owner's consent.






50. In the broadest sense - a fraud is a deception made for personal gain