Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Notes > CISSP Notes 2 > Flashcards

CISSP Notes 2 Flashcards

1
Q

Are launched directly from an attacker (the client) to a listening service. The “Conficker” worm of 2008+ spread via a number of methods, including this method on TCP port 445, exploiting a weakness in the RPC service.

A

SMB Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Behavioral biometric method, that’s inexpensive, not intrusive and often transparent to the user.

A

Keystroke pattern

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The amount of time the biometric system requires to scan and approve or deny access.

A

Throughput Rate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A method where user can register their own devices with the organization & associates them with the user account.

A

Device Fingerprinting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

3rd party tool to authenticate users own devices into the organization’s network.

A

SecurityAuth Identity Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

XML-based language commonly used to exchange (AA) information between federated organizations.

A

Security Assertion Markup Language (SAML)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

XML-framework designed for exchanging user information for federated identity SSO purposes that’s based on DSML.

A

Service Provisioning Markup Language (SPML)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Can display LDAP-based directory service information in an XML format.

A

Directory Service Markup Language (DSML)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Menus and shell, DB view and physical interfaces

A

Constrained User Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Declarative access control policy language implemented in XML and also a processing model, describes how to interpret security policies.

A

Extensible Access Control Markup Language (XACML)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A protocol specification for exchanging structured information in the implementation of web services and networked environments.

A

Simple Object Access Protocol (SOAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A type of IDS that uses if/then statements and expert system to allow for A.I characteristics

A

Rule-based IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A type of client/server technology that forces users to log onto a central server just to use the computer and access network resources.

A

Thin Clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An attack method on smart cards when attackers have introduced computational errors into the card with the goal of uncovering the stored encryption keys.

A

Fault Generation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attack against smart cards that uses needle-less and ultrasonic vibration to remove the outer protective material on the card’s circuit and tapping into the card’s ROM chips.

A

Micro-probing Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The process of identifying, understanding and categorizing a potential threat

A

Threat Modeling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

IDaaS functionality that includes logging information and answering questions such as who accesses what and when.

A

Intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IDaaS that includes the ability to provision identities held by service to target application.

A

Identity Governance and Administration (IGA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In this model the user authenticates once and then has unconditional access to all resources.

A

Once In-Unlimited Access (OIUA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

If real SSO isn’t available, then the company compensate this software with _____ solution.

A

Script-based SSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A set of IT-U guidelines for the exchange of email of Message Handling System (MHS)

A

X.400

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Developed by telecommunication companies as a way to facilitate a standard method for developing electronic directories for use over telecom networks.

A

X.500 protocol suite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Outlawed malcode creators plus punishment

A

Computer Abuse Amendment Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Guarantees the creators of “original work of authorship” protection against the unauthorized duplication of their works.

A

Digital Millennium Copyright Act (DMCA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Privacy and security regulations for hospitals, physicians, insurance companies and other organizations that process or store Personal Health Information.

A

HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Greatly broadens the power of law enforcement organizations among many areas including when monitoring electronic communications.

A

Patriot Act of 2001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

A standard for credit card companies to handle the private information of customer credit cards.

A

PCI-DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Integrated framework governance model used to help prevent fraud within a corporate environment

A

COSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Framework of control objectives and allows for IT governance

A

COBIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The standard for the establishment, implementation, control, and improvement of the information security management system.

A

ISO 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Set of best practices for IT service management

A

ITIL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Security and Privacy Control objectives for federal information systems and organizations.

A

NIST SP 800-53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Model and methodology for the development of enterprise architectures developed by the Open Group.

A

TOGAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Decomposing the application to gain greater understanding of the logic of the product and its interaction with external elements

A

Reduction Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Decomposition five key concepts

A
  1. Trust boundaries
  2. Data flow paths
  3. Input points
  4. Privileged operations
  5. Security stance and approach
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Approach to identify threats

A

Focused on assets; focused on attacker; focused on software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Minimum level of security that every system must meet

A

Baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Compulsory requirements for user of hardware, software, technology and security control

A

Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Individual responsible for reviewing and verifying that the security policy is properly implemented

A

Auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

individual responsible for implementing the prescribed protections in security policy

A

Data Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Individual responsible for classifying information

A

Data Owner

42
Q

Trained and experienced network, system and security engineer who is responsible for following directives by senior management

A

Security Professional (You)

43
Q

Used to store a sample of biometrics

A

Reference Profile or Reference Template

44
Q

Commercial classification system

A
  • Confidential
  • Private
  • Sensitive
  • Public
  • Top secret
45
Q

Military classification system

A
  • Top secret
  • Secret
  • Confidential
  • Sensitive but unclassified
  • Unclassified
46
Q

Storing something in out-of-the-way location

A

Seclusion

47
Q

Risk Management Framework steps

A
  1. Categorize information
  2. Select security control
  3. Implement security control
  4. Assess security control
  5. Authorize information system
  6. Monitor security control
48
Q

The collection of executives practicing the support, definition and direction of the security effort of the organization

A

Security governance

49
Q

The system of oversight that may be mandated by law, regulations, industry standards, contractual agreements or licensing requirement.

A

Third party governance

50
Q

BCP Main Steps

A
  1. Project Scope and planning
  2. BIA
  3. Continuity planning
  4. Approval and Implementation
51
Q

BCP resource requirements phase

A
  1. BCP development
  2. BCP testing, training and maintenance
  3. BCP implementation
52
Q

BCP scope and planning requirements

A
  1. Structured analysis of business organization
  2. Creation of BCP team with senior management approval
  3. Assessment of availability of resources
  4. Analysis of legal and regulatory landscape
53
Q

Business organization analysis and critical departments

A
  1. Operation department
  2. Critical support departments
  3. Senior executives
54
Q

BCP team selection

A
  1. Representative from each core department
  2. Representative from each support dept
  3. Representative from IT
  4. Representative from legal dept
  5. Representative from senior management
55
Q

BIA process steps

A
  1. Assets identification
  2. Risks identification
  3. Likelihood assessment
  4. Impact assessment
  5. Resource prioritization
56
Q

Continuity planning sub-tasks

A
  1. Strategy development
  2. Provisions and processes
  3. Plan approval
  4. Plan implementation
  5. Training and education
57
Q

BCP Statement of Importance

A

Reflects the criticality of the BCP, commonly takes the form of a letter to the employees stating the reason behind BCP efforts and request cooperation of all personnel in implementation phase.

58
Q

BCP Statement of Priorities

A

Flows directly from the “identify priorities” phase of BIA and involves listing of the functions considered critical

59
Q

Statement of organizational responsibility

A

Comes from senior level executives and echoes the sentiment that “business continuity is everybody’s responsibility”.

60
Q

Statement of urgency and timing

A

Expresses the criticality of implementing BCP and outlines the implementation timetable.

61
Q

Confinement

A

Allows a process to read from and write to only certain memory locations and resources. This is also known as sandboxing.

62
Q

Mode Transition

A

When the CPU has to change from processing code in user mode to kernel mode. This is a protection measure but it causes a performance hit.

63
Q

HSM

A

A crypto-processor used to manage/store digital encryption keys, accelerate cryptograhpic ops, and improve authentication. Often an add-on adapter or peripheral or can be TCP/IP network device.

64
Q

Feedback

A

One system provides input to another system, which reciprocates by reversing those roles (so that system A first provides input for system B and then system B provides input to System A)

65
Q

Memory Protection

A

Protection mechanism provided by operations systems that can be implemented as encapsulation, time multiplexing of shared resources, naming distinctions, and virtual memory mapping.

66
Q

TPM

A

Both a specification for motherboard crypto-processor and general specification name. It is a chip used to store/process crypto keys for hardware and supported HDD crypto systems.

67
Q

DLL

A

A set of subroutines that are shared by different applications and operating system processes.

68
Q

Bound

A

The bound of a process consist of limits set on the memory addresses and resources it can access. It states the area within which a process is confined or contained.

69
Q

Unconstrained Data Item (UDI)

A

Any data item that is not controlled by the security model. Any data that is to be input and hasn’t been validated, or any output.

70
Q

Base register

A

Beginning of address space assigned to a process. Used to ensure a process does not make a request outside its assigned memory boundaries.

71
Q

Package

A

An intermediate grouping of security requirement components that can be added or removed from a Target of Evaluation (TOE).

72
Q

Data mining

A

Searches large amounts of data to determine patterns that would otherwise get “lost in the noise”.

73
Q

Data Execution Prevention (DEP)

A

Memory protection mechanism used by some operating systems where segments may be marked as non-executable so that they cannot be misused by malicious software.

74
Q

Take-Grant

A

A technology that employs a directed graph to dictate how rights can be passed from one subject to another or from a subject to an object.

75
Q

Security Perimeter

A

Imaginary boundary that separates the trusted computing base from the rest of the system.

76
Q

PCI-DSS

A

Collection of requirements for improving security of electronic payment transactions.

77
Q

Hybrid Microkernel Architecture

A

Combination of monolithic and microkernel architecture. The microkernel carries out critical operating system functionality, and the remaining functionality is carried out in a client/server model within kernel mode.

78
Q

Interfaces

A

Implemented within an application to restrict what users can do or see based on their privileges. Users with full privileges have access to all the capabilities of the application.

79
Q

Cascading

A

Input for one system comes from the output of another system.

80
Q

TCB

A

A combination of hardware, software, and controls that work together to form a trusted base to enforce your security policy.

81
Q

Data Hiding

A

Use of segregation in design decisions to protect software components from negatively interacting with each other.

82
Q

Common Criteria

A

A worldwide standards-setting group of reps from various international standards organizations. It defines standards for industrial and commercial equipment, S/W, protocols, and management, among others.

83
Q

OWASP

A

Provides a huge number of free resources dedicated to improving an organization’s application security posture.

84
Q

Tokens

A

Separate object that is associated with a resource and describes its security attributes. It can communicate security information about an object prior to requesting access to the actual object.

85
Q

Instruction Set

A

Set of operations and commands that can be implemented by a particular CPU

86
Q

Trusted System

A

Describes a system that is always secure no matter what it is in.

87
Q

Chinese Wall

A

This model was created to permit access controls to change dynamically based on a user’s previous activity.

88
Q

Process Isolation

A

One in which all protection mechanisms work together to process sensitive data for many types of users while maintaining a stable and secure computing environment.

89
Q

Micro-architecture

A

Specific design of a microprocessor, which includes physical components (registers, logic gates, ALU, cache, etc.) that support a specific instruction set.

90
Q

Protection Profile

A

Specifications for a product that is to be evaluated; the security requirements and protections.

91
Q

Constrained Data Interface (CDI)

A

Any data item whose integrity is protected by the security model.

92
Q

Reference Model

A

The part of the trusted computing base that validates access to every resource prior to granting access requests.

93
Q

Multilevel Security

A

A system is operating in multilevel security when it permits two or more classification levels to be processed at the same time (all that users don’t have the clearance or formal approval to access)

94
Q

Rootkit

A

Malware that replaces portion of the kernel and/or operating system.

95
Q

Interrupts

A

Software or hardware signal that indicates that system resources (i.e., CPU) are needed for instruction processing.

96
Q

Graham-Denning Model

A

Focused on the secure creation and deletion of both subjects and objects. It is a collection of eight primary protection rules or actions that define the boundaries of certain secure actions.

97
Q

Integrity Verification Procedures (IVP)

A

In Clark Wilson model, IVP is a procedure that scans data items and confirms their integrity.

98
Q

Layered OS Architecture

A

Architecture that separates system functionality into hierarchical layers.

99
Q

Security Target (ST)

A

Specify the claims of security from the vendor that is built into the Target Of Evaluation (TOE).

100
Q

DREAD rating system components

A
  1. Damage Potential
  2. Reproductibility
  3. Exploitability
  4. Affected Users
  5. Discoverability

CISSP Notes (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions