Information Security Terms & Definitions - D430 (Actual Exam) Questions with verified Answers (Latest Update 2026) UPDATE!!-WGU
Call Kai
Learn
Practice Test
Spaced Repetition
Match
Flashcards1/99
There's no tags or description
Looks like no tags are added yet.
Name | Mastery | Learn | Test | Matching | Spaced | Call with Kai |
|---|
No analytics yet
Send a link to your students to track their progress
100 Terms
Which type of system is considered absolutely secure?
A system that is shut off and disconnected from all networks.
3 multiple choice options
Which concept of the CIA Triad is associated with reliability?
Integrity
3 multiple choice options
____________ ensures data has not been tampered with and is correct, authentic, and reliable.
Integrity
3 multiple choice options
A malicious actor has breached the firewall with a reverse shell. Which side of the CIA triad is most affected?
Confidentiality
3 multiple choice options
A reverse shell enables an attacker to gain remote access to and control of a machine by bypassing firewall safeguards.
Confidentiality
3 multiple choice options
A user changes a number in a dataset with a typo. Which side of the CIA triad is most affected?
Integrity
3 multiple choice options
What is an example of identification?
Username
3 multiple choice options
What are three forms of authentication? Choose three answers.
Four-digit pin number; Text of 6-digit number to phone; Fingerprint
3 multiple choice options
What is an example of identification?
Email Address
3 multiple choice options
_________________ is claiming an identity with a unique identifier, such as an email address.
Identification
3 multiple choice options
What is an example of authentication?
Mothers maiden name
3 multiple choice options
"Something You Know"
Authentication
3 multiple choice options
What is the final step in allowing access to resources?
Authorization
3 multiple choice options
Which example demonstrates access control?
Locking and unlocking the doors of your house.
3 multiple choice options
Which type of access control model is a CAPTCHA an example of?
Attribute-based
3 multiple choice options
__________________ access control (ABAC) is, logically, based on attributes.
Attribute-based
3 multiple choice options
What is a sandbox?
An isolated environment that protects a set of resources
3 multiple choice options
A _________________ is an isolated environment that enables users to run programs or open files without affecting the application, system, or platform on which they run.
Sandbox
______________________ access control (MAC) is given based in the level of sensitivity of information.
Mandatory-based
3 multiple choice options
___________________ access control (RBAC) is where permissions are based on someone's role.
Role-based
3 multiple choice options
__________________ access control (DBAC) is where the owner of a file determines who can access it.
Discretionary-based
3 multiple choice options
Which characteristic falls under accountability?
Identity
3 multiple choice options
Which tool is used for vulnerability assessment?
Qualys
3 multiple choice options
Which standards apply to any financial entity policies?
Gramm-Leech-Bliley
3 multiple choice options
What company audits other companies for licensing requirements?
BSA
3 multiple choice options
They are an organization that investigates copyright infringement claims.
BSA
3 multiple choice options
Which term is synonymous with symmetric cryptography?
Secret key cryptography
3 multiple choice options
Which term is synonymous with asymmetric cryptography? It uses private and public key pairs.
Public key cryptography
3 multiple choice options
What are hash functions used for?
Determining whether the message has changed
3 multiple choice options
Which method is used to protect data at rest?
Encryption
3 multiple choice options
_________________ provides confidentiality.
Encryption
3 multiple choice options
Which type of compliance is achieved by law?
Regulatory
3 multiple choice options
________________ is mandated by congress.
Regulatory
3 multiple choice options
Which type of compliance is achieved by stakeholder agreement?
Industry
3 multiple choice options
_______________ agrees to standards but does not make laws or regulations.
Industry
3 multiple choice options
Which two types of compliance are laws? Choose two answers.
Privacy Act; HIPAA
3 multiple choice options
What act deals with the online privacy of minors under 13?
COPPA
3 multiple choice options
Which term refers to the process of gathering and analyzing information to support business decisions?
Competitive Intelligence
3 multiple choice options
What is the correct order of steps in the Operations Security Process?
Identification of critical information; Analysis of threats; Analysis of vulnerabilities; Assessment of risks; Application of countermeasures.
3 multiple choice options
What is one law of operational security?
If you don't know the threat, how do you protect it?
3 multiple choice options
The first law of operations security states.....
"If you don't know the threat, how do you know what to protect?"
What describes vulnerability analysis?
The identification of weaknesses that can be used to cause harm.
3 multiple choice options
What is the weakest link in a security program?
People
3 multiple choice options
Which type of attack is conducted on people to gather information?
Social Engineering
3 multiple choice options
_____________________ is a technique that uses deception to manipulate people into divulging confidential or personal information that may be used for fraudulent purposes.
Social Engineering
3 multiple choice options
___________________ is a malicious practice of manipulating a website user's activity by concealing hyperlinks beneath legitimate clickable content. This attack is not conducted directly against people.
Clickjacking
3 multiple choice options
____________________ is an attack that uses malicious social engineering, such as an email or link that tricks the victim into sending a forged request to a server.
Cross site request forgery (CSRF)
3 multiple choice options
__________________ is an attack carried out by placing code in the form of a scripting language into a website or other type of media. This attack not conducted directly against people.
Cross site scripting (XSS)
3 multiple choice options
Which type of data is collected by law enforcement agents without using technology as its primary tool?
Human intelligence
3 multiple choice options
_____________________ is data gathered by means of interpersonal contact as opposed to more technical intelligence gathering processes.
Human Intelligence (HUMINT)
3 multiple choice options
Which social engineering technique uses electronic communications to carry out an attack that is broad in nature?
Phishing
3 multiple choice options
_________________ is an attack against a company, organization, or person carried out by an electronic means, such as email or text messages, to carry out an attack that is broad in nature.
