Security+ SY0-701

A malicious software

A virus stored in the first sector of a hard drive and loaded into memory upon boot up. It is hard to detect

virus that infect an executable or an application

A virus that combines both boot sector and program viruses together by attaching itself to the boot sector and system files

A virus that uses a cipher to encrypt the content itself to avoid detection by any antivirus software.

An advanced version of an encrypted virus that changes itself everytime its executed by trying to morph the way the code looks so the sign-based antivirus cant defect it

A virus that is able to rewrite itself entirely before it attempts to infect a file

a type of malware that hides itself to avoid detection by antivirus software

malicious code that runs without user's knowledge. Requires a user action in order to reproduce and spread

Virus embedded in a document and executed when the document is opened.

layer of protection to confuse a program or person analyzing it

non malicious code hidden message

A malware like a virus but it's able to replicate itself without user interaction that cause disruptions to network traffic, computer activities, and cause a system to crash or slow down

A malware disguised as a piece of harmless software to preform desired and malicious functions to infect a system.

A malware that allows an attacker to remotely control an infected computer

A malware that restricts access by encrypting a victims file or computer until ransom payment is recieved

A malware that secretly gathers information about you without your consent by using a keylogger that captures keystrokes and take screenshots

Displays advertisments based upon its spying

mane a computer system to behave improperly

A software aimed to gain administrative level control on a system without detection. The attacker uses a technique called DLL Injection to maintain their persistent control

A malicious code inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries that are loaded at running time.

An attack that relies on compromising the Kernel-mode device drivers that operate at a private or system level. A shim is placed between two components to intercept calls and redirect them

DDL Injection and Driver Manipulation

A malicious activity that abuses electronic messaging systems such as emails. Attackers often exploit a company's open mail relay to send their messages.

A method to access a victims machine

same as threat but in order to infect it w/ malware

A malware placed on a website potential will access websites that are mispelled that you know your type squatting

A collection of compromised computers under the control of a master node. It can be used for illegal activities or conclucting a DDoS attacks

Occurs when a computer is placed between the sender and the receiver to capture or modify the traffic between them

Used to bypass normal security and authentication functions

A malicious code that has been inserted inside a program and will execute only when certain conditions have been met.

A technique that describes the specific method by which malware code infects a target host

A technique to avoid detection by signature-based security softwares by using a malware that is executed directly as a script or a small piece of shellcode

Designed to install or run other types of malware embedded in a payload on an infected host

A piece of code that connects to the internet to retrieve additional tools

A light weight code designed to run an exploit

Runs malicious code with the identification number of legit process such as Masquerading DLL Injection, DLL Sideloading , and Process hollowing

An exploit technique that uses standard system to exploit packages to perform intrusions → Powershell

Software application that protects a single computer from unwanted internet traffic

Uses rules and policies to filter incoming and outgoing traffic on a single computer.
Windows = Basic and Advanced
OSX = PF and IPFW
Linux = iptables

A device or software that monitors a system or network and analyzes the data passing through it to identify an incident or attack. Only alert and log but doesnt protect it.

installed on a computer or server and logs suspicious activity

Hardware installed on a network switch, copies traffic, andlogs suspicious activity

Specific string of bytes triggers that an alert for known specific key.

Relies on a specific sequrity policy and flags any violations

Compares current traffic patterns with basline and alerts on deviations

When a threat is detected and flagged

When a normal activity is identified as an attack

When a normal activity is not flagged

When an actual threat is not flagged

A detection system used to recreate the events after an attack has occurred.

Blocking of external files containing Javascript, images, or web pages from loading in a browser

A hardware or software designed to monitor the data of a system while in use, in transit, or at rest to detect attemps to steal the data.

Software-based client system that monitors data in use and stop a file transfer or alert an administrator of the occurance

A software or hardware based solution installed on the perimeter of the network detect data in transit, going in or out with a focus on outgoing data

Act protects data and information from unauthorized access, unlawful modification and disruption, disclosure, corruption, and destruction

Act of protecting the systems that hold processes that are critical data

Confidentiality, Integrity, and Availablity

Information/data accuracy. Data cannot be modified by unauthorized users.

information/data being available when needed at all times.

information/data privacy. Information is not made available to unauthorized users.

guarantees that a specific action or event has taken place and cannot be denied by the parties involved.

verifying the identity of the person or device attempting to access the system

defines what actions or resources a user can access

Act of tracking user activities and resource usage

Measures or mechanisms put in place to mitigate risks and protect the confidentiality, integrity and availability of the system and its information

A security model based on the principle of maintaining strict access controls and not trusting anyone by default, even those already inside the network

Focused on the subject/system, policy engine, policy administrator, and establishing policy enforcement points

Weakness

No Risk

No Risk

using strategies to reduce the amount of risk (the degree of likelihood that a person will become ill upon exposure to a toxin or pathogen).

Process of converting data into code to prevent unauthorized access.

A security measure that defines who can access a computer, device, or network, when they can access it, and what actions they can take while accessing it.

Permitting parts of a sensitive value to be visible while leaving the remainder of the value shielded from view

To ensure confidentiality for physical types of data and for digital information contained on servers and workstations.
- lock file cabinets, install biometric security locks on the server room door

Conducting regular training on the security awareness best procestice that employees can use to protect the organization's sensitive data

Protect personal privacy, Maintain a business advantage, and Achieve regulatory compliance

Encryption, Access Controls, Data Masking, Physical Security Measures, and Training and Awareness

Data accuracy, Maintaining trust, an Ensuring system operability.

ensures that decisions are made based on correct information and with the expected outcomes

Process of converting data into a fixed-size value

Digital Fingerprint

Use encryption to ensure both integrity and authenticity. File is first hashed and then the resulting hash digest is encrypted using the user's private key.

Used to verify data integrity during transmission. Sender and receiver compare checksum values to detect any unintended changes in the data.

Involve reviewing logs and operations to ensure that only authorized changes have been made and any discrepancies are addressed.

Hashing, Digital Signatures, Checksums, Access Controls, and Regular Audits

System guarantees a downtime of no more than 5.26 minutes in a year

Requires a robust infrastructure, proactive monitoring, redundancy measures, and swift disaster recovery mechanisms.

Duplicating critical components or functions of a system to enhance reliability and ensure uninterrupted service. Having backup options in place in case of system failure.

Using multiple servers in a load balance or failover configuration to support users when one server is overloaded or fails

The duplication of data, or the storage of the same data in multiple places

Ensures that data can still travel through another route if one network path fails.

Involves using backup power sources, such as generators and uninterrupted power supply systems, to keep organizational systems operational during power disruptions or outages.

the ability to prove that a specific action or transaction occurred and that the parties involved cannot deny their involvement

a cryptographic algorithm that verifies the authenticity and integrity of digital information, such as emails, documents, or credit card transactions

the concept of ensuring that information is accessible and usable in a timely and reliable manner

the practice of creating backup systems or components to ensure that a system continues to function even if there is a failure

the concept of protecting data from unauthorized modification or destruction

a mathematical process that turns data into a unique, unreadable string of characters, called a hash value, to protect sensitive information

the practice of protecting information from unauthorized access and disclosure

a process that scrambles data into an unreadable code, known as ciphertext, so that only authorized people can access it

a type of authentication factor that requires a user to provide information they know to access a secure system (something you know)

a category of authentication credentials that requires a user to have something in their possession to identify themselves (Something you have)

Something you do

a category of authentication factor in cyber security that refers to a user's biological traits that are used to identify them (Something you are)

a way to confirm a user's identity based on their location (Somewhere you are)

Set of rules and policies that are used to dictate what actions users can perform once verified

Security process that requires users to provide multiple of identification to verify their identity

the process of verifying the identity of a user or device before allowing them to access a computer system or network

the process of tracking user activity on a network

A chronological record of users' activities that can be used for tracing changes, unauthorized access, or anomalies

Maintains a comprehensive record of all users' activities

Uses detailed accounting and event logs that can help cybersecurity experts understand what happened. how it happened. and how to prevent similar incidents from occurring again.

Organizations can optimize system performance and minimize costs by tracking resource utilization and allocation decisions

Ensures users' actions are monitored and logged, deterring potential misuse and promoting adherence to the organization's policies.

A server used to aggregate logs from various network devices and systems for analysis.

like Wireshark capture and analyze network traffic for network administrators

provides real-time analysis of security alerts generated by hardware and software infrastructure.

Technologies, hardware, and software mechanisms implemented to manage and reduce risk in a system

Strategic planning and governance side of security ensuring alignment of security strategies with business goals and risk tolerance.

Procedures and measures designed to protect data on a day-to-day basis, governed by internal processes and human actions.

Tangible real-world measures taken to protect assets, existing outside the digital realm

Proactive measures are implemented to prevent security threats or breaches. They fortify systems before an incident occurs, such as using a firewall to filter incoming and outgoing traffic

Monitor and alert organizations to malicious activities as they occur. Examples include security cameras and intrusion detection systems.

Mitigate potential damage and restore systems to their normal states after a threat has been detected. Antivirus software quarantining and removing malware is an example.

Security controls that attempt to discourage individuals from causing a security incident.

Alternative measures ensuring protection when primary controls aren't feasible or effective. For example, using a VPN on top of an older encryption standard.

Controls that guide, inform, or mandate actions based on policy or documentation.