AP®︎ Cybersecurity: Topic 4.1 Flashcards

A computer that provides one or more services to other computers; server describes a role, though enterprise servers typically have greater capacity than personal computers

A general-purpose computer designed primarily for one person's work or recreation, such as a desktop, laptop, or notebook

A battery-powered computer smaller than a personal computer, such as a smartphone, tablet, or wearable device

A computer built into a larger machine to perform specialized functions, usually with limited processing power and storage

An everyday or operational product containing an embedded computer, especially one that communicates over a network

Malicious software that can damage or destroy a device or network or allow an adversary to access a device and its data

Malware that requires a user to activate it by executing or opening an infected file

Malware that spreads automatically from one computer to another without human interaction

Malware embedded in software that appears harmless or legitimate

A trojan that gives an adversary continuing remote access to and control of the target system

Malware that encrypts files to deny access and demands payment in exchange for a promised decryption key

Malware that monitors a user's actions and sends collected information to an adversary

Software or hardware that records a user's keystrokes and provides them to an adversary, often exposing usernames and passwords

Malicious code that remains inactive until a specified condition, event, date, or system state triggers its effect

Sophisticated malware with deep operating-system control that can conceal itself, its processes, or an adversary's activity

Malicious code that operates in RAM and uses legitimate installed programs instead of relying on a conventional malicious file stored on disk

A weakness in a device, software, configuration, or control that can be exploited

Something capable of exploiting a vulnerability and causing harm, such as an adversary or deployed malware

A method or code that takes advantage of a vulnerability

Exposure caused by failing to install an available patch for a known software flaw, allowing exploits to crash, monitor, alter, or control a device

Authentication requirements that make unauthorized access more likely, such as easily guessed passwords or using a password as the only required proof of identity

Basic Input/Output System or Unified Extensible Firmware Interface settings lacking password protection, allowing unauthorized recovery-mode or external-drive booting to gain privileges or alter accounts

A feature that automatically executes content when external media is inserted, allowing malware on a drive to run without the user deliberately opening it

A network port on which a service is listening for connections; it creates exposure when the reachable service is unnecessary, insecure, or vulnerable

The absence or incorrect configuration of traffic-filtering rules, allowing malicious or unnecessary network data to reach a device or vulnerable service

The absence of software intended to identify, quarantine, and remove malware, making successful installation or continued operation of malware more likely

The possibility that a device vulnerability will be exploited and the organizational impact if exploitation succeeds

Evaluating a device vulnerability by considering the asset, plausible threat, likelihood of exploitation, controls, and operational or data impact

Recording the affected asset, vulnerability, plausible threat or attack, likelihood, impact, and overall risk level

Risk involving potential compromise of sensitive data or critical operations because exploitation is likely, the impact is severe, or both

A meaningful device risk, often involving weak authentication or a vulnerability less likely to be exploited, whose likelihood or impact does not support the highest rating

A device risk whose successful exploitation would typically have little organizational impact