CIW Security Analyst Flashcards

What is SQL injection?

Answer: An attack that inserts malicious SQL code into input fields to manipulate a database

SQL injection exploits insufficient input validation by inserting malicious SQL statements into fields, potentially exposing or corrupting database data.

What does XSS (Cross-Site Scripting) allow an attacker to do?

Answer: Inject malicious scripts into web pages viewed by other users

XSS attacks inject client-side scripts into pages viewed by other users, potentially stealing session cookies or redirecting users.

What is a VPN (Virtual Private Network) used for?

Answer: Create an encrypted tunnel over the internet to secure data transmission and mask IP addresses

A VPN encrypts internet traffic and routes it through a secure server, protecting privacy and securing data on public networks.

What is the principle of least privilege in security?

Answer: Grant users only the minimum permissions necessary to perform their job functions

The principle of least privilege limits user and system access rights to the bare minimum needed, reducing the attack surface and damage from breaches.

What is multi-factor authentication (MFA)?

Answer: Requiring two or more verification factors (something you know, have, or are) to authenticate

MFA requires at least two independent authentication factors — such as a password plus a one-time code — dramatically reducing account compromise risk.

What is a brute-force attack in the context of cybersecurity?

Answer: Systematically trying all possible password combinations until the correct one is found

A brute-force attack methodically attempts every possible combination of credentials to gain unauthorized access to an account or system.