Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP 2021 Random > All domains > Flashcards

All domains Flashcards

1
Q

Kerckhoff’s principle

A

Crypto system must be secure even if crypto algorithm is public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which crypto principles does IPSEC provide?

A

Confidentiality
Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In what state does a processor’s scheduler place a process when it is prepared to execute but the CPU is not currently available?

A

Ready state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Processor Running State

A

Process is executing on the CPU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Process: Waiting State

A

Process is blocked waiting for an external event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Process: Ready State

A

Process is prepared to execute but the CPU is not available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Process: Stopped state

A

Used when a process terminates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Maintenance hook

A

Backdoor created by developers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Substitution cipher examples

A

AES, 3DES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Transposition cipher

A

One for one replacement of letters. Defeated by frequency analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Data custodian

A

Implements security controls defined by policy and mgmt. Authority delegated from data owner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data custodian responsibilities

A

Validating data integrity
Testing backups
Implementing controls defined by policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Data Purging

A

Removing data so it cannot be reconstructed. Ex. DBAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Device sanitization

A

All of the processes used to remove data.
“Defensible Destruction”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

4 Goals of Crypto

A

CAIN
Confidentiality
Authentication
Integrity
Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

C
A
I
N

A

Confidentiality
Authentication
Integrity
Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which backup type does not clear the archive bit?

A

Differential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Incremental backup

A

Backs up all data since previous backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Differential backup

A

Backs up all data that changed since last full backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which backup type uses fewer tapes to restore?

A

Differential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which backup type uses more tapes to restore?

A

Incremental

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which backup type is faster to restore?

A

Differential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Opposite of CIA

A

DAD
Disclosure
Alteration
Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which law protects trade secrets?

A

Economic Espionage Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Covert timing attack

A

Modulating some aspect of system behavior over time.
Inference attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Confinement aka…

A

Sandbox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Data steward

A

Ensures governance/compliance.
Manages data from business perspective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Audits provide…

A

Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Due Diligence

A

Assurance we’re doing the right thing.
Evidence that due care is working.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Due care

A

Doing the right thing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Intangible asset valuation aka…

A

Intellectual property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Copyright length for software

A

95 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Copyright length for creative expressions

A

70 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Wassenaar Agreement

A

Covers weapons or dual use technologies (high encryption, VPN, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

OECD

A

Oversees financial cooperation between nations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

ISC Code of ethics (4)

A
  1. Protect society
    2 Act legally
  2. Provide competent service
  3. Advance the profession
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

SPML purpose

A

Provides service, user, and resource provisioning between organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which is an OASIS standard markup language?

A

SPML

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

SAML purpose

A

Exchange authentication and authorization data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

XACML purpose

A

Describe access controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What do digital signatures provide TLS?

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Acceptable humidity levels

A

40%-60%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What type of packet does ping flood use?

A

ICMP echo request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

RESTful, JSON-based authentication protocol

A

OpenID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which two protocols are paired to provide identity verification and basic profile information?

A

OpenID
OAuth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Most effective defense against XSS attacks?

A

Input validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What does an incipient fire detection system use to identify fires?

A

Air ionization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

In what stage of the ISC2 incident response process does remediation occur?

A

Remediation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Take-grant security model

A

Used to assign-revoke rights.

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

In what phase of the IR process are processes analyzed for potential improvements?

A

Lessons learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Misuse case testing

A

Testing how a system can be misused

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Can serial data over TCP/IP be encrypted?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Fagan

A

Highly structured code inspections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Pair programming

A

Two developers. One writes code while both discuss the coding process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Which has higher availability? Cloud or Hybrid cloud?

A

Hybrid Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

SMURF attack traffic type

A

ICMP echo replies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What can be used to prevent DOS attacks?

A

Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What do PPTP and L2F have in common?

A

They are IP protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Protocol for non-IP based VPN’s

A

L2TP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Civilian classification levels (3)

A

Confidential/Proprietary
Private
Sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What testing methods are used in static analysis?

A

Walkthroughs
Sanity checks
Syntax checks
Logical code reviews

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

vlan hopping attack

A

Jumping vlans via the trunk by double tagging 802.1q frames

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

IR Phases (7)

A

Detection
Response
Mitigation
Reporting
Recovery
Remediation
Lessons Learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What are code words for?

A

Shorten, hide, or clarify a message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Characteristic of circuit switched networks

A

Dedicated between two endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Cell switched network example

A

ATM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

TGS: Ticket Granting Service

A

Receives TGT. Validates TGT and user rights. Then issues a ticket and session keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Difference between sampling and clipping in log review.

A

Sampling uses statistical techniques.
Clipping uses thresholds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Cognitive passwords

A

Passwords that are answers to a series of questions

70
Q

Multistate systems

A

Handle data from different security classifications

71
Q

Incremental backup backs up…

A

Files changed since last backup

72
Q

Identity as a service

A

Third party identity service

73
Q

OpenID vs. OAuth

A

OpenID: Authentication
OAuth: Authorization

74
Q

Netflow records

A

Contain every network communication session

75
Q

What does IDS record?

A

Detections

76
Q

What two logical network topologies can be physically implemented as a star topology?

A

Bus
Ring

77
Q

Preaction steps

A

Fill with water when fire is detected
Dispense water when heat sensors trigger

78
Q

What does ESP encrypt?

A

IP packet data, but not the header

79
Q

Exposure factor is…

A

Percentage of asset loss

80
Q

Exposure factor calculation

A

SLE x Asset Value=Exposure Factor

81
Q

ARO less than one

A

Percentage less than 1. 1 represents 100%.

82
Q

ALE calculation

A

SLE * ARO = ALE

83
Q

First step in the User provisioning process…

A

Enrollment (registration)

84
Q

Which security framework is an “appraisal”

A

CMMI

85
Q

Clark-Wilson goal

A

Prevent fraud

86
Q

Security model that uses transformation procedures and integrity verification procedures

A

Clark-Wilson

87
Q

Security model that uses access-control triple

A

Clark-Wilson

88
Q

Brewer-Nash Confidentiality model purpose

A

Conflicts of Interest
Separation of Duties

89
Q

Lipner model

A

Bell & Biba combined

90
Q

Bell LaPadula

A

Write Up, Read Down
Confidentiality

91
Q

Protection Profile

A

Common Criteria Term

92
Q

Evaluation Assurance Level

A

Common Criteria Term

93
Q

Target of Evaluation

A

Common Criteria Term

94
Q

Security Target

A

Common Criteria Term

95
Q

Security kernel protects…

A

The TCB

96
Q

Stream cipher

A

Encrypts data-in-transit

97
Q

Block ciphers encrypt…

A

Data in transit and data at rest

98
Q

What type of encryption upholds all 4 goals of crypto?

A

Assymetric

99
Q

IAAA Order

A

Identify
Authenticate
Authorize

Auditing (always happens)

100
Q

AAA
EAP
PKI
Enterprise

Are all characteristics of…

A

802.1x

101
Q

How many ISAKMP SA’s are created per protocol per connection?

A

2 (Initiator and responder)

Total 4 for ESP and AH

102
Q

Product certification requirements

A

Tested by certification authority
Proven to fit security requirements of product owner

103
Q

Product accredited

A

Data owner has chosen to implement system, even if there are vulnerabilities and risks.

104
Q

Obfuscation type that makes code obscure to computer

A

Prevention obfuscation

105
Q

Junk Bytes
Converting branches to jsr instructions
Combining try blocks with catch blocks

A

Prevention obfuscation techniques

106
Q

Lexical obfuscation

A

Renaming classes, fields, and methods with new identifiers that lack intuitive meaning

107
Q

Control flow obfuscation

A

Making the application harder to understand/decompile

108
Q

Separating related structures and operations
Grouping unrelated structures and operations
Inserting unused or irrelevant code
Parallel code

A

Control flow obfuscation techniques

109
Q

Variable modification
Array splitting
Bit shifting

A

Data obfuscation techniques

110
Q

What type of BC/DR plan includes checklists?

A

DRP`

111
Q

MTD

A

Maximum tolerable downtime

112
Q

Circuit-level proxy firewall OSI Layer

A

Layer 5

113
Q

Packet filter firewall OSI Layer

A

Layer 3 and Layer 4

114
Q

ALE Caluclation

A

SLE x ARO

115
Q

Who receives BCP training?

A

Everyone

116
Q

Best method to sanitize SSD’s

A

Destruction

117
Q

What is a concern with degausing?

A

Data remanence

118
Q

zzuf

A

Fuzzer

119
Q

Nikto

A

Web server scanner

120
Q

Identification

A

Claiming an identity

121
Q

802.1g Ad-hoc mode

A

P2P. Directly connects two clients (not through a AP)

122
Q

Wireless stand-alone mode

A

Wireless network not connected to wired network.

123
Q

Wireless Infrastructure mode

A

Connect endpoints to a central network. (Normal home wireless setup)

124
Q

Wired extension mode

A

Connects wired networks via WAPs

125
Q

PAT

A

NAT with Port numbers

126
Q

Best protection for buffer overflow

A

Input validation

127
Q

Microsoft SDL Design Phase

A

Decide how to implement security requirements.
Begin to identify threats.
Attack surface analysis and reduction
Threat modeling

128
Q

CHAP periodically…

A

reauthenticates users

129
Q

Encryption modes that don’t propagate errors

A

CTR, OFB

130
Q

Weakest encryption mode

A

ECB

131
Q

Best Encryption modes

A
  1. CTR
  2. OFB
132
Q

When should risk transfer occur?

A

When the cost of insurance is less than the cost of the insured item.

133
Q

Which is slower and cheaper? SRAM or DRAM?

A

DRAM

134
Q

RAM type that stores more information

A

DRAM

135
Q

What does SRAM use to store information?

A

Flip-flops

136
Q

Minutiae refers to…

A

fingerprints

137
Q

A digital signature encrypts…

A

the hash of a message

138
Q

Which key is used to sign a message?

A

Senders private key

139
Q

Which key is used to decrypt email?

A

Recipients private key

140
Q

Corrective access control

A

Repair damage after a malicious event

141
Q

CVSS Scoring order

A

Base
Temporal
Environmental

142
Q

Who issues CVE numbers?

A

MITRE

143
Q

Determining the cost-effectiveness of mitigating the potential harm or loss to a company

A

Risk Management

144
Q

RTO

A

Amount of time to restore without unacceptable impact

145
Q

Type 1 error

A

Valid subject is not authenticated

146
Q

Type 2 error

A

Invalid subject is incorrectly authenticated

147
Q

FISMA applies to…

A

Government contractors

148
Q

Generational fuzzing aka…

A

Intelligent fuzzing

149
Q

Generational fuzzing relies on…

A

Data models

150
Q

What must the client perform before it can use the TGT?

A

Install the TGT
Decrypt the symmetric key using a hash of the users password

151
Q

Database key that corresponds to a key in another table…

A

Foreign key

152
Q

TCP PSH flag

A

Used to clear the buffer

153
Q

Keyspace bit calculation

A

2 to the power of the number of bits

154
Q

AAA protocol that provides authentication to remote devices

A

RADIUS

155
Q

Access control model with “meaningful” permissions

A

RBAC

156
Q

What are the two types of physical intrusion detection systems?

A

Electromechanical
Volumetric

157
Q

Volumetric systems detect…

A

change to space of an environment

158
Q

Security marking uses…

A

Human readable security attributes

159
Q

What refers to security attributes for internal data structures?

A

Security labeling

160
Q

Primary objective of physical security

A

Protecting peoples safety

161
Q

Which side generates a high number port for a network connection? (Client or Server)

A

Client

162
Q

MD5 and SHA-1 hash values

A

MD5: 128
SHA-1 160

163
Q

Negative testing

A

Sending invalid information to an application

164
Q

Positive testing

A

Tests if an app is working the way it should

165
Q

CRUD testing

A

Test that database objects are creted correctly

166
Q

Layer 5 protocols (2)

A

RPC
PAP

167
Q

Exigent circumstances

A

Seize evidence without a warrant to protect it

168
Q

Remote journaling

A

Remote database log

169
Q

Capacitance

A

Monitors electromagnetic field

170
Q

Abstraction

A

Hide implantation details for an object from the users of that object

171
Q

Dirty Read

A

Reading a transaction that did not commit

CISSP 2021 Random (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions