Cybersecurity Fundamentals & Concepts Flashcards

What is 'social engineering' in the context of cybersecurity?

Answer: Manipulating people into divulging confidential information or performing actions

Social engineering exploits human psychology rather than technical vulnerabilities to gain unauthorized access or information.

Which control type is a security awareness training program?

Answer: Administrative control

Administrative controls are policies, procedures, and training programs that govern how people behave and manage security.

What does the term 'attack surface' refer to?

Answer: All the points where an attacker could try to enter or extract data from an environment

The attack surface encompasses all the different points of entry an attacker could exploit to compromise a system or network.

A user receives an email appearing to be from their bank asking them to click a link and enter credentials. This is an example of:

Answer: Phishing

Phishing is a broad social engineering attack using fraudulent emails to trick users into revealing sensitive information.

What is the purpose of network segmentation in cybersecurity?

Answer: To divide a network into zones to contain breaches and limit lateral movement

Network segmentation creates isolated zones so that if one segment is compromised, an attacker cannot freely move to other parts of the network.

Which term describes the practice of testing an application by sending unexpected, random, or malformed inputs?

Answer: Fuzzing

Fuzzing (fuzz testing) involves injecting invalid or unexpected data into a program to discover bugs, crashes, or security vulnerabilities.

What is the CIA Triad's relevance when classifying a DDoS attack?

Answer: It primarily affects Availability

A DDoS (Distributed Denial of Service) attack overwhelms systems to make services unavailable, directly targeting the Availability pillar of the CIA Triad.