Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > CISSP > Flashcards

CISSP Flashcards

1
Q

ISC2 Code of Ethics: Preamble

A

The safety and welfare of society and the common good, duty to our principals, and duty to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.

Therefore, strict adherence to this Code is a condition of certification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ISC2 Code of Ethics: Canons

A

1) Protect society, the common good, necessary public trust and confidence, and the infrastructure.

2) Act honorably, honestly, justly, responsibly, and legally.

3) Provide diligent and competent service to principals.

4) Advance and protect the profession.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

OSI Layers

A

7 Application
6 Presentation
5 Sessions
4 Transport
3 Network
2 Data Link
1 Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

OSI: Application

A

Network Process to Application
Application Firewall
HTTP/S
DNS
SSH
SNMP
FTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

OSI: Presentation

A

Data representation and encryption.
XML
JPEG
ANSI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

OSI: Session

A

Interhost communication and session management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

OSI: Transport

A

End-to-end connection with error correction and detection
TCP/UDP
iSCSI (SAN

Uses segments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

OSI: Network

A

Local addressing, routing and delivery of packets.
Routers
Packet Filtering Firewalls
IP Addresses
ICMP
NAT

Uses Bits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OSI: Data Link

A

Physical addressing and reliable point-to-point connection.
Switches
Bridges
MAC Addresses
Point-to-Point Protocol (PPP)
Point-to-Point Protocol over Ethernet (PPPoE)
ARP

Uses Frames.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

OSI: Physical

A

Media, Signal and Binary Transmission

Uses Bits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

TCP/IP Model

A

Application
Transport
Internet
Link

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Incident Response

A

Preparation
Detection
Response
Mitigation
Reporting
Recovery
Remediation
Lessons Learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Cyber Kill Chain: Recon

A

Identify vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Cyber Kill Chain

A

Recon
Weaponization
Delivery
Exploit
Installation
Command & Control (C&C)
Actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cyber Kill Chain: Weaponization

A

Create Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Cyber Kill Chain: Delivery

A

Transmits weapon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Cyber Kill Chain: Exploit

A

Exploit vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Cyber Kill Chain: Installation

A

Installs persistent access point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cyber Kill Chain: C&C

A

Persistent access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cyber Kill Chain: Actions

A

Achieve goal, exfiltrate data, ransomware, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

IR: Preparation

A

Developing IR process, team members, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

IR: Detection

A

Triage
Identify an adverse event - an incident - and begin dealing with it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

IR: Response

A

Triage
IR Team is activated and begin impact assessment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

IR: Mitigation (Containment)

A

Action/Investigation
Minimize damage or impact from the incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

IR: Reporting

A

Action/Investigation
Happens throughout incident response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

IR: Recovery

A

Recovery
Return to normal
Getting back to business as usual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Remediation

A

Recovery
Prevention methods such as implementing fixes and improvements to systems, processes to prevent similar incidents.

28
Q

IR: Lessons Learned

A

Recovery
Improve processes and try to prevent future incidents.

29
Q

Layer / Lattice-based Models

A

Bell-LaPadula
Biba

30
Q

Bell-LaPadula

A

Confidentiality
Simple security property, “no read up”.
Star (*) property, “no write down”.
Strong star property: read and write.

31
Q

Biba

A

Integrity
Simple integrity property: “no read down”
Star (*) integrity property: “no write up”
Invocation property: can’t send information to someone that is rated at a higher layer.

32
Q

Rule-Based Models

A

Information Flow
Clark-Wilson
Brewer-Nash (Chinese Wall)
Graham-Denning
Harrison-Ruzzo-Ullman

33
Q

Information Flow Model

A

Help address unintentional covert channels.

34
Q

Clark-Wilson Model

A

Integrity
Rules of Integrity
Well-Formed Transactions: Good, consistent, validated data.
Separation of Duties
Access Triple: Subject | Program | Object

35
Q

Brewer-Nash (The Chinese Wall) Model

A

Preventing conflicts of interest.

36
Q

Graham-Denning

A

Integrity
Specific rules for allowing subjects to access objects.

36
Q

ISO 27001

A

Provides best practice recommendations for a functional security department.
Organizations can be certified against ISO 27001

36
Q

Harrison-Ruzzo-Ullman Model

A

Integrity
Adds Generic Rights, rights applied to everyone universally.

36
Q

ISO 27002

A

Implementation guidance for ISO 27001

37
Q

ISO 27001 - Annex A

A

Where the domains and controls are listed.

38
Q

Symmetric Cryptography Advantages

A

Fast/Efficient
Strong

39
Q

Symmetric Cryptography Disadvantages

A

Key Distribution
Scalability
No authenticity, integrity, or nonrepudiation

40
Q

Symmetric Cryptography

A

Same key has to be at both ends to decrypt and encrypt.

41
Q

Asymmetric Cryptography

A

Different keys that decrypt and encrypt at both ends.

42
Q

DES

A

Weak
Symmetric
key: 56
Block 64

43
Q

IDEA

A

Strong
Key: 128
Block: 64

44
Q

3DES

A

Strong
Key: 168=112
Block: 64

Susceptible to meet in the middle attack.

45
Q

AES

A

Very Strong
Key: 128, 192, 256
Block: 128

46
Q

Asymmetric Advantages

A

Solves key exchange problem
Enables digital signatures and other services, like authenticity (proof of origin), confidentiality, and access control
Solves scalability

47
Q

Asymmetric Disadvantages

A

Significantly slower
Requires large key sizes

48
Q

RSA

A

Math: Factoring

49
Q

Ellipitic Curve (ECC)

A

Math: Discrete logarithm
ECC uses shorter keys than RSA for same level of security.

50
Q

Diffie-Hellman

A

Math: Discrete Logs
Only used for Key Exchange.

51
Q

ElGamal

A

Asymmetric key encryption algorithm for public-key cryptography which is based on Diffie-Hellman key exchange.

52
Q

DSA (Digital Signature Algorithm)

A

Uses a different algorithm for signing and encryption than RSA, yet provides the same level of security. Key generation has two phases.

53
Q

FTP

A

Port 20/21

54
Q

Secure Shell (SSH)

A

Port 22

55
Q

SMTP

A

Port 25
Port 587 is secure via TLS

56
Q

NTP (Time)

A

Port 37

57
Q

DNS

A

Port 53

58
Q

TFTP

A

Port 69

59
Q

HTTP

A

Port 80

60
Q

SNMP

A

Port 161

61
Q

SNMP Trap

A

Port 162

62
Q

Border Gateway Protocol (BGP)

A

Port 179

63
Q
A

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions