Question 1

Cybersecurity

Accepted Answer

Protection of networked
systems and data from unauthorized use or
harm.

Question 2

Spyware

Accepted Answer

Malware designed to track and spy
on the user without their knowledge.

Question 3

Buffer Overflow

Accepted Answer

A type of security
vulnerability where data is written beyond the
limits of a buffer

Question 4

Phishing

Accepted Answer

A type of cyberattack where a
malicious party sends fraudulent emails
disguised as being from a legitimate source.

Question 5

Rootkit

Accepted Answer

Malware that modifies the operating
system to create a backdoor.

Question 6

Ransomware

Accepted Answer

Malware that holds a
computer system or data captive until a
ransom is paid.

Question 7

Black Hat

Accepted Answer

Hackers who exploit
vulnerabilities for illegal, personal, financial,
or political gain.

Question 8

Social Engineering

Accepted Answer

Manipulation of
individuals into performing actions or
divulging confidential information.

Question 9

Brute-force attacks

Accepted Answer

An attack method
where the attacker tries numerous possible
passwords or encryption keys.

Question 10

SYNful Knock

Accepted Answer

A vulnerability in Cisco IOS
that allows attackers to gain control of
routers.

Question 11

Offline Identity

Accepted Answer

Your identity that interacts
on a regular basis at home, school, or work.

Question 12

Online Identity

Accepted Answer

Your identity while you are in
cyberspace, which should only reveal a
limited amount of information about you.

Question 13

EHR (Electronic Health Records)

Accepted Answer

Physical,
mental, and other personal information
stored electronically

Question 14

Man-in-the-Middle

Accepted Answer

An attack where the
attacker secretly intercepts and possibly
alters the communication between two
parties.

Question 15

Adware

Accepted Answer

Software that automatically
displays or downloads advertising material
when a user is online.

Question 16

Gray Hat

Accepted Answer

Hackers who may violate laws or
ethical standards but do not have the
malicious intent of black hats

Question 17

Script Kiddies

Accepted Answer

Inexperienced hackers who
use existing computer scripts or code to hack
into computers.

Question 18

Scareware

Accepted Answer

Malware designed to scare users
into buying unnecessary software or providing
personal information.

Question 19

Authentication

Accepted Answer

The process of verifying the
identity of a user or device.

Question 20

Race Condition

Accepted Answer

A security vulnerability
caused by improperly ordered or timed
events.

Question 21

Confidentiality

Accepted Answer

Ensuring that information is
accessible only to those authorized to have
access.

Question 22

Trojan Horse

Accepted Answer

Malware that misleads users
of its true intent by disguising itself as a
legitimate program.

Question 23

Project Zero

Accepted Answer

An initiative by Google aimed
at finding software vulnerabilities.

Question 24

Rowhammer

Accepted Answer

A hardware vulnerability in
DRAM where repeated access to a row of
memory can cause bit flips in adjacent rows.

Question 25

Firewall and Antivirus

Accepted Answer

Always keep your firewall active and use reputable antivirus software.

Question 26

Unique Passwords

Accepted Answer

Use unique, complex passwords or passphrases for each account.

Question 27

Encryption

Accepted Answer

Encrypt sensitive data to protect it from unauthorized access.

Question 28

Backup

Accepted Answer

Regularly back up your data to prevent loss.

Question 29

Privacy

Accepted Answer

Be cautious about the information shared on social media and use private browsing modes.

Question 30

Two-Factor Authentication

Accepted Answer

Use two-factor authentication for added security.

Question 31

Organizational Security

Accepted Answer

Implement comprehensive security policies, conduct regular employee training, and ensure both digital and physical security measures are in place.

Question 32

Overview of Protecting Your Data - Protecting Devices from Threats

Accepted Answer

Keep your firewall on to prevent unauthorized access.

Use antivirus and antispyware software; download only from trusted websites.

Regularly update your operating system and browser.

Question 33

Overview of Protecting Your Data - Managing Operating Systems and Browsers

Accepted Answer

Set security settings to medium or higher.

Install the latest patches and security updates.

Question 34

Using Wireless Networks Safely - Home Wireless Network

Accepted Answer

Change default SSID and administrative password.

Disable SSID broadcast and use WPA2 encryption.

Be aware of WPA2 protocol security flaws (e.g., KRACK attack).

Question 35

Using Wireless Networks Safely - Public Wi-Fi Hotspots

Accepted Answer

Avoid sending sensitive information.

Use a VPN to prevent eavesdropping.

Turn off Bluetooth when not in use.

Question 36

Passwords and Passphrases - Passwords and Passphrases

Accepted Answer

Avoid dictionary words, names, and common misspellings.

Use special characters and a minimum of ten characters.

Use password managers for convenience.

Question 37

Passwords and Passphrases - Passphrases

Accepted Answer

Create meaningful statements with special characters.

Follow NIST guidelines: minimum 8 characters, no common 

passwords, allow all characters, and no password hints.

Question 38

Data Maintenance - Encrypting Your Data

Accepted Answer

Use encryption to protect data from unauthorized access.

Understand encryption as converting information into an unreadable format without a key.

Question 39

Data Maintenance - Backing Up Your Data

Accepted Answer

Regularly and automatically back up data.

Use local backups (e.g., NAS, external hard drives) or cloud storage services.

Question 40

Data Maintenance - Deleting Data Permanently

Accepted Answer

Use tools to delete data securely.

Destroy storage devices to ensure data is unrecoverable.

Question 41

Safeguarding Online Privacy - Strong Authentication

Accepted Answer

Implement two-factor authentication using physical objects or biometric scans.

Utilize OAuth 2.0 for secure access to third-party applications without exposing passwords.

Question 42

Safeguarding Online Privacy - Sharing Information on Social Media

Accepted Answer

Minimize sharing personal information (e.g., birth date, email, phone number).

Regularly check and adjust social media privacy settings.

Question 43

Safeguarding Online Privacy - Email and Web Browser Privacy

Accepted Answer

Understand email is not secure and can be read by multiple parties.

Use private browsing modes to protect online activities.

Question 44

Overview of Organizational Protection - Security Policies and Procedures

Accepted Answer

Develop and enforce comprehensive security policies.

Ensure employees are trained on security protocols and procedures.

Question 45

Overview of Organizational Protection - Incident Response

Accepted Answer

Establish an incident response plan to handle security breaches.

Regularly test and update the response plan.

Question 46

Network Security - Network Segmentation

Accepted Answer

Use network segmentation to isolate sensitive data and systems.

Implement firewalls and intrusion detection/prevention systems (IDS/IPS).

Question 47

Network Security - Secure Access Controls

Accepted Answer

Employ role-based access control (RBAC) to restrict access based on job roles.

Use multi-factor authentication (MFA) for accessing critical systems.

Question 48

Data Protection and Privacy - Data Encryption and Masking

Accepted Answer

Encrypt sensitive data both in transit and at rest.

Use data masking to protect sensitive information in non production environments.

Question 49

Data Protection and Privacy - Data Loss Prevention (DLP)

Accepted Answer

Implement DLP solutions to monitor and protect data from unauthorized access or leaks.

Educate employees on data handling and protection best practices.

Question 50

Physical Security - Secure Facilities

Accepted Answer

Control physical access to sensitive areas with security measures (e.g., badges, biometrics).

Monitor and log access to facilities.

Question 51

Physical Security - Equipment Protection

Accepted Answer

Secure hardware and networking equipment against theft and tampering.

Regularly inspect and maintain physical security controls.

Question 52

Employee Training and Awareness - Regular Training Programs

Accepted Answer

Conduct ongoing cybersecurity training for all employees.

Simulate phishing attacks to raise awareness and improve response.

Question 53

Employee Training and Awareness - Creating a Security Culture

Accepted Answer

Foster a culture of security within the organization.

Encourage employees to report suspicious activities and potential security threats.

Question 54

Responsibility and Ethics

Accepted Answer

Emphasize the importance of being both legally compliant and ethically sound in all professional activities.

Question 55

Consultation and Compliance

Accepted Answer

Highlight the need for consulting legal departments and adhering to corporate codes of ethics.

Question 56

Career Paths

Accepted Answer

Provide an overview of the various job roles and the importance of each in maintaining cybersecurity.

Question 57

Global Impact

Accepted Answer

Stress the significance of international cooperation in combating cyber threats.

Question 58

Responsibility

Accepted Answer

Cybersecurity professionals must use their skills responsibly to avoid legal repercussions.

Question 59

Compliance

Accepted Answer

Companies must adhere to cybersecurity laws and regulations.

Question 60

Consequences

Accepted Answer

Violations can result in job loss and legal penalties for both individuals and companies.

Question 61

Legal Consultation

Accepted Answer

When in doubt, always consult the legal department to ensure compliance.

Question 62

IMPACT

Accepted Answer

A global partnership involving governments, industries, and academia aimed at improving global cybersecurity capabilities.

Question 63

Legal vs. Ethical

Accepted Answer

Actions can be legal but still unethical. Cybersecurity professionals must adhere to a higher standard of ethics.

Question 64

Codes of Ethics

Accepted Answer

Many organizations have codes of ethics that guide professional behavior.

INFSEC FINALS

REVIEWER

Term	Definition
Cybersecurity	Protection of networked systems and data from unauthorized use or harm.
Spyware	Malware designed to track and spy on the user without their knowledge.
Buffer Overflow	A type of security vulnerability where data is written beyond the limits of a buffer
Phishing	A type of cyberattack where a malicious party sends fraudulent emails disguised as being from a legitimate source.
Rootkit	Malware that modifies the operating system to create a backdoor.
Ransomware	Malware that holds a computer system or data captive until a ransom is paid.
Black Hat	Hackers who exploit vulnerabilities for illegal, personal, financial, or political gain.
Social Engineering	Manipulation of individuals into performing actions or divulging confidential information.
Brute-force attacks	An attack method where the attacker tries numerous possible passwords or encryption keys.
SYNful Knock	A vulnerability in Cisco IOS that allows attackers to gain control of routers.
Offline Identity	Your identity that interacts on a regular basis at home, school, or work.
Online Identity	Your identity while you are in cyberspace, which should only reveal a limited amount of information about you.
EHR (Electronic Health Records)	Physical, mental, and other personal information stored electronically
Man-in-the-Middle	An attack where the attacker secretly intercepts and possibly alters the communication between two parties.
Adware	Software that automatically displays or downloads advertising material when a user is online.
Gray Hat	Hackers who may violate laws or ethical standards but do not have the malicious intent of black hats
Script Kiddies	Inexperienced hackers who use existing computer scripts or code to hack into computers.
Scareware	Malware designed to scare users into buying unnecessary software or providing personal information.
Authentication	The process of verifying the identity of a user or device.
Race Condition	A security vulnerability caused by improperly ordered or timed events.
Confidentiality	Ensuring that information is accessible only to those authorized to have access.
Trojan Horse	Malware that misleads users of its true intent by disguising itself as a legitimate program.
Project Zero	An initiative by Google aimed at finding software vulnerabilities.
Rowhammer	A hardware vulnerability in DRAM where repeated access to a row of memory can cause bit flips in adjacent rows.
Firewall and Antivirus	Always keep your firewall active and use reputable antivirus software.
Unique Passwords	Use unique, complex passwords or passphrases for each account.
Encryption	Encrypt sensitive data to protect it from unauthorized access.
Backup	Regularly back up your data to prevent loss.
Privacy	Be cautious about the information shared on social media and use private browsing modes.
Two-Factor Authentication	Use two-factor authentication for added security.
Organizational Security	Implement comprehensive security policies, conduct regular employee training, and ensure both digital and physical security measures are in place.
Overview of Protecting Your Data - Protecting Devices from Threats	Keep your firewall on to prevent unauthorized access. Use antivirus and antispyware software; download only from trusted websites. Regularly update your operating system and browser.
Overview of Protecting Your Data - Managing Operating Systems and Browsers	Set security settings to medium or higher. Install the latest patches and security updates.
Using Wireless Networks Safely - Home Wireless Network	Change default SSID and administrative password. Disable SSID broadcast and use WPA2 encryption. Be aware of WPA2 protocol security flaws (e.g., KRACK attack).
Using Wireless Networks Safely - Public Wi-Fi Hotspots	Avoid sending sensitive information. Use a VPN to prevent eavesdropping. Turn off Bluetooth when not in use.
Passwords and Passphrases - Passwords and Passphrases	Avoid dictionary words, names, and common misspellings. Use special characters and a minimum of ten characters. Use password managers for convenience.
