SEC 401 VERIFIED STUDY GUIDE
3DES - Answers - (Triple Data Encryption Standard) A symmetric encryption algorithm
that encrypts data by processing each block of data three times, using a different DES
key each time.
802.11 - Answers - A family of specifications developed by the IEEE for wireless LAN
technology.
802.11a - Answers - A fast, secure, but relatively expensive protocol for wireless
communication. It Supports speeds up to 54 Mbps in the 5 GHz frequency.
802.11ac - Answers - A wireless communication protocol that improves upon 802.11n
by adding wider channels to increase bandwidth.
802.11b. - Answers - The first specification to be called Wi-Fi, it is the least expensive
wireless network protocol used to transfer data among computers with wireless network
cards, or between a wireless computer or device and a wired LAN. It provides for an 11
Mbps transfer rate in the 2.4 GHz frequency.
802.11g - Answers - A specification for wireless data throughput at the rate of up to 54
Mbps in the 2.4 GHz band that is a potential replacement for 802.11b
802.11n - Answers - A wireless standard for home and business implementations that
adds QoS features and multimedia support to 802.11a and 802.11b.
802.1x - Answers - An IEEE standard used to provide a port based authentication
mechanism over a LAN or WLAN
access control - Answers - In IT security terms, the process of determining and
assigning privileges to various resources, objects, and data.
Access Control Lists (ACL) - Answers - In a DAC (discretionary access control) access
control scheme, this is the list that is associated with each object, specifying the
subjects that can access the object and their levels of access.
account federation - Answers - The practice of linking a single account across many
different management systems.
account management - Answers - A common term used to refer to the processes,
functions, and policies used to effectively manage user accounts within an organization.
account phishing - Answers - In social networking, and attack where an attacker creates
an account and gets on the friends list of an individual just to try to obtain information
about the individual and their circle of friends or colleagues.
,account policy - Answers - A document that includes an organization's user account
management guidelines.
account privileges - Answers - Permissions granted to users that allow them to perform
various actions such as creating, deleting, and editing files, and also accessing systems
and services on the network.
accountability - Answers - In security terms, the process of determining who to hold
responsible for a particular activity or event.
accounting - Answers - In IT security terms, the process of tracking and recording
system activities and resource access.
Active Directory - Answers - The standards-based directory service from Microsoft that
runs on Microsoft Windows servers.
adware - Answers - Software that automatically displays or downloads advertisements
when it is used.
AES (Advanced Encryption Standard) - Answers - A symmetric 128-, 192-, or 256-bit
block cipher based on the Rijndael algorithm developed by Belgian cryptographers Joan
Daemen and Vincent Rijmen and adopted by the U.S. government as its encryption
standard to replace DES.
ALE (annual loss expectancy) - Answers - The total cost of a risk to an organization on
an annual basis.
all-in-one-security appliance - Answers - A single network device that is used to perform
a number of security functions to secure a network.
anomaly-based monitoring - Answers - A monitoring system that uses a database of
unacceptable traffic patterns identified by analyzing traffic flows.
anti-malware software - Answers - A category of software programs that scan a
computer or network for known viruses, Trojans, worms, and other malicious software.
anti-spam - Answers - A program that will detect specific words that are commonly used
in spam messages.
anti-spyware - Answers - Software that is specifically designed to protect systems
against spyware attacks.
antivirus software - Answers - An application that scans files for executable code that
matches specific patterns that are known to be common to viruses.
,API (application programming interface) - Answers - A mechanism that defines how
software elements interact with each other.
application attacks - Answers - Attacks that are targeted at web-based and other client-
server applications.
application aware device - Answers - A network device that manages information about
any application that connects to it.
application blacklisting - Answers - The practice of preventing undesirable programs
from running on a computer, computer network, or mobile device.
application whitelisting - Answers - The practice of allowing approved programs to run
on a computer, computer network, or mobile device.
arbitrary code execution - Answers - An attack that exploits an applications vulnerability
into allowing the attacker to execute commands on a user's computer.
archive bit - Answers - A file property that essentially indicates whether the file has been
modified since the last back up.
armored virus - Answers - A virus that is able to conceal its location or otherwise render
itself harder to detect by anti-malware programs.
ARO (annual rate of occurrence) - Answers - How many times per year a particular loss
is expected to occur.
ARP (Address Resolution Protocol) - Answers - The mechanism by which individual
hardware MAC addresses are matched to an IP address on a network.
ARP poisoning - Answers - A method in which an attacker, with access to the target
network, redirects an IP address to the MAC address of a computer that is not the
intended recipient.
asymmetric encryption - Answers - A two-way encryption scheme that uses paired
private and public keys.
attachment attack - Answers - An attack where the attacker can merge malicious
software or code into a downloadable file or attachment on an application server so that
users download and execute it on client systems.
attack - Answers - Any technique that is used to exploit a vulnerability in any application
on a computer system without the authorization to do so.
attack surface - Answers - The portion of a system or application that is exposed and
available to attackers.
, attackers - Answers - A term for users who gain unauthorized access to computers and
networks for malicious purposes.
attacking - Answers - The final phase of a hack in which the attacker steals data,
disrupts traffic, or damages systems.
auditing - Answers - The practice of examining logs of what was recorded in the
accounting process.
authentication - Answers - In security terms, the process of validating a particular
individual or entity's unique credentials.
authorization - Answers - In IT security terms, the process of determining what rights
and privileges a particular entity has.
availability - Answers - The fundamental security goal of ensuring that systems operate
continuously and that authorized persons can access data that they need.
backdoor - Answers - A mechanism for gaining access to a computer that bypasses or
subverts the normal method of authentication.
backdoor attack - Answers - A type of attack where the attacker creates a software
mechanism to gain access to a system and its resources. This can involve software or a
bogus user account.
back-out contingency plan - Answers - A documented plan that includes specific
procedures and processes that are applied in the event that a change or modification
made to a system must be undone.
baseline report - Answers - A collection of security and configuration settings that are to
be applied to a particular system or network in the organization.
BCP (business continuity plan) - Answers - A policy that defines how normal day-to-day
business will be maintained in the event of a business disruption or crisis.
bcrypt - Answers - A key-derivation function based on the Blowfish cipher algorithm.
behavior-based monitoring - Answers - A monitoring system that detects changes in
normal operating data sequences and identifies abnormal sequences.
BIA (business impact analysis) - Answers - A BCP preparatory step that identifies
present organizational risks and determines the impact to ongoing, business-critical
operations if such risks actualize.
3DES - Answers - (Triple Data Encryption Standard) A symmetric encryption algorithm
that encrypts data by processing each block of data three times, using a different DES
key each time.
802.11 - Answers - A family of specifications developed by the IEEE for wireless LAN
technology.
802.11a - Answers - A fast, secure, but relatively expensive protocol for wireless
communication. It Supports speeds up to 54 Mbps in the 5 GHz frequency.
802.11ac - Answers - A wireless communication protocol that improves upon 802.11n
by adding wider channels to increase bandwidth.
802.11b. - Answers - The first specification to be called Wi-Fi, it is the least expensive
wireless network protocol used to transfer data among computers with wireless network
cards, or between a wireless computer or device and a wired LAN. It provides for an 11
Mbps transfer rate in the 2.4 GHz frequency.
802.11g - Answers - A specification for wireless data throughput at the rate of up to 54
Mbps in the 2.4 GHz band that is a potential replacement for 802.11b
802.11n - Answers - A wireless standard for home and business implementations that
adds QoS features and multimedia support to 802.11a and 802.11b.
802.1x - Answers - An IEEE standard used to provide a port based authentication
mechanism over a LAN or WLAN
access control - Answers - In IT security terms, the process of determining and
assigning privileges to various resources, objects, and data.
Access Control Lists (ACL) - Answers - In a DAC (discretionary access control) access
control scheme, this is the list that is associated with each object, specifying the
subjects that can access the object and their levels of access.
account federation - Answers - The practice of linking a single account across many
different management systems.
account management - Answers - A common term used to refer to the processes,
functions, and policies used to effectively manage user accounts within an organization.
account phishing - Answers - In social networking, and attack where an attacker creates
an account and gets on the friends list of an individual just to try to obtain information
about the individual and their circle of friends or colleagues.
,account policy - Answers - A document that includes an organization's user account
management guidelines.
account privileges - Answers - Permissions granted to users that allow them to perform
various actions such as creating, deleting, and editing files, and also accessing systems
and services on the network.
accountability - Answers - In security terms, the process of determining who to hold
responsible for a particular activity or event.
accounting - Answers - In IT security terms, the process of tracking and recording
system activities and resource access.
Active Directory - Answers - The standards-based directory service from Microsoft that
runs on Microsoft Windows servers.
adware - Answers - Software that automatically displays or downloads advertisements
when it is used.
AES (Advanced Encryption Standard) - Answers - A symmetric 128-, 192-, or 256-bit
block cipher based on the Rijndael algorithm developed by Belgian cryptographers Joan
Daemen and Vincent Rijmen and adopted by the U.S. government as its encryption
standard to replace DES.
ALE (annual loss expectancy) - Answers - The total cost of a risk to an organization on
an annual basis.
all-in-one-security appliance - Answers - A single network device that is used to perform
a number of security functions to secure a network.
anomaly-based monitoring - Answers - A monitoring system that uses a database of
unacceptable traffic patterns identified by analyzing traffic flows.
anti-malware software - Answers - A category of software programs that scan a
computer or network for known viruses, Trojans, worms, and other malicious software.
anti-spam - Answers - A program that will detect specific words that are commonly used
in spam messages.
anti-spyware - Answers - Software that is specifically designed to protect systems
against spyware attacks.
antivirus software - Answers - An application that scans files for executable code that
matches specific patterns that are known to be common to viruses.
,API (application programming interface) - Answers - A mechanism that defines how
software elements interact with each other.
application attacks - Answers - Attacks that are targeted at web-based and other client-
server applications.
application aware device - Answers - A network device that manages information about
any application that connects to it.
application blacklisting - Answers - The practice of preventing undesirable programs
from running on a computer, computer network, or mobile device.
application whitelisting - Answers - The practice of allowing approved programs to run
on a computer, computer network, or mobile device.
arbitrary code execution - Answers - An attack that exploits an applications vulnerability
into allowing the attacker to execute commands on a user's computer.
archive bit - Answers - A file property that essentially indicates whether the file has been
modified since the last back up.
armored virus - Answers - A virus that is able to conceal its location or otherwise render
itself harder to detect by anti-malware programs.
ARO (annual rate of occurrence) - Answers - How many times per year a particular loss
is expected to occur.
ARP (Address Resolution Protocol) - Answers - The mechanism by which individual
hardware MAC addresses are matched to an IP address on a network.
ARP poisoning - Answers - A method in which an attacker, with access to the target
network, redirects an IP address to the MAC address of a computer that is not the
intended recipient.
asymmetric encryption - Answers - A two-way encryption scheme that uses paired
private and public keys.
attachment attack - Answers - An attack where the attacker can merge malicious
software or code into a downloadable file or attachment on an application server so that
users download and execute it on client systems.
attack - Answers - Any technique that is used to exploit a vulnerability in any application
on a computer system without the authorization to do so.
attack surface - Answers - The portion of a system or application that is exposed and
available to attackers.
, attackers - Answers - A term for users who gain unauthorized access to computers and
networks for malicious purposes.
attacking - Answers - The final phase of a hack in which the attacker steals data,
disrupts traffic, or damages systems.
auditing - Answers - The practice of examining logs of what was recorded in the
accounting process.
authentication - Answers - In security terms, the process of validating a particular
individual or entity's unique credentials.
authorization - Answers - In IT security terms, the process of determining what rights
and privileges a particular entity has.
availability - Answers - The fundamental security goal of ensuring that systems operate
continuously and that authorized persons can access data that they need.
backdoor - Answers - A mechanism for gaining access to a computer that bypasses or
subverts the normal method of authentication.
backdoor attack - Answers - A type of attack where the attacker creates a software
mechanism to gain access to a system and its resources. This can involve software or a
bogus user account.
back-out contingency plan - Answers - A documented plan that includes specific
procedures and processes that are applied in the event that a change or modification
made to a system must be undone.
baseline report - Answers - A collection of security and configuration settings that are to
be applied to a particular system or network in the organization.
BCP (business continuity plan) - Answers - A policy that defines how normal day-to-day
business will be maintained in the event of a business disruption or crisis.
bcrypt - Answers - A key-derivation function based on the Blowfish cipher algorithm.
behavior-based monitoring - Answers - A monitoring system that detects changes in
normal operating data sequences and identifies abnormal sequences.
BIA (business impact analysis) - Answers - A BCP preparatory step that identifies
present organizational risks and determines the impact to ongoing, business-critical
operations if such risks actualize.
