5.1 Security+ Knowledge Assessment Flashcard

Front

Which access control model is based on the concept of least privilege and separation of duties? Options: Discretionary Access Control (DAC), Role-Based Access Control (RBAC), Mandatory Access Control (MAC), Attribute-Based Access Control (ABAC)

Back

Role-Based Access Control (RBAC)

Answer explanation

Role-Based Access Control (RBAC) is designed around the principles of least privilege and separation of duties, ensuring users have only the access necessary for their roles, thus enhancing security.

Front

Which network security protocol is primarily used to secure web traffic over the Internet?

Back

HTTPS

Answer explanation

HTTPS (Hypertext Transfer Protocol Secure) is the protocol used to secure web traffic over the Internet by encrypting data between the user's browser and the web server, ensuring privacy and data integrity.

Front

During which phase of the incident response process is evidence collected and preserved? Options: Preparation, Detection and Analysis, Containment, Eradication, and Recovery, Post-Incident Activity

Back

Containment, Eradication, and Recovery

Answer explanation

During the Containment, Eradication, and Recovery phase, evidence is collected and preserved to understand the incident and prevent future occurrences. This is crucial for effective incident response.

Front

Which of the following is a qualitative risk management strategy? Risk Avoidance, Risk Quantification, Risk Mitigation, Risk Transfer

Back

Risk Avoidance

Answer explanation

Risk Avoidance is a qualitative risk management strategy that involves eliminating the risk entirely, rather than trying to manage or transfer it. The other options focus on quantifying or mitigating risks, which are not qualitative.

Front

Which encryption technique uses two different keys for encryption and decryption?

Back

Asymmetric Encryption

Answer explanation

Asymmetric Encryption uses two different keys: a public key for encryption and a private key for decryption. This contrasts with Symmetric Encryption, which uses the same key for both processes.

Front

Which of the following is an example of a security policy? Firewall Configuration, Password Policy, Network Topology, Data Backup Schedule

Back

Password Policy

Answer explanation

A Password Policy is a security policy that defines rules for creating and managing passwords, ensuring security. In contrast, Firewall Configuration, Network Topology, and Data Backup Schedule are not classified as security policies.

Front

In the context of access control models, what does the principle of "separation of duties" aim to prevent?

Back

Conflict of interest

Answer explanation

The principle of 'separation of duties' aims to prevent conflict of interest by ensuring that no single individual has control over all aspects of a transaction, thereby reducing the risk of fraud and errors.

Front

Which protocol is used to encrypt email messages?

Back

S/MIME

Answer explanation

S/MIME (Secure/Multipurpose Internet Mail Extensions) is the protocol specifically designed for encrypting and signing email messages, ensuring confidentiality and authenticity. The other options (IMAP, POP3, SMTP) are not used for encryption.

Front

What is the primary goal of the incident response phase known as "Detection and Analysis"?

Back

To identify and understand the incident

Answer explanation

The primary goal of the "Detection and Analysis" phase is to identify and understand the incident. This involves gathering information to assess the nature and impact of the incident before taking further action.

Front

Which risk management strategy involves sharing the risk with another party?

Back

Risk Transfer

Answer explanation

The correct answer is Risk Transfer, which involves sharing the risk with another party, often through contracts or insurance. This strategy allows one party to manage potential losses by transferring the risk to another.