Chapter 7 - Host, Data and Application Security

Question 1

What is the most common language used to speak to databases?

Answer 1

page 216

Structured Query Language (SQL)

Question 2

What kind of database and application exist on a single system?

Answer 2

page 216

One-Tier Model or Single-Tier Model

Question 3

In what tiered system model, does the client workstation or system runs an application that communicates with the database that is running on a different server.

Answer 3

page 217

Two-Tier Model

Question 4

In what tiered system model effectively isolates the end user from the database by introducing a middle-tier server.

Answer 4

page 217

Three-Tier Model

Question 5

What is NoSQL?

Answer 5

page 217

Is not a relational database and does not use SQL.

Question 6

What is a SAN?

Answer 6

page 218
Storage Area Network
Is a separate network set up to appear as a server to the main organizational network.

Question 7

What is a technique of providing unexpected values as input to an application in order to make it crash?

Answer 7

page 218

Fuzzing

Question 8

What is the best way to prevent Fuzzing is…

Answer 8

page 218

Is to validate all input to ensure that input is of expected type.

Question 9

What is OWASP?

Answer 9

page 219
Is a voluntary group dedicated to forming secure coding practices for web-based applications as well as mobile and client applications along with back-end design issues.

Question 10

What is CERT Secure coding Standards?

Answer 10

page 219
Computer Emergency Response Team
Cover many of the same issues as OWASP, but they also have complete language-specific standards for Java, Perl, C and C++.

Question 11

What are the three types of operating system patches?

Answer 11

page 220

• Hotfix
• Patch
• Service Pack

Question 12

What are the different permissions?

Answer 12

page 220

• Full Control
• Modify
• Read & Execute
• Read
• Write

Question 13

What are some actions you should take to keep safe from Malware?

Answer 13

page 221
Install antivirus software
Install antispam filters
Install antispyware software
Use pop-up blockers
Use host-based firewalls
Use host-based IDS

Question 14

A _____ _______ defines the level of security that will implemented and maintained.

Answer 14

page 226

Security Baseline

Question 15

What types of Backups are there?

Answer 15

page 233

• Full
• Differential
• Incremental

Question 16

What is a Differential Backup?

Answer 16

page 233

All changes since the last full backup are archived.

Question 17

What is an Incremental Backup?

Answer 17

page 233

All changes since the last backup of any type are archived.

Question 18

What is RAID 3 or 4?

Answer 18

page 234
The RAID uses one dedicated disk to store parity information. The storage capacity of the array is reduced by one disk (the one used for parity). If a disk fails, that is only a partial loss of data. The data remaining on the other disks, along with the parity information allows data to be recovered.

Question 19

What is RAID 6?

Answer 19

page 234
This RAID level combines four or more disks in a way that protects data against the loss of any two disks. It accomplishes this by adding an additional parity block to RAID 5. Each of the parity blocks is distributed across the drive array so parity is not dedicated to any specific drive.

Question 20

What is RAID 1+0 (or 10)?

Answer 20

page 234
“Stripe of Mirrors”, requires a minimum of 4 drives, 2 mirrored drives to hold half of the striped data, plus another 2 mirrored drives for the other half of the data.

Question 21

What is RAID 0+1?

Answer 21

page 235
“Mirror of the Stripes”
This RAID level is the opposite or RAID 1+0, Here the stripes are mirrored. Array requires a minimum of 4 drives, 2 mirrored drives to replicate the data on the RAID 0 array.