Phishing
3 multiple choice options
___________________ is where the attacker assumes a guise or fake identity to create a believable scenario that elicits the victim to provide information or perform an action.
Pretexting
3 multiple choice options
_____________________ a type of social engineering attack where a scammer uses a false promise to pique a victim's greed or curiosity to lure a victim into a trap that may steal sensitive information or inflict the system with malware.
Baiting
3 multiple choice options
___________________ is not electronic and takes advantage of a victim's misguided courtesy of leaving the door open.
Tailgating
3 multiple choice options
What is a major category of physical threats?
Gases
3 multiple choice options
Which type of asset control reports undesirable events?
Detective
3 multiple choice options
What are two advantages of flash media over traditional magnetic media?
Speed; Cost
3 multiple choice options
What are two considerations when choosing a location for a data center?
Natural disaster; Stable utilities
3 multiple choice options
What is a protocol for securing communications?
SSH
3 multiple choice options
What is the purpose of Wireshark?
Packet sniffing
3 multiple choice options
What are two advantages of using VPN's (Virtual Private Networks)?
Accessing data on secure network from a remote site.; Sending sensitive traffic over unsecured networks
3 multiple choice options
What are two main methods of an IDS? Choose 2 answers.
Signature-based; Anomaly-based
3 multiple choice options
Which type of intrusion detection system (IDS) is used to analyze activities on the network interface of a particular asset?
Host-based
3 multiple choice options
Which security mechanism hardens operating systems (OS) by limiting user access to the minimum permissions needed to carry out tasks?
Apply the principle of least privilege
3 multiple choice options
Which tool is used for port scanning and to discover devices on a network?
Nmap
3 multiple choice options
__________ is used for port scanning, discovering devices, and searching for hosts on a network. It is an important tool to help identify and remove unessential services when hardening an operating system.
Nmap
3 multiple choice options
What is reduced by hardening an operating system?
The attack surface
3 multiple choice options
Hardening the operating system is a way to mitigate various threats and vulnerabilities, thus, reducing ____________________________.
The attack surface
3 multiple choice options
What is used to prevent buffer overflow?
Bounds checking
3 multiple choice options
__________________ sets a limit on the amount of data an application takes in.
Bounds checking
3 multiple choice options
_____________________ is a type of attack where more data is entered into an application from a particular input than expected.
Buffer overflow
3 multiple choice options
_____________________ occurs when input is checked for accuracy and validity.
Input validation
3 multiple choice options
Which type of vulnerability is present when multiple threads within a process control access to a particular resource?
Race condition
3 multiple choice options
___________________ is a security risk in places where data might be exposed, such as free wireless internet networks.
Wireless exposure
3 multiple choice options
A ________________________ occurs when multiple threads within a process control access to a particular resource and the correct handling depends on timing or transactions.
Race condition
3 multiple choice options
__________________ is an attack that uses SQL code for backend database manipulation to access information.
SQL injection
3 multiple choice options
__________________ is an attack that routes DNS requests to the attacker's server, providing attackers a covert command and control channel, and data exfiltration path.
DNS tunneling
3 multiple choice options
Which type of attack occurs when certain print functions within a programming language are used to manipulate and view the internal memory of an application?
Format string
3 multiple choice options
_________________________ is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website.
Cross-site scripting
3 multiple choice options
A ____________ attack is a type of authentication attack that occurs when a program is implemented to automate the process of guessing valid usernames and password combinations.
Brute force
3 multiple choice options
_____________________ attacks occur when homegrown algorithms are used as cryptographic controls or when application keys are not changed, as these practices result in exposing our systems to attackers.
Cryptographic
3 multiple choice options
Which type of attack is an example of an input validation attack?
Format string
3 multiple choice options
An organization is seeking to implement a solution that unifies control of all devices from a central location. Which solution should the organization implement?
Mobile device management (MDM)
3 multiple choice options
An _____________________ refers to any system that controls in industrial process and is commonly embedded in devices.
Industrial control system
3 multiple choice options
A __________________________ solution refers to a set of tools and features that allow an organization to centrally manage its devices under a single system. P 155
Mobile device management (MDM)
3 multiple choice options
_____________________ refers to a computer contained inside another device that typically performs a single function.
Embedded security
3 multiple choice options
A __________________ is an underlying system that runs on its own processor and generally handle's the devices' hardware. P 156
Baseband OS
3 multiple choice options
What should a company do to prevent jailbreaking on a mobile device?
Attach an external management solution
3 multiple choice options
_____________________________________________ to a mobile device can stop jailbreaking, as it installs its own apps to provide additional security layers on the device.
Attaching an external management solution
3 multiple choice options
While ________________________ can make it easier for an organization to centrally manage devices, it will not prevent jailbreaking.
Disabling personal email
3 multiple choice options
While _________________________ apps on a mobile device can make it easier for an organization to centrally manage devices, it will not prevent jailbreaking.
Disabling file sharing
3 multiple choice options
While ____________________ frequent updates will provide protection on a mobile device, hackers can still find a way to jailbreak the device.
Installing updates
3 multiple choice options
Which assessment tool scans for vulnerabilities on a host?
Nessus
3 multiple choice options
What describes an authorized attempt to gain unauthorized access to a computer system or network?
Ethical hacking
3 multiple choice options
The practice of covertly discovering and collecting information about a system.
Reconnaissance
3 multiple choice options
________________ is part of the process for pen testing that deals with what will be tested.
Scoping
3 multiple choice options
A __________________________ is a systematic review of security weaknesses in an information system.
Vulnerability assessment
3 multiple choice options
A _______________ pen test is a type of pen test that tests a system using a combination of black and white testing.
Gray box
2 multiple choice options
A ________________ pen test is a type of pen test that tests a system with no prior knowledge of its internal workings.
Black box
2 multiple choice options