Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP Mindmap and 11th Hour > Domain 3 > Flashcards

Domain 3 Flashcards

1
Q

A security model that prevents a secret cleared subject from reading a top secret object. Also includes ‘no read up’ rule and focuses on protecting confidentiality

A

Bell-Lapadula

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Biba is a model that protects _____

A

integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This security model is ‘no read down’ and ‘no write up’

A

BIba

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This security model protects integrity by requiring subjects to access objects via programs. It focuses on having well formed transactions and separation of duties and access triple

A

Clark-Wilson

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This security model is designed to avoid conflicts of interest by prohibiting one person from accessing multiple conflict of interest categories

A

Chinese Wall aka Brewer Nash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A table that defines the access permissions that exist between specific subjects and objects

A

access control matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A list of objects a subject is allowed to access

A

security domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Processes communicate between CPU rings via _____ which allows processes to communicate with the kernel and provide a window between the rings

A

system calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The ____ is the computer’s case that houses the computer’s internal electronic computer components ex: motherboard

A

system unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This part of the CPU performs mathematical calculations

A

ALU (arithmetic logic unit)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The ALU is fed instructions by the ____ unit.

A

control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the ‘fetch and execute’ (aka FDX) steps?

A
  1. Fetch Instruction 1
  2. Decode Instruction 1
  3. Execute Instruction 1
  4. Write (save) Result 1
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

_____ combines multiple CPU steps into one process

A

pipelining

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A parent process can spawn additional child processes called ____

A

threads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

____ segmentation maps processes to specific memory locations

A

hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

_____ provides virtual address mapping between applications and hardware memory

A

virtual mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

____ uses virtual memory to to copy contents of primary memory (RAM) to secondary memory (CD)

A

Swapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

This storage can be written to once and read many times

A

WORM (write once, read many)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

____ attempts to prevent code execution in memory locations that are not predefined to contain executable content

A

DEP (data execution prevention)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

____ makes software exploitation more difficult by randomizing memory addresses

A

ASLR (address space location randomization)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

____ mediates all access between subjects and objects and is ran by the kernel

A

reference monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Malware that needs a host

A

virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Malware that self propogates

A

worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A neutral technology used to shrink the size of executables

A

packer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
____ are small pieces of mobile code embedded into web browsers that are executable and typically written in Java or ActiveX
Applets
26
Database ____ allows two objects to have the same name. Ex: two rows have the same primary key but different data
polyinstantiation
27
___ means the order of plaintext should be dispersed in the ciphertext
diffusion
28
___ means that the relationship between the plaintext and the ciphertext should be as confused or random as possible
confusion
29
___ replaces one character for another to provide confusion
substitution
30
____ also called transposition provides diffusion by rearranging the characters of the plaintext.
permutation
31
How long it will take to break a cryptosystem is called
work factor
32
prolonged loss of power
blackout
33
prolonged low voltage
brownout
34
short loss of power
fault
35
prolonged high voltage
surge
36
temporary high voltage
spike
37
temporary low voltage
sag
38
This person ensures that all personnel safely evacuate the building in the event of an emergency or drill
safety warden
39
This person assures that all personnel are accounted for at the emergency meeting point
meeting point leader
40
Class B fires should be extinguished with
Gas or soda acid. never use water
41
Class C fires should be extinguished with
Gas. never water or soda acid
42
Class D fires should be extinguished with
Dry powder
43
Class K fires should be extinguished with
Wet chemicals
44
___ is an enterprise security architecture
Zachman
45
defines a risk driven Enterprise security architecture model that is
Sabsa
46
Enterprise security architecture that helps break down organizations to integrate security
TOGAF
47
defines different layers of confidentiality or integrity and then defined rules about what can be read or written between the layers to maintain confidentiality or integrity
Lattice based
48
Bell-LaPadula and Biba combined
Lipner
49
Graham Denning and Harrison Ruzzo Ullman are ___ based models
rule
50
Provides best practice information for information systems and defines the controls
ISO 27001
51
Provides implementation of ISO 27001 controls
ISO 27002
52
Security and privacy Controls for US and federal agencies
NIST 800-53
53
Useful for IT audit and assurance work created by IT auditors
COBIT
54
Focuses on financial fraud
COSO
55
Defines standards and best practices for delivering IT services aligned with business goals and objectives
ITIL
56
Provides structured process for managing security and privacy
NIST 800-37
57
What are the 6 RMF steps?
security categorization security control selection security control implementation security control assessment information system authorization and security control monitoring
58
True or False ISO 31000, COSO, ISACA Risk IT are frameworks based on risk management
True
59
The older criteria evaluation that certifies single boxes only and verifies confidentiality
TC SEC (orange book)
60
The older criteria evaluation that certifies single boxes only and verifies confidentiality
TC SEC (orange book)
61
Collection of all protection mechanisms to protect a system
TCB (trusted computing base)
62
___ storage is volatile
primary
63
____ storage is non-volatile
secondary
64
When an application checks the state of a resource before using that resource
TOCTOU (time of check, time of use) aka race conditions
65
How to mitigate TOCTOU?
Increase frequency of re-authentication
66
____ blocks emanation from a system
Shielding (TEMPEST)
67
Placing high value systems in a physically secured zone
control zones
68
How to prevent against improper platform usage?
secure coding and configuration management
69
How to prevent against insecure data storage? (mobile)
dont store sensitive data on a mobile device
70
How to prevent against insecure communication?
encryption and authentication with certificates
71
most common form of cross site scripting?
reflected
72
Who is the target of attack in XSS attacks?
The client (the users browser)
73
Who is the target of attack in cross site request forgery attacks?
the server
74
Who is ultimately responsible for the protection of any data and services they outsource to the cloud?
the customer
75
A protocol that provides both authentication and authorization in federated access
SAML
76
56 bit keys, 64 bit block, 16 round
DES
77
Uses 3 56 bit keys (168 bits)
3DES
78
128, 192, 256 key lengths, 128 bit blocks
AES
79
CAST 128 is
symmetric, block
80
SAFER is
symmetric, block
81
RC4 is
a symmetric stream cipher
82
These crypto algorithms rely on discrete log
diffie hellmann, elliptic curve, el gamal, DSA ECC is very efficient
83
Which role in the CA issues certificates?
issuing ca
84
This algorithm uses factoring
RSA
85
Torturing someone to get the key
rubber hose
86
clean filtered air will be blown into the data center at slightly above ambient pressure thus ______ the data center
positively pressurizing
86
clean filtered air will be blown into the data center at slightly above ambient pressure thus ______ the data center
positively pressurizing
87
which fire system will detect a fire as early as possible?
ionization
88
Class C fire extinguishers use ___ to suppress fires
co2

CISSP Mindmap and 11th Hour (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions