Information Security Fundamentals Flashcards
6 cards from real SFPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Information Security Fundamentals flashcards as text
What is 'vulnerability management' in information security?
Answer: A systematic process for identifying, evaluating, treating, and reporting security vulnerabilities
Vulnerability management is the ongoing process of identifying, classifying, prioritizing, remediating, and mitigating security vulnerabilities in systems and software.
What is 'encryption' and why is it important in information security?
Answer: The process of converting data into a coded form that can only be read by authorized parties with the decryption key
Encryption converts data into an unreadable format that can only be decoded with the correct key, protecting data confidentiality both in transit and at rest.
What is 'security information and event management' (SIEM)?
Answer: A system that collects and analyzes security events from across an organization to identify threats
SIEM systems collect and correlate security events and logs from across an organization's IT infrastructure to provide real-time threat detection and compliance reporting.
What is the principle of 'least privilege' in information security?
Answer: Granting users and systems only the minimum permissions necessary to perform their required functions
The principle of least privilege limits user and system permissions to only what is necessary for their specific job functions, reducing the potential damage from account compromise or insider threats.
What is 'patch management' in information security?
Answer: The process of acquiring, testing, and deploying software updates to fix vulnerabilities and improve functionality
Patch management is the systematic process of keeping software up to date by applying vendor-released updates that fix security vulnerabilities and improve functionality.
What is a 'zero-day vulnerability'?
Answer: A software vulnerability that is unknown to the vendor and for which no patch exists yet
A zero-day vulnerability is a previously unknown security flaw in software that the vendor has not yet been notified about or had time to fix, leaving systems exposed until a patch is developed.