CISSP Notes 3 Flashcards
1
Q
Packers
A
Provide runtime compression of executables. The original .exe is compressed, and a small executable decompresser is prepended to the .exe. Upon execution the decompresser unpacks the compressed executable machine code and runs it.
2
Q
compartmented security mode
A
A system is operating in ________ when all users have clearance to access all the information processed by the system in a system high-security configuration, but might not have the need-to-know and formal access approval.
3
Q
Sutherland Model
A
A model that is based on the idea of defining a set of system states, initial states, and state transitions. Through the user of only these predetermined secure states, integrity is maintained and interference is prohibited.
4
Q
Hardware Segmentation
A
Physically mapping software to individual memory segments.
5
Q
System-High Security Model
A
A system is operating _____ when all users have a security clearance to access the information but not necessarily a need-to-know for all the information processed on the system.
6
Q
Garbage Collector
A
Tool that marks unused memory segments as usable to ensure that an operating system does not run out of memory.
7
Q
Trusted Paths
A
For the TCB to communicate with the rest of the system, it must create secure channels, also called _____
8
Q
System State
A
A snapshot of a system at a specific moment in time.
9
Q
Absolute Address
A
Hardware addresses used by CPU.
10
Q
Sandbox
A
Designed to prevent an attacker who is able to compromise a java applet from accessing system files, such as the password file.
11
Q
Accreditation
A
Is the formal declaration by the designated approving authority that an IT system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk
12
Q
Transformation Procedures (TP)
A
______ are the only procedures that are allowed to modify a constrained data item (CDI)
13
Q
ActiveX
A
Are the functional equivalents of Java applets. They use digital certificates instead of a sandbox to provide security. They are tied more closely to the operating system, allowing functionality such as installing patches via Windows Update.
14
Q
ITSEC
A
European standard used to assess the effectiveness of the security controls built into a system.
15
Q
Read-Only Memory (ROM)
A
Nonvolatile memory that is used on motherboards for BIOS functionality and various device controllers to allow for operating system-to-device communication. Sometimes used for off-loading graphic rendering or cryptographic functionality.
16
Q
System security capabilities
A
The _____ of information systems include memory protection, virtualization, Trusted Platform Module, interfaces and fault tolerance.
17
Q
Cache
A
Fast and expensive memory type that is used by a CPU to increase read and write operations.
18
Q
Clark-Wilson Model
A
A security model that uses multifaceted approach to enforcing data integrity. Instead of defining a formal state machine, this model defines each data item and allows modifications through only small set of programs.
19
Q
Security Kernel
A
The collection of components in the TCB that work together to implement reference monitor functions.
20
Q
Logical Addressing
A
Indirect addressing used by processes within an operating system. The memory manager carries out logical-to-absolute address mapping.
21
Q
Emanation
A
_____ is energy that escapes an electronic system, which may be remotely monitored under certain circumstances.
22
Q
Goguen-Meseguer Model
A
The ____ model is based on predetermining the set or domain - a list of objects that a subject can access. This model is based on automation theory and domain separation.
23
Q
Assurance evaluation criteria
A
The comprehensive evaluation of the technical and nontechnical security features of an IT system and other safeguards.
24
Q
TCSEC
A
U.S. DoD standard used to assess the effectiveness of the security controls built into a system. Replaced by the Common Criteria.
25
Stack
Memory construct that is made up of individually addressable buffers. Process-to-process communication takes place through the use of them.
26
Process Isolation
Is used to prevent an active process from interacting within an area of memory that was not specifically assigned or allocated to it.
27
Virtual Memory
Combination of main memory (RAM) and secondary memory within an operating system.
28
Covert channel
________ is a way for an entity to receive information in an unauthorized manner. It's also an information flow that is not controlled by a security mechanism.
29
Maintenance Hooks
They are instructions within software that only the developer knows about and can invoke, and which give the developer easy access to the code.
30
Fault Tolerance
The ability of a system to suffer a fault but continue to operate. This is achieved by adding redundant components such as additional disks within a RAID.
31
Time of Check/Time of Use
A type of attack which takes advantage of the dependency on the timing of events that take place in a multitasking operating system.
32
Limit Register
Ending of address space assigned to a process. Used to ensure a process does not make a request outside its assigned memory boundaries.
33
Lattice Model
A structure consisting of a finite partially ordered set together with least upper and greatest lower bound operators on the set.
34
Race Condition
______ happens when two different processes need to carry out their tasks on one resource.
35
Pipelining
______ combines multiple steps into one combined process, allowing simultaneous fetch, decode, execute, and write steps for different instructions.
36
Watchdog timers
_______ is designed to recover a system by rebooting after critical processes hang or crash. It reboots the system when it reaches zero; critical operating system processes continually reset the timer, so it never reaches zero as long as they are running.
37
Dedicated Mode
A system is operating in a ______ if all users have a clearance for, and a formal need-to-know about, all data processed within the system.
38
API
Software interface that enables process-to-process interaction. Common way to provide access to standard routines to a set of software programs.
39
Hardware separation
Is a form of CPU hardware layering that separates and protects domains (such as kernel mode and user mode) from each other.
40
Microkernel Architecture
Reduced amount of code running in kernel mode carrying out critical operating system functionality. Only the absolutely necessary code runs in kernel mode, and the remaining operating system code runs in user mode.
41
RAM
Memory sticks that are plugged into a computer's motherboard and work as volatile memory space for an operating system.
42
Security Policy
Strategic tool used to dictate how sensitive information and resources are to be managed and protected.
43
Hypervisor
Central program used to manage virtual machines (guests) within a simulated environment (host).
44
P2P
Alternative to the classic client/server computer model. Any system may act as a client, a server, or both, depending on data needs.
45
Thin clients
Normally run on a system with a full operating system, but use a Web browser as a universal client, providing access to robust applications which are downloaded from the server and run in the client's browser.
46
IoT
______ refers to small internet connected devices, such as baby monitors, thermostats, case registers, appliances, light bulbs, smart meters, fitness monitors, cars, etc.
47
ASLR
Memory protection mechanism used by some operating systems. The addresses used by components of a process are randomized so that it is harder for an attacker to exploit specific memory vulnerabilities.
48
Applets
_____ are small pieces of mobile code that are embedded in other software such as web browsers.
49
Java
_______ is an object-oriented language used not only to write applets, but also as a general purpose programming language. Java bytecode is platform-independent.
50
Diskless workstations
______ contains CPU, memory, and firmware, but no hard drive. It includes PCs, routers, embedded devices, and others. The kernel and operating system are typically loaded via the network.
51
Are launched directly from an attacker (the client) to a listening service. The Conficker worm of 2008+ spread via a number of methods, including this method on TCP port 445 - exploiting a weakness in the RPC service.
Server-side attack
52
Systematic whittling at assets in accounts or other records with financial value, where very small amounts are deducted from balances regularly and routinely.
Salami attack
53
An attacker gains access to a system and makes small random or incremental changes to data during storage, processing, I/O, instead of obviously altering the file.
Data Diddling
54
Malicious variations of official BIOS or firmware is installed that allows remote controlled access or other malicious actions.
Phlashing attack
55
Holds different condition bits. One of the bits states whether the CPU should be working in user mode or Kernel mode.
Program Status Word (PSW)
56
Single-purpose digital computer deployed for the management and automation of various industrial electro-mechanical operations
Programmable Logic Controller (PLC)
57
Static file on TCP/IP supporting systems that contains hard-coded references for domain names and their associated IP addresses.
HOSTS file
58
Often contains historical information not normally stored in productions DBs because of storage limitation and data security concerns
Data Warehouses
59
Software that runs an algorithm to identify unused committed memory and then tells the OS to mark the memory as available.
Garbage Collectors
60
Designed to do limited sets of specific functions, and it may consist of the same components of typical computer systems; or it could be a micro-controller (integrated chip with on-board memory and peripheral ports)
Embedded Systems
61
Minimal human interfaces, can be stand-alone; other similarly systems-integrated or traditional IT system integrated; mechanical buttons and knobs or simple LCD screen interfaces
SCADA
62
A technology that allows the electronic emanations that every monitor produces (Van Eck radiations) to be read from a distance.
TEMPEST
63
The science of raw data examination with the focus of extracting useful information out of the bill information set.
Data Analytic
64
Refer to devices that offer a computational means to control something in the physical world.
Cyber-physical systems
65
The user of an object (or OS component) doesn't necessarily need to know the details of how the object works
Abstraction
66
A form of parallel distributed processing that loosely groups a significant number of processing nodes to work toward a specific processing goal
Grid Computing
67
Typically found in industrial process plans where the need to gather data and implement control over a large-scale environment from a single location is essential.
Distributed Control Systems
68
A set of functions that applications can call upon to carry out different types of procedures
Dynamic-Link Libraries
69
Holds information such as the program counter, stack pointer and PSW
Special Registers
70
Used to hold variables and temp results as the ALU works through its execution process
General Registers
71
Can cause the client to download contents and store it in the cache that was not the intended element of a requested webpage
Split-Response Attack
72
A technique to look for duplication of efforts, manual steps which can be automated, and other streamlined techniques to reduce time and effort in business processes
Process Enhancement
73
Document a new employee should sign upon employment which outlines rules, restrictions, acceptable use policies, job description, violations, consequences and length of employment.
Employment agreement
74
A document which needs to be signed by an employee in order to protect the organization's confidential information or business practices.
Nondisclosure agreement
75
A document which needs to be signed by an employee in order to protect trade secrets or knowledge which distinguishes the company from the competition. It may even prevent the employee from working for a competitive company for a certain period of time.
Noncompete agreement
76
This process is essential to making sure a terminated employee is handled in a private, respectful, and careful manner as to make sure precautions are taken.
Employment Termination Process
77
Document containing vendor, consultant, or contractor controls used to define the expected performance, compensation, scope, and consequences of a missed agreement.
Service Level Agreement
78
The act of following the necessary laws, rules, policies, requirements, standards, or regulations.
Compliance
79
The freedom from being observed, leaked, monitored or experience unauthorized access to your data.
Privacy
80
Private information which can be traced back to the original person
Personally Identifiable Information
81
A system in which governance can be mandated by a third party law, regulation, standard, license, obligation or requirement.
Third-party governance
82
The process of reading through and verifying standards and requirements between exchanged documentation.
Documentation review
83
This loss can occur when failing to meet the required documentation requirements of third-party governance; specifically in the military or government.
Authorization to Operate
84
The process of examining the environment for risk and scoring the likelihood of it happening
Risk analysis
85
The direct target of a threat
Asset
86
The dollar value attached to an asset
Asset Valuation
87
Can be caused by the absence of a safeguard
Vulnerability
88
The percentage that a threat will be realized
Exposure factor
89
The calculation of a risk
Threat x vulnerability
90
The step taken to protect an asset
Safeguard or counter-measure
91
When a safeguard or counter-measure has failed and an exploit has been successful by the threat agent
Breach
92
Network topology that uses a single unilateral cable
Ring Topology
93
Network topology in which all points connect to one another
Mesh Topology
94
Fourth layer of the OSI Model
Transport
95
Fourth layer of the TCP/IP Model
Application
96
The #1 most important concept in all of the CISSP
Human life comes first
97
The place where security should begin in any SDLC
First phase/stage
98
The battleground where information and communication technology is used and utilized as a competitive factor over an enemy
Information warfare
99
Calculations made with numbers, graphs, historical numbers and research
Quantitative Analysis
100
Calculations based on feelings and instinct
Qualitative Analysis
101
SSL belongs in this layer of the OSI Model
Transport Layer
102
TCP belongs in this layer of the OSI Model
Transport Layer
103
Protocol data unit at the transport layer
Segments
104
Protocol data unit at the network layer
packets
105
Protocol data unit at the data link layer
frames
106
SMTP, HTTP, DNS belong in this layer of the OSI Model
Application Layer
107
This layer of the OSI Model is not concerned with the data, but the format of the data
Presentation Layer
108
This layer of the OSI Model is responsible for establishing the connection between applications
Session Layer
109
Communication that takes place unidirectionally, in one direction
Simplex
110
This layer of the OSI Model is responsible for establishing the connections between endpoints, between the actual physical computers, not the applications
Transport Layer
111
Mode in which two applications can communicate with each other and send messages at the same time
Full-duplex
112
MAC addresses belong in which layer of the OSI Model?
Data Link Layer
113
Voltage, bits, UTP, NIC cards are all on which layer of the OSI Model?
Physical Layer
114
Connection-oriented protocol
TCP
115
Enables private IP addresses to be routed through the Internet
Network Address Translation
116
Allows fiber channel protocol encapsulation over Ethernet networks
Fiber Channel Over Ethernet
117
Layer 2 protocol which allows private IP addresses over a dedicated link, acting like a VPN
MPLS (Multiprotocol Label Switching)
118
Transmission in which the entire communication channel is utilized
Baseband
119
Transmission in which communications channels can be divided up into different types of subchannels for different types of data
Broadband
120
Has a copper core surrounded by a layer of shielding and grounded. It is further protected by an outer jacket. It is somewhat resistant to EMI.
Coaxial cable
121
Protocol that does not guarantee delivery
UDP
122
Components of a TCP handshake
SYN, SYN/ACK, ACK
123
192.168.1.12 is what type of IP address?
Private (RFC 1918)
124
10.0.0.2 is what type of IP address?
Private (RFC 1918)
125
127.0.0.1 is what type of IP address?
Loopback
126
Will you have to calculate subnets for the CISSP exam?
No.
127
Allows bigger networks to become smaller, more segmented and manageable networks.
Subnetting/CIDR
128
Does not require network address translation as it has its own configuration administration.
IPv6
129
Cabling with high transmission speeds, not susceptible to EMI, and can go for extended distances.
Fiber-optic cable
130
Contains large glass cores, can carry more data than single mode in fiber optic cables.
Multimode
131
This kind of cabling interference can be caused by other wires, microwaves, motors, computers, or other types of electronics.
Noise
132
The weakening and eventual loss of a signal.
Attenuation
133
802.3
Ethernet
134
When you hear conversations on your electronic device from another electronic device
Crosstalk
135
The most common network topology
Star Topology
136
CSMA/CA
Carrier sense multiple access with collision avoidance
137
Computers which all receive a Layer 2 broadcast frame are all in this type of domain.
Broadcast.
138
FDDI
Fiber Distributed Data Interface
139
Protocol which assigns IP addresses.
DHCP
140
Protocol used by ping
ICMP
141
Protocol for Internet mail servers which can send and receive email
Post Office Protocol
142
Protocol that does not download messages from an email server and erase them
IMAP
143
192.168.255.22 is an example of a Class _____ network
C
144
172.16.0.66 is an example of a Class _____ network
B
145
10.255.255.255 is an example of a Class ____ network
A
146
If someone said they were having IP connectivity issues, which layer of the OSI Model would you look at first?
Network Layer
147
Type of firewall that has the ability to look at the entire packet, not just the source and destination address and associated ports
Application-Level Proxy Firewalls
148
These types of firewalls remember the state of a connection, and has become the de facto standard. It was first created by Checkpoint.
Stateful
149
IDS is a technical _____________ control
Detective
150
A firewall with two interfaces is said to be __________
dual-homed
151
A type of proxy that does not have the ability to perform deep packet inspection, and operates at the session layer
Circuit-level proxy
152
Firewalls that can examine the relationship between previous and current network packets are known as _______ filtering firewalls
Stateful
153
Firewalls that can only examine the source, destination, and port are known as _______ filtering firewalls
packet
154
Firewalls which have two interfaces
Dual-homed firewalls
155
A server or a firewall designed to receive inbound network attacks
bastion host
156
A storage area network combined with backup tapes would provide a high degree of ______
availability/redundancy
157
Provides integrity through well-formed transactions
Clark-Wilson Model
158
CPTED
Crime Prevention Through Environmental Design
159
This algorithm uses less computing power and offers more security
Elliptical Curve Cryptography
160
The most common type of intrusion detection system
Signature-based
161
An architecture in which multiple segmented networks are separated by two or more firewalls
Three-tier deployment
162
The concept of providing security to a local device, to a local host whether it is connected to the network or not
Endpoint security
163
A remote encrypted connection for users connecting to the corporate headquarters externally
Virtual Private Network
164
When two transmissions collide on a transmission medium meant for one connection
Collision
165
An environment which communicates only using MAC addresses (Layer 2 of the OSI Model)
Broadcast domain
166
A device in the middle of the same broadcast domain which repeats traffic from multiple systems
Hub
167
PSTN
Public switched telephone network
168
Also known as a store and forward device
Bridge
169
An intelligent hub
Switch
170
A device that connects two different networks together
Router
171
A type of firewall which receives traffic only from the router in front of it, and then sends the packets to the internal host(s)
Screened host
172
An intangible firewall
Virtual firewall
173
Firewall company the created the stateful filtering firewall
Checkpoint
174
Firewall company that boasts a single-pass architecture and named after a city in California
Palo Alto
175
A type of proxy firewall that can look into the sequence numbers of a TCP packet
Application-level proxy
176
Total number of connections created by a proxy when a host tries to connect to a web server
4 connections. One from the host to the proxy, one from the proxy to the web server, one from the web server to the proxy, and one from the proxy to the host
177
A type of attack which creates Instability caused by malformed fragments
Teardrop attack
178
The first and implicit rule for a firewall
Implicit deny rule
179
Type of rules you create and put on a firewall, and not ones that are already built into the firewall
Explicit rules
180
A firewall rule that logs and drops traffic and is usually at the bottom of the rule base
Cleanup rule
181
Allowing excessive half-connected TCP sessions to overflow the NIC buffer can cause this attack on availability
Denial of service
182
Sharing your private key with someone else can destroy ___________
Confidentiality
183
A firewall rule that drops any connections directed only at the firewall
Stealth rule
184
A computer used to study the techniques, attack styles, and tactics of attackers utilizing various exploits
Honeypot
185
A device capable of providing multiple security services such as threat prevention, VPNs, stateful filtering, IDS/IPS, or DLP
UTM (Unified Threat Management)
186
If in a company there is a single point of failure, then there needs to be ________
redundancy / high availability / fault-tolerance
187
Max speed of 1000Base-T
1 Gbps
188
Type of cable which has zero susceptibility to EMI
Fiber-optic
189
Type of cable that has a PVC shielding around four pairs of wires twisted around each other
Twisted-Pair
190
Most common type of unshielded twisted-pair cable
CAT 5
191
Degradation of a signal
Attenuation
192
A standard best practice rule when designing and allocating network repeaters, concentrators and segments
5-4-3 Rule
193
Lines which are dedicated to carry voice and data over trunk lines
T-carriers
194
CSU/DSU
Channel service unit/data service unit
195
A type of switching which sets up a dedicated virtual link between two systems. May experience fixed delays and travels in a constant and predictable manner.
Circuit switching
196
A type of switching that sets up a connection which can pass through several links on the way to the destination. Consists of variable delays.
Packet switching
197
VoIP
Voice over Internet Protocol
198
A dedicated WAN link technology which is obsolete now, but should be known for the CISSP exam.
Frame Relay
199
QOS
Quality of service. It is a way to make some data processes faster than others. For example, voice data needs to be faster and higher priority for meetings and conferences.
200
A weakness of PAP (Password Authentication Protocol)
Cleartext passwords
201
Three components of the first phase of the BCP/DRP
Policy, scope, implementation
202
BIA
Business Impact Analysis
203
A site which will meet the requirement of an MTD of 1-2 hours
Hot site
204
A cloud service where the tenant is responsible for software, hardware, upgrades, licenses, and their own security except for the actual physical security
Infrastructure as a Service (IaaS)
205
A type of cloud service which provides an operating system such as Windows Server 2003
Platform as a Service
206
An employee drug test is this type of control
Administrative preventative
207
A governance and management framework created by ISACA
Control Objectives for Information and related Technology (COBIT)
208
Designed to improve an organization's process and the posture of their security program
Capability Maturity Model Integration
209
Computer crime laws are also known as this
Cyberlaw
210
When an actual computer was used to carry out a crime
Computer-assisted crime
211
Logs which record events such as reboots and stopped/started services.
System logs
212
Logs which record ingress and egress network traffic along with source/destination IP address and source/destination port numbers.
Firewall logs
213
Logs which can record how long a user has been on a specific website, and when a user has gone to an unauthorized website
Proxy logs
214
Logs which contain when changes have been made to a firewall, who approved it, and who implemented it
Change logs
215
The amount of time data is backed up, stored or preserved from destruction
Retention period
216
Tool used to discover open ports on a system either locally or remotely
Nmap
217
Two web server ports
80/443
218
A SYN packet receives a _________ back
SYN/ACK
219
Tool used to easily launch DDOS in MSSQL attacks
Metasploit
220
Sets the archive bit to 1 for a file which has changed for backup
Incremental backups
221
Leftover risk after implemented controls
Residual risk
222
The probability of a threat using an exploit to expose a vulnerability
Risk
223
Document which makes sure that the project or plan about to be implemented doesn’t involve things that waste our time and resources
Scope
224
The process of identifying the business functions of an organization and prioritizing them from most important, to least important.
Business Impact Analysis
225
The group who plans the BCP/DRP
BCP Committee
226
Using instinct, experience, and wisdom to calculate risk
Qualitative analysis
227
Using numbers, calculations, and math to calculate risk
Quantitative analysis
228
Point of time before a disaster from which data needs to be recovered.
Recovery Point Objective
229
Recovery of services from initial disaster to recovery, but still within the Maximum Tolerable Downtime.
Recovery Time Objective
230
Critical business resources support critical business ________
Functions
231
A backup site to a backup site
Tertiary site
232
Infrequent backups sent to an offsite facility
Electronic Vaulting
233
Has a faster data recovery time than electronic vaulting
Remote Journaling
234
Data is being backed up at the same time it is being received
Remote Mirroring
235
A duplicate site with the same content, but not the same web address
Mirror Site
236
Files which are backed up since the last full backup, and the archive bit may not be set back to zero
Differential backup
237
Definition of when immediate operations are back after a disaster
Recovery
238
Definition of when all organizational functions are back after a disaster
Restoration
239
Occurs before a disaster
Testing
240
Occurs after a disaster
Implementation
241
Someone or something which has identified a vulnerability, and will proceed to exploit it
Threat
242
An specific entity which takes advantage of a vulnerability
Threat agent
243
A risky BCP/DRP test which requires a business impacting halt to production
Full-interruption test
244
A disaster which is recreated at an alternate site
Parallel test
245
Testing which involves a round table discussion
Structured-walkthrough
246
The level of importance for knowing BCP/DRP for the CISSP exam
High
247
IPSec provides confidentiality through _______
Encryption
248
IPSec secures data in _______
Motion
249
One of the least favorite yet critical task for an information security professional
Updating documentation
250
The collection of all software, hardware, firmware within a system which work in conjunction to provide and enforce the overall security policy
Trusted Computing Base
251
Penetration testing will look for vulnerabilities and also do this
Exploit them
252
A great framework to keep your organization's information security management in line with best practices. It is optional, not obligatory.
ISO 27001
253
The results of a penetration test should be sent to this group.
Senior management
254
There's only one way to send the findings of a penetration test.
Securely
255
The difference between hacking and penetration testing
Permission
256
The next thing to implement after issuing organization policies
Controls
257
These require constant tests and reviews
Policies and BCP/DRP
258
New CAT exam questions may include these terms
MOST, LEAST, BEST
259
Two high-level terms to think about constantly during the exam
Risk and cost
260
COBIT deals with which concept of the CIA Triad
Integrity
261
IAAA
Identification, Authorization, Authentication, Accountability
262
What each must bring to the table, otherwise the secret does not open, reveal, or unlock
Split-knowledge
263
Everything requires management understanding, support, initiation, and _______
approval
264
Anti-virus is a type of ________ security
endpoint
265
Backups can provide both availability and _______
integrity
266
Man in the middle attacks compromise both confidentiality and _________
integrity
267
Virtual private networking technology that allows private data and IP addresses over an insecure medium
IPSec
268
The most important component of BCP/DRP
Documentation
269
Web encryption techniques
SSL/TLS/VPN
270
Defining organization security policies upholds these three concepts
Confidentiality, integrity, and availability
271
To meet standards and compliance an organization needs _____
audits
272
Outdated software, lack of updates, no patching, misconfigurations all present ________
risk
273
OSPF and BGP routing protocols can uphold the concept of _______
availability
274
Billions of devices part of a group which can come with default credentials and difficult to patch. Can be used for DDOS
Internet of Things
275
Shutting down a computer, releasing all volatile memory, and starting it up again
Cold boot
276
In order to prove authenticity of a website on the Internet we use _______
SSL certificates
277
An organization can use its own internal certificate for internal vendors or users who are part of a ________ identity
federated
278
Security always starts off with _______
policy
279
In order to have BCP/DRP in an organization, senior management must be first convinced it would cost _______ to not have one. That is the key.
more
280
A CISO must perform __________ in order to verify and check the effects of controls, BCP/DRP, and other pending policies for approval.
due diligence
281
Directive, deterrent, preventative, corrective, recovery, and ________ controls
compensating
282
A proper change management process should include the necessary procedures in case a change needs to be ______ back
rolled
283
Recommended controls should be testable, provide accountability, consistent (integrity), overrides for privileged operators (confidentiality) and measures to be fail-safe (________)
availability
284
An organization's business goals should come ____ and security should come ______.
first/second
285
Ultimately responsible for the confidentiality of classified data
Data owner
286
Implements the protections and controls for the system and the data. Receives instructions from the data owner.
Data custodian
287
Takes into account critical business functions and provides corrective or recovery measures to minimize disruption
Business Continuity Planning
288
Management tool which can help identify cost and the effectiveness of implemented controls
Metrics
289
Policies are this type of strategy
Directive
290
Objects = labels, Subjects = _______
clearances
291
Bugs and vulnerabilities found in the original version of software which has not been updated yet due to it not being sold yet.
Shrink Wrap Attack
292
Holds all the credentials for users utilizing SAML, and can be a single point of failure.
IDP - Identity Provider
293
Can disrupt communications over the wire and even mask or scramble an attack
Crosstalk
294
A primary concern in implementing biometrics is user ________
acceptance
295
An attack with the same source and destination IP addresses
Land Attack
296
The primary result of a Land Attack is a _____-
denial of service
297
Unplugging the power cable to a server is a form of ________
denial of service
298
Network security device which can hide the identity of internal network clients
Proxy
299
Networking technique which can hide the identity of internal network clients
Network Address Translation
300
Injection using
Cross-site scripting
301
Instead of mathematics, quantum cryptography uses _______ for key exchange
photons
302
When two entities come together with their own partial secret to open a master secret, it is known as _________
split-knowledge
303
Encryption turns plaintext secrets into ______
ciphertext
304
Batman uses _______ bit encryption for his communications with the Batcave, allies, and vehicle communication
4096
305
Technique which rearranges the plaintext message
transposition
306
Security guards and dogs are this type of control
Physical deterrent (and can also be the most expensive control i.e. salaries, dog training, and dog treats :) )
307
Physical limitation of the Internet of Things devices
Lack of CPU or RAM power to provide encryption calculations
308
The 10.x private IP range
10.0.0.0 to 10.255.255.255.255
309
Sender cannot deny sending the message
Nonrepudiation
310
QKD
Quantum Key Distribution
311
Hashing and encryption are a part of ________
cryptography
312
variable length message converted to fixed length message
hashing
313
The Caesar Cipher used this block cipher technique
Substitution
314
Type of memory that temporarily holds data
RAM
315
Type of memory that can permanently store data
ROM
316
Creating a preset scenario and environment in which a victim has an increased chance of handing over confidential information
Pretexting Attack (ISC2 Fourth Edition book)
317
CDs and USB flash drives are left at a location to conduct this type of attack
Baiting Attack
318
Three types of cloud solutions
IaaS, PaaS, SaaS
319
Provides bare metal or the very basic infrastructure resources to a cloud tenant
Infrastructure as a Service
320
A security professional may need to perform inspection, review and assessment to confirm ______
assurance
321
The most important question to ask when studying for the CISSP exam and while taking the exam itself
Why?
322
Rests on the belief of these three concepts: technology, analysis, mythology
Big Data
323
The sharing of computing resources across a network in which multiple machines function as one large computer
Grid computing
324
The ability for cloud tenants to spin up new virtual machines if their organization is increasing in size, or shut down previous virtual machines if their organization is decreasing their infrastructure.
Elasticity
325
Type of cloud in which a tenant is confident they are not sharing a pool of resources with other tenants
Private cloud
326
Risky issue when different encryption keys used to encrypt plaintext also produces the same ciphertext. This is not good.
Key clustering
327
Type of cloud most used by military or governments
Private cloud
328
When different hashed plaintext produces the same ciphertext
Collision
329
Venom Snake discovered his true identity from an ______________ cassette tape
encoded
330
Substitution exchanges characters, while transposition ______ letters
scrambles
331
The amount of time and effort it takes to crack an encryption key. The time and effort to decide if it's worth it or not.
Work factor
332
Another term for ciphertext
Cryptogram
333
CBC depends on each previous block for encryption. But what does it do to encrypt the very first block?
Initialization Vector
334
Bit-by-bit encryption
Stream cipher (RC4, WEP)
335
Block-by-block encryption
Block cipher
336
Variable-length message turned into a fixed-length message
Hashing
337
Variable-length message turned into another variable-length message
Encryption
338
Was the Caesar cipher mono or poly alphabetic?
Mono (It was just 1 alphabet)
339
The Vernam cipher is used for this unbreakable style of encryption
One-Time Pad
340
Symmetric ciphers can use ___________ key distribution
out of band
341
This block cipher mode requires an initialization vector because of its chaining process
Cipher Block Chaining
342
This symmetric algorithm was broken using a known-plaintext attack, the simplest of cryptographic attacks.
DES
343
Ron Rivest, Adi Shamir, Len Adleman
RSA
344
Has the highest strength key length of all the asymmetric encryption algorithms
Elliptic Curve Cryprography (ECC)
345
Allows the exchange of assertions between identity management systems between federated identity web environments
Security Assertion Markup Language (SAML)
346
These are more commonly hashed and salted on a system and not encrypted, lacking decryption keys
Password files
347
This is used to prevent a user from changing a message and state the altered message came from the sender
Digital signatures
348
When data packets are decrypted and re-encrypted at each node along a communications channel
Link encryption
349
The architecture of a system which distributes public certificates, verifies public keys are tied to a certain organization, and verify the public keys
Public Key Infrastructure (PKI)
350
Requires actual collusion to complete the process
Dual Control
351
Approves data release or disclosure
Data owner
352
Regulation, data mapping, data classification
Data retention policies in the cloud
353
The first step of the cyber kill chain
Reconnaissance
354
Eavesdropping without affecting the communications medium, system, or protocol
Passive attack
355
Message alteration, system file modification, masquerading
Active attacks
356
Responsible for implementing RAID to maintain the data
Data custodian
357
Scope, classification, assurance, marking and labeling
Data classification requirements
358
DEP, ASLR, ACL
Memory Protection
359
Fence jumping, badge cloning, lock bypass, lockpicking, dumpster diving
Physical security facility attacks
360
The last stage of the penetration testing process
Reporting
361
Backup method which ensures no single point of failure with parity written to all drives
RAID5
362
Not a cost-efficient backup method involving RAID mirroring
RAID1
363
Detailed actions for personnel to follow
Procedures
364
A commonality or pattern within an organization
Standards
365
Mark Zuckerberg testifying in front of Congress
Senior management is ultimately responsible
366
Proving a system does what it is supposed to do
Certification
367
Making sure a system provides high-level testing, inspection, analysis and reviews.
Assurance
368
The formal approval to introduce a system into an organization
Accreditation
369
Responsible for the security elements within an enterprise which work to uphold business processes
The security professional
370
Develops disaster recovery plans which could impact the organization
Business Continuity Planner
371
Not collecting any private information in the first place
Rejecting the risk
372
Not installing your Windows Updates even though you know you should
Accepting the risk
373
The only time it might be a good idea to share your password with someone else
Under investigation by law enforcement
374
Code which requires a trigger to be executed
Logic bomb
375
The weakest component of an organization
People
376
Everything in an organization begins with this
Policy
377
Type of cloud where resources are shared with other tenants
Public cloud
378
Company that sells books and cloud computing space
Amazon
379
Currently the best way to detect man in the middle attacks
Quantum cryptography
380
Fourth canon of the CISSP Code of Ethics
Advance and protect the profession
381
Bringing in a crime scene investigator is this type of control
Physical detective
382
Exit interviews are this type of control
Administrative detective
383
Firewalls are this type of control
Technical preventative
384
Tenant takes full responsbility in this type of cloud service model
Infrastructure as a Service
385
Public, Private, Hybrid, Community
Cloud deployment models
386
One of security's biggest enemies
Complexity
387
Security compromises of projects, but is part of an overall ______
program
388
Group that doesn't understand DDOS, but only the numbers, figures, and risks behind it
Senior management
389
Overrules the rules of the organization
Law of the land
390
Group which is part of the overall part of the security program
Everyone
391
Data not to be decrypted by an organization
Employee financial and health data
392
Release date of AIO CISSP study guide by Shon Harris 8th Edition
22-Oct-18
393
Renting or leasing Windows Server 2012 from the cloud
Software as a Service
394
How the cloud exists and why it is utilized
Concepts to know for the exam
395
Best way to get rid of CD-ROM data
Physical destruction
396
Data left over even after erasure
Data remanence
397
Testing which takes place after an update or change
Regression testing
398
Investing in a test case before committing full financial resources to software code
Prototyping
399
Software model which allows risk analysis and feedback per iteration
Spiral Model
400
Used in databases to restrict access to only authorized users. Also a Drake album.
Views
