1 Network Security Foundations and Threats Free Online FlashCards

What are the three goals of the CIA triad?

Confidentiality limits information to authorized users; integrity protects accuracy from unauthorized change; availability keeps systems and information accessible when needed.

How does a threat differ from a vulnerability?

A threat is a potential cause of harm; a vulnerability is a weakness that could be exploited or accidentally triggered.

What does a threat model identify?

A threat model identifies assets, actors and events, entry points and trust boundaries, weaknesses and consequences, and suitable controls.

How do authentication and authorization differ?

Authentication checks a claimed identity; authorization determines what that identity is allowed to do.

How can network segmentation limit a breach?

Segmentation divides a network into zones and controls traffic between them, limiting unnecessary paths and helping contain a breach.

What is the goal of a denial-of-service attack?

A denial-of-service attack overwhelms a service or its network capacity, making it unavailable to legitimate users.

Why should organizations test their backups?

Protected backups and tested recovery plans help restore systems and data after disruption or loss.

How should an employee handle an unexpected invoice link requesting sign-in?

Avoid the link, verify the request through a known channel, and report the message.

What does security risk combine?

Risk combines the chance of an event with its possible impact.

What makes authentication multifactor?

Multifactor authentication uses two or more different factor types: something known, something possessed, or something inherent to the person.

What does the principle of least privilege require?

Least privilege gives each user or service only the permissions needed for its task and removes permissions when they are no longer required.

What assumption does a zero-trust approach reject?

Zero trust does not assume a user or device is trustworthy because it is inside the corporate network; access decisions verify identity and authorization for the requested resource.