Securites Essentials Exam Study
Guide+Questions and Answers Verified 100%
Correct
CIA Triad - ANSWER Confidentiality- encryption, Integrity-hashing, Availability-99.999%
rule
Risk - ANSWER Chance of harm coming to an asset
Threat - ANSWER anything that can cause harm to an asset
Vulnerability - ANSWER Weakness the asset has against potential threats
Security controls - ANSWER Admin- policies and training
Technical- technology
Operational- day to dayemployee activities
Physical- physical security (locks, etc)
Classification of security controls - ANSWER Preventative-proactive, designed to prevent
a problem in the first place
Detective-monitoring to discover and record problems
Corrective- after harm, to fix problem
Deterrent- visible controls designed to discourage attack
Confidentiality controls - ANSWER -Least privilege- only give access to what is needed to
do job
-Need to Know-restrict access to those who need it
, -Separation of Duties- have critical activities be performed by different people to
decrease conflicts of interest
-encryption- renders data unreadable to those unauthorized
-steganography- conceal a secret message within an ordinary one (code within a
picture)
Integrity Controls - ANSWER Hashing- math functions that Create a small fingerprint of a
message or file
Digital Signature- authentication, integrity, non repudiation
Backups- regular and complete backups can replace lost or changed data
Version control- storing multiple versions of files for frequent and collaborative change
Patch Management - ANSWER the process of regularly applying patches and updates to
software (can't trust people to do on their own)
Compensating Controls - ANSWER control procedures that compensate for the
deficiency in other controls
Events, incidents, alerts - ANSWER Event- meaningful change in the systems state that is
detectable and happened at a specific time
Incident- event that is unexpected, unusual, and poses a threat to the system
Alert- signal that an event is an incident
Event Evaluation - ANSWER True Positive- problem occurred, analysis recognized it
(good)
True negative- event was benign, no alerts (good)
False positive- event was benign, was reported as a problem (bad)
False negative- event was a problem, analysis didn't pick up on it (bad)
Guide+Questions and Answers Verified 100%
Correct
CIA Triad - ANSWER Confidentiality- encryption, Integrity-hashing, Availability-99.999%
rule
Risk - ANSWER Chance of harm coming to an asset
Threat - ANSWER anything that can cause harm to an asset
Vulnerability - ANSWER Weakness the asset has against potential threats
Security controls - ANSWER Admin- policies and training
Technical- technology
Operational- day to dayemployee activities
Physical- physical security (locks, etc)
Classification of security controls - ANSWER Preventative-proactive, designed to prevent
a problem in the first place
Detective-monitoring to discover and record problems
Corrective- after harm, to fix problem
Deterrent- visible controls designed to discourage attack
Confidentiality controls - ANSWER -Least privilege- only give access to what is needed to
do job
-Need to Know-restrict access to those who need it
, -Separation of Duties- have critical activities be performed by different people to
decrease conflicts of interest
-encryption- renders data unreadable to those unauthorized
-steganography- conceal a secret message within an ordinary one (code within a
picture)
Integrity Controls - ANSWER Hashing- math functions that Create a small fingerprint of a
message or file
Digital Signature- authentication, integrity, non repudiation
Backups- regular and complete backups can replace lost or changed data
Version control- storing multiple versions of files for frequent and collaborative change
Patch Management - ANSWER the process of regularly applying patches and updates to
software (can't trust people to do on their own)
Compensating Controls - ANSWER control procedures that compensate for the
deficiency in other controls
Events, incidents, alerts - ANSWER Event- meaningful change in the systems state that is
detectable and happened at a specific time
Incident- event that is unexpected, unusual, and poses a threat to the system
Alert- signal that an event is an incident
Event Evaluation - ANSWER True Positive- problem occurred, analysis recognized it
(good)
True negative- event was benign, no alerts (good)
False positive- event was benign, was reported as a problem (bad)
False negative- event was a problem, analysis didn't pick up on it (bad)
