Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cissp > CISSP Domain 8 > Flashcards

CISSP Domain 8 Flashcards

1
Q

Aggregate Vs Inference

A

Aggregate requires multiple small pieces

Inference requires a single data point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Waterfall method

A

Very linear, each phase leads

Once phase done can’t go back

Sequential steps

Can be improved by adding validation and verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Type of program language

A

Machine language

Assembly language

High level language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Machine language

A

Man had to manually calculate and allot memory address

Complete binary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Assembly language

A

Users mnemonic like ADD, PUSH, POP instead of binary codes

Uses assemblers to convert assembly codes to binary codes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

High level language

A

Uses abstract statements like Excel IF - Then- ELSE function

It’s processor independent

Code written in high level language can be converted to machine language using compiler and interpreters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

4 Gen - Very high level language

A

More abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Natural language

A

Eliminate need of programming expertise like AI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Assemblers Vs Compilers Vs Interpreters

A

No matter what language is used institutions and data have to end up in binary for processor to understand

Interpreter - Convert high level to machine level code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is libraries used for?

A

Software libraries contains reusable code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Integrated development environment

A

Environment where they can write their code, write it, test it, debug it and compile it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What happens in OOP ? And how does it work?

A

Devloper doesn’t develop each and every object

Works with class, subject and objects

Class - Set of attributes associated with it, when an object is generated, it inherits these attributes example: Furniture

From security pov provides a black box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Polymorphism

A

Characteristic of an object that allows is to respond with different behaviours to same message or method because of change in external conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Properties of OOP

A

Encapsulation

Messaging - Communication between objects

Reusability

Abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cohesion

A

How many different types of tasks a module carry out

Should high in nature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Coupling

A

How much interaction one module requires to carry out it’s tasks

Should be low in nature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Steps in OOP ( FYI)

A

Devloper creates a class which outlines specifications

Object is initiated it inherits these attributes

User inputs in a software - Addition

Objects is initiated

Object A interacts with B using API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Input validation - Limit check and Escaping input

A

Remove risky inputs

Always occurs on the server side

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Properties of session management

A

Cookies to be secure

Expire after a certain time and user to authenticate again

Identifiers to be long and randomly generated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Error handling

A

Devloper love long detailed error messages but those might contain sensitive info hence disable it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SDLC steps

A

Conceptual definition

Functional requirements determination

Control specifications devlopment

Design review

Coding

Code Review walk through

System test review

Maintanence and change management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Conceptual definition

A

Project charter - Top level understanding

Designers identity classification of data to be processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Functional requirements determination

A

How parts of system interoperate

Characteristics:

Input

Behaviour

Output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Control specifications determination

A

Analyse system from security perspective

  1. Access control
  2. Confidentiality using data encryption
  3. Audit trail - Accountability
  4. Availability and fault tolerance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Design review

A

Once functional and control is completed let system designers do their thing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Code Review walk through

A

Devloper starts writing code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Testing

A

System testing

Regression testing

UAT

Then deployed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Maintanence and change management

A

Maintanence tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Spiral model

A

prototype and incremental model

Determine objectives

Evaluate alternatives, identify and resolve risks

Devlop and verify next level product

Plan next phases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Agile software development - 12 principle

A

Satisfying customer

Welcome change

Devlop working software, couple of weeks

Have face to face conversation

Working software primary measure of progress

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Agile methodology

A

Scrum

Kanban

RAD

AUP

XP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Scrum

A

Daily team meetings

Scrum master

Sprint: Organize work into shorter sprints of activity

Short term objectives that contribute to broader goals of the project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

CMMI

A

Initial - Chaotic

Repeatable - Reuse of code

Defined- Operate what is documented

Managed - Quantitative Process management

Optomizing - Continuous improvement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Software Assurance Maturity model business functions

A

Governance - Stratergy and metrics , policy and compliance, education and guidance

Design - Threat assessment , security requirements and security architecture

Implementation - Secure build, Secure deployment, Defect management

Verification - Architecture analysis, Req driven testing, security testing

Operations - Incident management, environment management, operational management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

IDEAL model

A

Initiation

Diagnosis: Current state of org and make general recommendation of change

Establishing

Acting: Walk the talk

Learning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Change management process and 3 basic components

A

Request change

Change control: test and analyse

Release control: Only approved changes into prod

Also include acceptance testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Software configuration management

A

Control the version of the software used throughout an organisation and to formally track and control changes to software configuration

Configuration identification

Configuration control: Changes to software in accordance with change control and configuration management policies. Updates

Configuration status accounting - Formalized procedures to keep track of all authorised Changes they takes place

Configuration audit - Periodic audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Devops model Vs CI/CD model

A

Software development+ QA+ Operations

Often deploy code several times per day

Code roll out dozens or several times per day: - Security also should move

1.High degree of automation
2. Code repositories
3. SCM process
4. Movement of code between development, testing and prod environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

API’s and what a devloper needs to consider ?

A

Bypass traditional web pages and interact directly with underlying service through function calls

Secure authentication and Authorization to make specific call

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Software testing when is best time ? And types of test

A

Aa models are designed

Reasonableness check: Inputs gives desired output

Misuse case test: Code will perform under normal activity and when subjected to extreme conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

White box, Grey box and Black box testing

A

Access to source code, logical structures of program, inner workings of program

Have access to source code+ analyse inputs and outputs

Do not have access to source code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Code repositories

A

Central storage point for developers

Version control

Bug tracking

Web hosting

Release management

Used to manage and distribute code libraries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Third party software acquisition

A

COTS - On premise of IaaS

Open software (OSS) - freely available for anyone to download and use

44
Q

Type of DBMS

A

Hierarchical

Relational

45
Q

Hierarchical DBMS

A

Each employee has one manager but one manager has one or more employees

DNS

Distributed database

46
Q

Relational DBMS

A

Row ( Turple) and column ( fields/attributes)

Cardinality - Number of rows

Degree - Number of columns

47
Q

Candidates key in RDBMS

A

Uniquely identify any record in a table

48
Q

Primary key

A

Enforces uniqueness is primary key

Each table has only one primary key

49
Q

Alternate keys

A

Any key not selected as primary key is alternate key

50
Q

Foreign key

A

Enforces relationship between two tables, aka referential integrity

51
Q

What is SQL primary security feature?

A

Granularity of authorisation
It’s very detailed

52
Q

Db normalisation

A

Process of bringing a Db table into compliance with normal forms is known as normalisation

Developers want well organised and efficient db

53
Q

4 Required characteristics of Relational DB

A

A- All or nothing

Consistency

Isolation

Durability - Once committed they must be preserved

54
Q

What is multilevel Db and what is challenge?

A

Data(IC) and security should be separate it leads to data contamination

Can be implemented using restricted access with views

55
Q

Concurrency in DB and what if they fail to implement?

A

Edit control

Certain Information stored in Db is always correct at least has integrity and availability protected

Lost updates - Two people update at same time data is lost

Dirty Reads - Transaction that did not commit because of crash

56
Q

Aggregation

A

Multiple low level security data points combine them to produce useful info

57
Q

Inference

A

Using a single info gain access to confidential info

58
Q

Time stamps, Content dependent access control, context dependent, Db partitioning

A

Data integrity and availability

Contents or payload

Cell suppression - Concept of hiding individual db fields

Context - Big picture of ACL

Db partitioning - Subvert inference and aggregation

59
Q

Polyinstation in DB

A

When 2 or more rows in same DB have same primary keys but different data for use at different data classification levels

60
Q

Noise and perturbation

A

Can insert false or misleading data

61
Q

OBDC

A

To communicate with different db kind of interface

62
Q

No SQL and types

A

Uses models other than relational to store data

Key/ Value

Graph db

Document

63
Q

Key/ Value pairs

A

Store info in key value pairs

64
Q

Graph Db

A

Stores data in graph format

65
Q

Document

A

Stores data in document like JSON or XML

66
Q

Covert channel

A

Storage threat
Allow transmission of sensitive data between classification levels through direct or indirect manipulation of shared storage media

67
Q

Types of knowledge based systems

A

AI

Expert systems and neural systems

68
Q

Expert systems and 2 components

A

Accumulation of knowledge of experts

Knowledge system and inference engine - Prediction based on historic data

69
Q

ML core approach and 2 categories:

A

Computer to analyse directly from data

Supervised learning - Uses labelled data for training

Unsupervised learning - Algorithm devlop model independently

70
Q

Neural network

A

Extension of ML aka deep learning

Computational decision+ Series of rules stored in KB

Has many layers of summation - Weighting information to reflect - Delta rule

71
Q

Script kiddies

A

Ready to use scripts from internet use them to launch attack

72
Q

APT malware

A

Small adversaries they have zero days

73
Q

2 main functions of computer viruses

A

Propagation and payload execution

74
Q

Virus technologies

A

Multiparte

Stealth

Polymorphic

Encrypted

75
Q

Multiparte

A

More than one propagation techniques in order to penetrate systems

76
Q

Stealth virus

A

Hide themselves by actually tampering with the OS to fool AV package to thinking everything is working fine

77
Q

Polymorphic virus

A

Modify their own code as they travel

78
Q

Encrypted virus

A

Uses virus decryption routine

79
Q

Logic bomb

A

Perform certain action at particular time. - A condition

80
Q

Trojan horses

A

Appears loving but carries a malicious behind the scene payload

81
Q

Remote access Trojans

A

Opens backdoor in system to grant attacker remote admin control of infected system

82
Q

Worms

A

They propagate themselves without human intervention

83
Q

Spyware and adware

A

They are potentially unwanted programs

Monitoring your actions

Display advertisement

84
Q

Malicious scripts

A

Commonly found in fileless malware

85
Q

Zero day vulnerability and reasons

A

Delay in patches

Slowness in applying patches

86
Q

Antimalware Software and 3 things it does

A

Signature based system or heuristic based

S/w can eradicate the virus, restore the machine to safe condition

Quarantine until admin can examine

Predefined danger threshold- Delete

87
Q

EDR and UEBA

A

Analysis of end points
Isolation possible malicious activity
Integration with threat intelligence to get info into malicious behaviour

UEBA- build a profile of user

88
Q

Buffer overflow

A

Devloper doesn’t validate user inputs leading to memory segment buffer to overwrite

89
Q

TOC TOU

A

Process executes access permissions before too far in advance of a resource request

90
Q

Backdoor

A

Bypass normal access restrictions

Used in devlopment and debugging

91
Q

Prevlige escalation - Rootkits

A

Freely available on internet

92
Q

XSS and persistence XSS

A

Occur when web apps allow attacker to perform injection into a web page

Allows reflected input

Malicious scripts are injected into trusted websites

Remains even when attacker isn’t actively waging an attack

93
Q

SQL injection

A

Unexpected input to gain unauthorised access to an underlying db

94
Q

Network reconciance techniques

A

IP probes

Port scans

Vulnerability scans

95
Q

SDLC Life cycle

A

Real devlopers ideas take effort

Requirement gathering

Design

Implementation

Testing

Evolution

96
Q

Insecure direct object reference

A

If app doesn’t perform Authorization checks user may be permitted to view info that exceeds their authority

97
Q

Directory transversal

A

Web server suffers from misconfiguration that allows attackers to navigate directory structure and access file that should remain secure

98
Q

File inclusion

A

Simply retrieving a file from local OS and displaying it to attacker, FI actually execute code

99
Q

XSRF - Cross site request forgery

A

XSS attack exploit the trust the user has in website to execute code in users system

100
Q

SSRF

A

Instead of tricking users browser into visiting URL, trick server into visiting a URL based on user imput

101
Q

Session hijacking

A

Malicious person intercepts between authorised user and resource

  1. Capture details of client identity
  2. Tricking client into thinking attacker system is server
  3. Accessing web app using a cookie data of user who didn’t close connection
102
Q

Most effective input validation

A

Input whitelisting inputs which is defined by devloper for user to input

Input blacklist - To control user imput

103
Q

Db security - parameterised queries and stored procedure

A

Techniques to protect against injection attacks doesn’t allow insertion of codes

104
Q

Db admins to reduce data exposure

A

Obsfuscation and camaflogue

Data minimisation

Tokenization : Random token replacement of actual data

105
Q

Application resilience

A

Scalability - Scale up

Elasticity - scale up and down

106
Q

Resource exhaustion in memory management

A

Memory leaks memory needs to released if not in use

Cissp (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions