Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Mindmap and 11th Hour > Domain 3 > Flashcards

Domain 3 Flashcards

1
Q

A security model that prevents a secret cleared subject from reading a top secret object. Also includes ‘no read up’ rule and focuses on protecting confidentiality

A

Bell-Lapadula

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Biba is a model that protects _____

A

integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This security model is ‘no read down’ and ‘no write up’

A

BIba

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This security model protects integrity by requiring subjects to access objects via programs. It focuses on having well formed transactions and separation of duties and access triple

A

Clark-Wilson

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This security model is designed to avoid conflicts of interest by prohibiting one person from accessing multiple conflict of interest categories

A

Chinese Wall aka Brewer Nash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A table that defines the access permissions that exist between specific subjects and objects

A

access control matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A list of objects a subject is allowed to access

A

security domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Processes communicate between CPU rings via _____ which allows processes to communicate with the kernel and provide a window between the rings

A

system calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The ____ is the computer’s case that houses the computer’s internal electronic computer components ex: motherboard

A

system unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This part of the CPU performs mathematical calculations

A

ALU (arithmetic logic unit)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The ALU is fed instructions by the ____ unit.

A

control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the ‘fetch and execute’ (aka FDX) steps?

A
  1. Fetch Instruction 1
  2. Decode Instruction 1
  3. Execute Instruction 1
  4. Write (save) Result 1
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

_____ combines multiple CPU steps into one process

A

pipelining

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A parent process can spawn additional child processes called ____

A

threads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

____ segmentation maps processes to specific memory locations

A

hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

_____ provides virtual address mapping between applications and hardware memory

A

virtual mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

____ uses virtual memory to to copy contents of primary memory (RAM) to secondary memory (CD)

A

Swapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

This storage can be written to once and read many times

A

WORM (write once, read many)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

____ attempts to prevent code execution in memory locations that are not predefined to contain executable content

A

DEP (data execution prevention)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

____ makes software exploitation more difficult by randomizing memory addresses

A

ASLR (address space location randomization)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

____ mediates all access between subjects and objects and is ran by the kernel

A

reference monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Malware that needs a host

A

virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Malware that self propogates

A

worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A neutral technology used to shrink the size of executables

A

packer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

____ are small pieces of mobile code embedded into web browsers that are executable and typically written in Java or ActiveX

A

Applets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Database ____ allows two objects to have the same name. Ex: two rows have the same primary key but different data

A

polyinstantiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

___ means the order of plaintext should be dispersed in the ciphertext

A

diffusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

___ means that the relationship between the plaintext and the ciphertext should be as confused or random as possible

A

confusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

___ replaces one character for another to provide confusion

A

substitution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

____ also called transposition provides diffusion by rearranging the characters of the plaintext.

A

permutation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How long it will take to break a cryptosystem is called

A

work factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

prolonged loss of power

A

blackout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

prolonged low voltage

A

brownout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

short loss of power

A

fault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

prolonged high voltage

A

surge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

temporary high voltage

A

spike

37
Q

temporary low voltage

A

sag

38
Q

This person ensures that all personnel safely evacuate the building in the event of an emergency or drill

A

safety warden

39
Q

This person assures that all personnel are accounted for at the emergency meeting point

A

meeting point leader

40
Q

Class B fires should be extinguished with

A

Gas or soda acid. never use water

41
Q

Class C fires should be extinguished with

A

Gas. never water or soda acid

42
Q

Class D fires should be extinguished with

A

Dry powder

43
Q

Class K fires should be extinguished with

A

Wet chemicals

44
Q

___ is an enterprise security architecture

A

Zachman

45
Q

defines a risk driven Enterprise security architecture model that is

A

Sabsa

46
Q

Enterprise security architecture that helps break down organizations to integrate security

A

TOGAF

47
Q

defines different layers of confidentiality or integrity and then defined rules about
what can be read or written between the layers to maintain confidentiality or integrity

A

Lattice based

48
Q

Bell-LaPadula and Biba combined

A

Lipner

49
Q

Graham Denning and Harrison Ruzzo Ullman are ___ based models

A

rule

50
Q

Provides best practice information for information systems and defines the controls

A

ISO 27001

51
Q

Provides implementation of ISO 27001 controls

A

ISO 27002

52
Q

Security and privacy Controls for US and federal agencies

A

NIST 800-53

53
Q

Useful for IT audit and assurance work created by IT auditors

A

COBIT

54
Q

Focuses on financial fraud

A

COSO

55
Q

Defines standards and best practices for delivering IT services aligned with business goals and objectives

A

ITIL

56
Q

Provides structured process for managing security and privacy

A

NIST 800-37

57
Q

What are the 6 RMF steps?

A

security categorization
security control selection
security control implementation
security control assessment
information system authorization
and security control monitoring

58
Q

True or False

ISO 31000, COSO, ISACA Risk IT are frameworks based on risk management

A

True

59
Q

The older criteria evaluation that certifies single boxes only and verifies confidentiality

A

TC SEC (orange book)

60
Q

The older criteria evaluation that certifies single boxes only and verifies confidentiality

A

TC SEC (orange book)

61
Q

Collection of all protection mechanisms to protect a system

A

TCB (trusted computing base)

62
Q

___ storage is volatile

A

primary

63
Q

____ storage is non-volatile

A

secondary

64
Q

When an application checks the state of a resource before using that resource

A

TOCTOU (time of check, time of use) aka race conditions

65
Q

How to mitigate TOCTOU?

A

Increase frequency of re-authentication

66
Q

____ blocks emanation from a system

A

Shielding (TEMPEST)

67
Q

Placing high value systems in a physically secured zone

A

control zones

68
Q

How to prevent against improper platform usage?

A

secure coding and configuration management

69
Q

How to prevent against insecure data storage? (mobile)

A

dont store sensitive data on a mobile device

70
Q

How to prevent against insecure communication?

A

encryption and authentication with certificates

71
Q

most common form of cross site scripting?

A

reflected

72
Q

Who is the target of attack in XSS attacks?

A

The client (the users browser)

73
Q

Who is the target of attack in cross site request forgery attacks?

A

the server

74
Q

Who is ultimately responsible for the protection of any data and services they outsource to the cloud?

A

the customer

75
Q

A protocol that provides both authentication and authorization in federated access

A

SAML

76
Q

56 bit keys, 64 bit block, 16 round

A

DES

77
Q

Uses 3 56 bit keys (168 bits)

A

3DES

78
Q

128, 192, 256 key lengths, 128 bit blocks

A

AES

79
Q

CAST 128 is

A

symmetric, block

80
Q

SAFER is

A

symmetric, block

81
Q

RC4 is

A

a symmetric stream cipher

82
Q

These crypto algorithms rely on discrete log

A

diffie hellmann, elliptic curve, el gamal, DSA

ECC is very efficient

83
Q

Which role in the CA issues certificates?

A

issuing ca

84
Q

This algorithm uses factoring

A

RSA

85
Q

Torturing someone to get the key

A

rubber hose

86
Q

clean filtered air will be blown into
the data center at slightly above ambient pressure thus ______ the data center

A

positively pressurizing

86
Q

clean filtered air will be blown into
the data center at slightly above ambient pressure thus ______ the data center

A

positively pressurizing

87
Q

which fire system will detect a fire as early as possible?

A

ionization

88
Q

Class C fire extinguishers use ___ to suppress fires

A

co2

CISSP Mindmap and 11th Hour (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions