AP®︎ Cybersecurity: Unit 4 Flashcards

A computer that provides one or more services to other computers; server describes a role, though enterprise servers typically have greater capacity than personal computers

A general-purpose computer designed primarily for one person's work or recreation, such as a desktop, laptop, or notebook

A battery-powered computer smaller than a personal computer, such as a smartphone, tablet, or wearable device

A computer built into a larger machine to perform specialized functions, usually with limited processing power and storage

An everyday or operational product containing an embedded computer, especially one that communicates over a network

Malicious software that can damage or destroy a device or network or allow an adversary to access a device and its data

Malware that requires a user to activate it by executing or opening an infected file

Malware that spreads automatically from one computer to another without human interaction

Malware embedded in software that appears harmless or legitimate

A trojan that gives an adversary continuing remote access to and control of the target system

Malware that encrypts files to deny access and demands payment in exchange for a promised decryption key

Malware that monitors a user's actions and sends collected information to an adversary

Software or hardware that records a user's keystrokes and provides them to an adversary, often exposing usernames and passwords

Malicious code that remains inactive until a specified condition, event, date, or system state triggers its effect

Sophisticated malware with deep operating-system control that can conceal itself, its processes, or an adversary's activity

Malicious code that operates in RAM and uses legitimate installed programs instead of relying on a conventional malicious file stored on disk

A weakness in a device, software, configuration, or control that can be exploited

A method or code that takes advantage of a vulnerability

Exposure caused by failing to install an available patch for a known software flaw, allowing exploits to crash, monitor, alter, or control a device

Authentication requirements that make unauthorized access more likely, such as easily guessed passwords or using a password as the only required proof of identity

Basic Input/Output System or Unified Extensible Firmware Interface settings lacking password protection, allowing unauthorized recovery-mode or external-drive booting to gain privileges or alter accounts

A feature that automatically executes content when external media is inserted, allowing malware on a drive to run without the user deliberately opening it

A network port on which a service is listening for connections; it creates exposure when the reachable service is unnecessary, insecure, or vulnerable

The absence or incorrect configuration of traffic-filtering rules, allowing malicious or unnecessary network data to reach a device or vulnerable service

The possibility that a device vulnerability will be exploited and the organizational impact if exploitation succeeds

Risk involving potential compromise of sensitive data or critical operations because exploitation is likely, the impact is severe, or both

A meaningful device risk, often involving weak authentication or a vulnerability less likely to be exploited, whose likelihood or impact does not support the highest rating

A device risk whose successful exploitation would typically have little organizational impact

A mathematical algorithm that converts binary data of arbitrary length into a fixed-length binary output

Widely used hash functions include SHA-2 and SHA-3, while older MD5 and SHA-1 are deprecated because they are not collision resistant

An n-bit hash has 2^n possible outputs

The result when two different inputs produce the same hash output

The property that makes it computationally difficult to find two different inputs with the same hash

The property that makes it computationally infeasible to determine an input that generated a given hash

The property that the same input processed by the same hash function always produces the same hash

The property that a particular hash function always produces the same number of output bits regardless of input size

A hash function no longer used in secure settings, usually because an efficient collision method exists; MD5 and SHA-1 are examples

Store a password's hash instead of its plaintext, then hash each entered password and compare the result with the stored hash

A unique random value combined with a user's password before hashing so identical passwords produce different stored hashes

An attack that submits username-and-password guesses to an active login portal, service, or device

An attack that tests candidate passwords against captured password hashes on the adversary's computer, bypassing account lockout

Using the same password for multiple accounts, allowing compromise of one account to endanger the others

Trying one common password or a few common passwords across many different user accounts

Trying complete credentials stolen elsewhere or common default credentials against accounts, services, or devices

An automated offline attack that systematically tests every potential password in a chosen search space

An automated offline attack that tests a list of common or likely passwords instead of every possible string

A precomputed table associating potential passwords with their hash outputs, sorted by hash for searching

Evidence a user supplies to prove identity, categorized as knowledge, possession, biometric, or location

Something the user knows, such as a password, PIN, or challenge-question answer

An object the user has, such as an access card, bank card, registered phone, or authentication token

A measured bodily feature, such as a fingerprint, face, iris, retina, palm print, or voice

Evidence of somewhere the user is, inferred from data such as Wi-Fi signals, GPS, time zone, or IP address

Authentication requiring at least two different factor categories, not merely two pieces of the same type of evidence

A login rule requiring characters from designated sets, commonly uppercase, lowercase, numeric, and special characters

A login rule requiring a password to contain at least a configured number of characters

The maximum time a password may remain in use before a change is required, though routine changes can encourage predictable patterns

A stored set of previous password hashes used to reject recently reused passwords

A setting that locks an account after a configured number of invalid login attempts, limiting online but not offline guessing

A policy defining permissible, prohibited, and required uses of organization-owned devices

A policy defining requirements for creating, using, changing, and managing organizational passwords

A policy defining what software users may install, which applications are approved, and how users request additional software

Software that scans files for known malware signatures and quarantines and removes matching malicious files

A detectable characteristic pattern associated with a known malicious file or piece of code

Isolation of a suspected malicious file so it cannot operate normally or affect the rest of the system

A vendor-distributed software fix that closes known vulnerabilities; operating systems and applications must both be kept current

A small software update, often distributed to correct a known vulnerability

Software on one device that allows or denies its inbound and outbound network traffic according to firewall rules

An ordered set of firewall rules specifying which traffic to allow or deny

Evaluate rules from first to last, apply the first matching rule, and ignore all later rules

Direction, source or destination IP address or port, service, protocol, or application used to decide whether to allow or deny traffic

A chronological record of device events such as logins, process activity, file actions, software changes, and configuration changes

Evidence that an adversary has compromised a device or network

A record of attempted logins whose frequency, timing, accounts, sources, outcomes, and context can reveal attack patterns

Evidence found in device logs or configuration settings, such as unusual files, unexpected processes or services, unauthorized configuration changes, or unauthorized software installations or updates

Evidence found by examining device files, such as a known-malware hash, recognized malicious filename, or suspicious file path

Suspicious conduct found in activity logs, such as repeated login failures, unusual logins, unauthorized access, or privilege-elevation attempts

Detection that matches files or events to known threat patterns; it is fast, resource-efficient, and precise but easier to bypass

Detection that flags significant deviations from normal activity; it can find unfamiliar attacks but uses more resources and produces more false positives

A unified endpoint threat-detection service that typically provides centralized monitoring and alerts across an organization’s devices

A combination of signature-based and anomaly-based detection that broadens protection but generally requires more resources and expense

The purchase, licensing, staffing, training, maintenance, and infrastructure expenses required to operate a detection tool

The importance of a device and the sensitivity of its data, which determine how severe its compromise would be and how much protection it requires