Passwords and Passphrases - Passphrases	Create meaningful statements with special characters. Follow NIST guidelines: minimum 8 characters, no common passwords, allow all characters, and no password hints.
Data Maintenance - Encrypting Your Data	Use encryption to protect data from unauthorized access. Understand encryption as converting information into an unreadable format without a key.
Data Maintenance - Backing Up Your Data	Regularly and automatically back up data. Use local backups (e.g., NAS, external hard drives) or cloud storage services.
Data Maintenance - Deleting Data Permanently	Use tools to delete data securely. Destroy storage devices to ensure data is unrecoverable.
Safeguarding Online Privacy - Strong Authentication	Implement two-factor authentication using physical objects or biometric scans. Utilize OAuth 2.0 for secure access to third-party applications without exposing passwords.
Safeguarding Online Privacy - Sharing Information on Social Media	Minimize sharing personal information (e.g., birth date, email, phone number). Regularly check and adjust social media privacy settings.
Safeguarding Online Privacy - Email and Web Browser Privacy	Understand email is not secure and can be read by multiple parties. Use private browsing modes to protect online activities.
Overview of Organizational Protection - Security Policies and Procedures	Develop and enforce comprehensive security policies. Ensure employees are trained on security protocols and procedures.
Overview of Organizational Protection - Incident Response	Establish an incident response plan to handle security breaches. Regularly test and update the response plan.
Network Security - Network Segmentation	Use network segmentation to isolate sensitive data and systems. Implement firewalls and intrusion detection/prevention systems (IDS/IPS).
Network Security - Secure Access Controls	Employ role-based access control (RBAC) to restrict access based on job roles. Use multi-factor authentication (MFA) for accessing critical systems.
Data Protection and Privacy - Data Encryption and Masking	Encrypt sensitive data both in transit and at rest. Use data masking to protect sensitive information in non production environments.
Data Protection and Privacy - Data Loss Prevention (DLP)	Implement DLP solutions to monitor and protect data from unauthorized access or leaks. Educate employees on data handling and protection best practices.
Physical Security - Secure Facilities	Control physical access to sensitive areas with security measures (e.g., badges, biometrics). Monitor and log access to facilities.
Physical Security - Equipment Protection	Secure hardware and networking equipment against theft and tampering. Regularly inspect and maintain physical security controls.
Employee Training and Awareness - Regular Training Programs	Conduct ongoing cybersecurity training for all employees. Simulate phishing attacks to raise awareness and improve response.
Employee Training and Awareness - Creating a Security Culture	Foster a culture of security within the organization. Encourage employees to report suspicious activities and potential security threats.
Responsibility and Ethics	Emphasize the importance of being both legally compliant and ethically sound in all professional activities.
Consultation and Compliance	Highlight the need for consulting legal departments and adhering to corporate codes of ethics.
Career Paths	Provide an overview of the various job roles and the importance of each in maintaining cybersecurity.
Global Impact	Stress the significance of international cooperation in combating cyber threats.
Responsibility	Cybersecurity professionals must use their skills responsibly to avoid legal repercussions.
Compliance	Companies must adhere to cybersecurity laws and regulations.
Consequences	Violations can result in job loss and legal penalties for both individuals and companies.
Legal Consultation	When in doubt, always consult the legal department to ensure compliance.
IMPACT	A global partnership involving governments, industries, and academia aimed at improving global cybersecurity capabilities.
Legal vs. Ethical	Actions can be legal but still unethical. Cybersecurity professionals must adhere to a higher standard of ethics.
Codes of Ethics	Many organizations have codes of ethics that guide professional behavior.
Enforcement	Sometimes these codes are supported by laws.
Organizations with Published Codes of Ethics	The CyberSecurity Institute (CSI) The Information Systems Security Association (ISSA) The Association of Information Technology Professionals (AITP)
Job Search Engines	TJobMatch, Monster, CareerBuilder
Types of Jobs - Penetration Tester/Ethical Hacker	Tests systems for vulnerabilities.
Types of Jobs - Security Administrator	Manages and secures network systems.
Types of Jobs - Network Administrator	Oversees network operations and security.
Types of Jobs - System Administrator	Maintains and secures computer systems.

"Know" box contains:
Time elapsed:
Retries: