Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 Part 2 > Flashcards

Domain 1 Part 2 Flashcards

1
Q

Three important access control concepts.

A

Subjects, objects, access permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Entities that may be assigned permissions.

A

Subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Types of resources that subjects may access.

A

Objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Relationships between subjects and the objects they may access.

A

Access permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Four phases of access control.

A

Identification, authentication, authorization, accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

User makes a claim as to his or her identity.

A

Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

User proves his or her identity using one or more mechanisms.

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

System makes decisions about what resources the user is allowed to access and the manner in which they may be manipulated.

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

System keeps an accurate audit trail of the users activity.

A

Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Contains access control entities (ACEs) that correspond to access permissions.

A

Access control list (ACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Four types of access control systems.

A

MAC, DAC, NDAC (RBAC), LBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Authorization of the subjects access to an object depends on labels which indicate a subjects clearance and the classification or sensitivity of the related object

A

Mandatory access control (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Access control type where the subject has authority to specify what objects can be accessible.

A

Discretionary access control (DAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Access control type where the Administrator determines which subjects can have access to certain objects based on an organizations security policy.

A

Non-discretionary access control (NDAC) also known as role based access control (RBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Access control type where the administrator specifies upper and lower bounds of the authority for each subject and uses those boundaries to determine access permissions.

A

Lattice based access control (LBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Five types of access controls.

A

Preventative, detective, corrective, deterrent, compensatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Controls designed to prevent unwanted activity from occurring.

A

Preventative controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Type of controls that provide a means of discovering unwanted activities that have occurred.

A

Detective controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Controls that are mechanisms for bringing a system back to its original state prior to the unwanted activity.

A

Corrective controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Control type used to discourage individuals from attempting to perform undesired activities.

A

Deterrent controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Control type implemented to make up for deficiencies in other controls.

A

Compensatory controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Three categories of access control.

A

Administrative, logical/technical, physical.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Controls constituting policies, procedures, disaster recovery plans, awareness training, security reviews and audits, background checks, reviews of vacation history, separation of duties, and job rotation.

A

Administrative controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Control type that restricts access to systems and the protection of information.

A

Logical/technical controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Type of controls used to protect access to the physical facilities housing information systems.

A

Physical controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

States that the subjects of an access control system should have the minimum set of access permissions necessary to complete their assigned job functions.

A

Principle of least privilege

27
Q

The ability to perform critical system functions should be divided among different individuals to minimize the risk of collusion.

A

Separation of duties

28
Q

Users should only have access to information that they have a need to know to perform their assigned responsibilities.

A

Need to know

29
Q

Users gain different access permissions as they move from position to position in an organization but old permissions are not revoked.

A

Privilege creep

30
Q

A central authentication and/or authorization point for an enterprise.

A

Centralized access control system

31
Q

A series of diverse access control systems at different points throughout the enterprise.

A

Decentralized access control systems

32
Q

Technology that enables centralized authentication.

A

Single sign on (SSO)

33
Q

Software used on a network to establish a users identity.

A

Kerberos

34
Q

Three components of kerberos

A

Key distribution center (KDC), Authentication service (AS), Ticket granting service (TGS)

35
Q

A public key based alternative to kerberos

A

SESAME

36
Q

Three authentication factors.

A

Something you know, something you have, something you are

37
Q

Using at least two authentication factors.

A

Two-factor authentication

38
Q

The most commonly implemented authentication technique.

A

Passwords

39
Q

Four different kinds of tokens

A

Static password, synchronous dynamic password, asynchronous dynamic password, challenge-response token

40
Q

Token type where the owner authenticates himself to the token and the token authenticates the owner to the system.

A

Static password token

41
Q

Token type where the token generates a new unique password at fixed time intervals, user enters a unique password and user name into the system, and the system confirms that the password and user name are correct and were entered during the allowed time interval.

A

Synchronous dynamic password token

42
Q

Same as the synchronous dynamic password token except no time dependency.

A

Asynchronous dynamic password token

43
Q

Token type where there is a system or workstation generated random number challenge, owner enters string into token with the proper PIN, and the token generates a response that is entered into the system.

A

Challenge-response token

44
Q

The percentage of cases in which a valid user is incorrectly rejected by the system.

A

False rejection rate (FRR), also known as a Type I error

45
Q

The percentage of cases in which an invalid user is incorrectly accepted by the system.

A

False acceptance rate (FAR), also known as a Type II error

46
Q

The rate at which FRR=FAR for any given system.

A

Crossover error rate (CER)

47
Q

Three evaluation factors for biometric techniques.

A

Enrollment time, throughput rate, acceptability

48
Q

The amount of time that it takes to add a new user to a biometric system.

A

Enrollment time

49
Q

The number of users that may be authenticated to a biometric system per minute.

A

Throughput rate

50
Q

The likelihood that users will accept the use of a biometric technique.

A

Acceptability

51
Q

Six types of attack.

A

Brute force, dictionary, spoofing, denial of service, man in the middle, sniffer.

52
Q

The type of attack where the attacker simply guesses passwords until eventually succeeding.

A

Brute force attack

53
Q

Type of attack where the attacker uses the password encryption algorithm to encrypt a dictionary of common words and then compares the encrypted words to the password file.

A

Dictionary attack

54
Q

Type of attack where an individual or system poses as a third party.

A

Spoofing

55
Q

Type of attack where the system is flooded with traffic so that it cannot provide service to legitimate users.

A

Denial of service (DoS)

56
Q

Type of attack where the attacker can monitor all traffic occurring on the same network segment,

A

Sniffer

57
Q

An effective way to assess the security of a system.

A

Penetration test

58
Q

Two types of monitored environment for IDS.

A

Host based, network based

59
Q

Two types of detection methodology for IDS.

A

Signature based, Anomaly based

60
Q

IDS that resides on a single system and monitors the systems even log and audit trail for signs of unusual activity.

A

Host based IDS

61
Q

IDS that performs real time monitoring in a passive manner by monitoring all of the traffic on a specific network segment,

A

Network based IDS

62
Q

IDS that stores characteristics of an attack and then compares activity in a monitored environment to those characteristics.

A

Signature based IDS

63
Q

IDS that measures user, system, and network behavior over an extended period of time to develop baselines.

A

Anomaly based IDS

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions