Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 3: (Security Architecture and Engineering) > Flashcards

Domain 3: (Security Architecture and Engineering) Flashcards

1
Q

What treats user identity as the control plane and assumes compromise/breach in verifying every request?

A

Zero Trust Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What represents a default config reflects a restrictive and conservative enforcement of security policy?

A

Secure Defaults

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What indicates that components should fail in a state that denies rather than grants access?

A

Fail Securely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the secure design principles?

A

Secure Defaults
Fail Securely
Zero Trust Security
Keep it Simple

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What was created by the IAPP and represents making privacy an integral part of every system, technology, policy, and design process?

A

Privacy by Design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the seven principles of privacy by design by IAPP?

A

Proactive
Privacy as the default setting
Privacy must be embedded in the design
Privacy should be a positive-sum approach
End to end full lifecycle data protection
Visibility and transparency
Keep privacy user-centric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What represents a cloud provider concept in which security is provided to an org through or by an online entity?

A

Security-as-a-Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What represents a class of devices connected to the internet in order to provide automation, remote control, or AI processing in a home or business setting?

A

Internet of Things

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What represents mobile devices that offer customization options, typically through installing apps and may use on-device or in-the-cloud AI processing?

A

Smart Devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What represents a system that collects data from other sources on the network, provides real-time monitoring, traffic analysis & notification of potential attacks?

A

SIEM
Security Information and Event Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What represents a centralized alert and response automation with threat-specific playbooks?

A

SOAR
Security Orchestration Automation, & Response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the creation of discrete services that may be accessed by users in a black box fashion?

A

SOA
Service Oriented Archietchture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are fine-grained services with a discrete function and is a modern adaption of SOA to cloud computing?

A

Microservices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What should be identified early in the development lifecycle?

A

Code-level vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What techniques should be incorporated early in the CI/CD process to identify deficiencies before release?

A

Static code analysis
Dynamic testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What represents a lightweight, granular, and portable way to package apps for multiple platforms and doesn’t have their own operating system?

A

Containerization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What reduces overhead of server virtualization by enabling containerized apps to run on a shared OS kernel?

A

Containerization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a set of exposed interfaces that allow programmatic interaction between services?

A

APIs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What uses the HTTPS protocol for web communications to offer API end points?

A

REST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What must be done prior to storing, distributing, and transmitting access keys?

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is an embedded system?

A

The technology component of an IOT device

A full computer system embedded inside of another larger system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are examples of embedded systems?

A

Printers, GPS, drones, semi-autonomous vehicles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What must you consider when dealing with embedded devices to ensure they meet security best practices?

A

Authentication practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What represents an alternative to client-server computing model for computer-intensive operations w/ large data sets?

A

HPC
High Performance Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

For problems that require the use of extremely large data sets and large-scale parallel processing what type of system should you use?

A

High Performance Computing system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What employs a centralized controller that makes computing assignments to grid members?

A

Grid Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What do you use when you need to process data locally and far from the cloud?

A

Edge Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is common in various internet-of-things scenarios, like agricultural, science/space, and military?

A

Edge Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What places gateway devices in the field to collect and correlate data centrally at the edge?

A

Fog Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are some key considerations when dealing with large network-connected device counts in various locations?

A

Data Encryption
Spoofing Protection
Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What cloud service provides the building blocks of support for networking, storage, compute, and datacenters?

A

IaaS
Infrastructure as a service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What cloud service is where the customer is responsible for deployment and management of apps, while the cloud service provider manages provisioning, config, hardware, and OS?

A

PaaS
Platform as a service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What cloud service is where the customer only configures features while the cloud service provider supports everything else?

A

SaaS
Software as a service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What cloud service model allows scalability, agility, pay as you go, no maintenance, and low skills?

A

Public cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What cloud service model is managed by the organization and allows for legacy support, control, and compliance?

A

Private cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What cloud service model supports public and private clouds and run apps in the right location and allows for flexibility in legacy support, compliance, and scalability scenarios?

A

Hybrid cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is a security policy enforcement solution that may be installed on premises or in the cloud?

A

CASB
Cloud access security broker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What key algorithm is quantum resistant, and enables better resistance against quantum computing attacks?

A

Lattice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What encrypts each plaintext digit one at a time with the corresponding digit of the keystream?

A

Symmetric stream cipher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What method encrypts a block of data rather than one bit at a time?

A

Block cipher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What uses the encryption algorithm to replace each character or bit of the plaintext message with a different character?

A

Substitution cipher/ Caesar cipher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What uses an encryption algorithm to rearrage the letters of a plaintext message?

A

Transposition cipher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is a random bit string that is XORed with the message and is normally the same length as the block size of the cipher?

A

Initialization vector IV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which cipher uses a key length of one?

A

Caesar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which cipher uses a longer key usually a word or sentence?

A

Vigenere

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Which cipher uses a key that is as long as the message itself?

A

One-time pad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What criteria must be met for a one-time pad to be successful?

A

Generated randomly
Protected against physical disclosure
Used only one time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What enables someone to prove knowledge of a fact to another individual without revealing the fact itself?

A

Zero-knowledge proof

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What describes the means that the information or privilege required to perform an operation is divided among multiple users?

A

Split knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is a way to measure the strength of a cryptography system by measuring the effort in terms of cost and/or time to decrypt messages?

A

Work function or Work factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What relies on the use of a shared secret key, lacks support for scalability, easy key distribution, nonrepudiation, and is faster.

A

Symmetric Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What uses public-private key pairs for communication between parties, support scalability, easy key distribution, nonrepudiation, and is stronger?

A

Asymmetric Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is the least secure mode that processes 64-bit blocks, and produces the same encrypted block if it encounters the same block multiple times?

A

ECB
Electronic Codebook Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What XORed each block of unencrypted text with block of the ciphertext immediately preceding and the decryption process decrypts the ciphertext and reverses the XOR operation.

A

CBC
Cipher Block Chaining

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is the streaming version of CBC and works on data in real time, using memory buffers of the same block size, and uses chaining so errors propagate?

A

CFB
Cipher Feedback

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What operates similar to CFB, but XORs the plain text with a seed value. No chaining function, so errors do not propagate.

A

OFB
Output Feedback

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What uses an incrementing counter instead of a seed and errors do not propagate?

A

CTR
Counter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is a weakness in cryptography where a plain text message generates identical ciphertext messages using the same algorithm but using different keys?

A

Key Clustering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

When you encrypt a message what asymmetric key do you use?

A

The recipient’s public key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

When decrypting a message what asymmetric key do you use?

A

Your private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

When signing a message what asymmetric key do you use?

A

Your private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

When validating a signature, what asymmetric key do you use?

A

The sender’s public key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What are the five requirements for good hash functions?

A

Allow input of any length
Provide fixed-length output
Easy to computer the hash function for any input
Provide one-way functionality
Collision free

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What can you add to passwords before hashing them to reduce the effectiveness of rainbow table attacks?

A

Salts

65
Q

What uses the SHA-1 SHA-2, and SHA-3 message digest functions, and works in conjunction with one of the three encryption algorithms (DSA, RSA, ECDSA)?

A

DSS
Digital Signature Standard

66
Q

What generates digital certificates containing the public keys of system users and certificate recipients verify a certificate using the CA’s public key?

A

Certificate Authorities

67
Q

What are the standards for encrypted messages for email?

A

S/MIME and PGP

68
Q

What is a security architecture framework that supports secure communication over IP, can be used for direct communication between cpus or over a VPN connection and uses two protocols (AH & ESP)?

A

IPsec

69
Q

What are some common cryptographic attacks?

A

Brute-force
Meet-in-the-middle
Man-in-the-middle
Birthday
Replay

70
Q

What attack attempts to randomly find the correct cryptographic key?

A

Brute-force attack

71
Q

What attack exploits protocols that use two rounds of encryption?

A

Meet-in-the-middle attacks

72
Q

What attack fools both parties into communicating with the attacker instead of directly with each other?

A

Man-in-the-middle attack

73
Q

What attack attempts to find collisions in hash functions?

A

Birthday attack

74
Q

What attack attempts to reuse authentication requests?

A

Replay attacks

75
Q

What allows content owners to enforce restrictions on the use of their content by others, and commonly protects entertainment content, such as music, movies, and e-books?

A

DRM
Digital Rights Management

76
Q

What symmetric algorithms are 64-bits in block size?

A

Blowfish
Skipjack
DES
3DES
IDEA
RC2

77
Q

What symmetric algorithms are 128-bits in block size?

A

AES
Twofish
RC5

78
Q

What symmetric algorithms are streaming bits in block size?

A

RC4

79
Q

What hash algorithms have a hash value length of 128?

A

MD2
MD4
MD5

80
Q

What are the hash value lengths of the SHA family that is still in use?

A

SHA-224
SHA-256
SHA-384
SHA-512

81
Q

What SHA algorithm is not in use anymore and has a hash value length of 160?

A

SHA-1

82
Q

What are the three major public key cryptosystems?

A

RSA
El Gamal
Elliptic Curve

83
Q

What is the most popular public key cryptosystem, developed by Rivest, Shamir, and Adleman in 1977, and depends on the difficulty of factoring the product of prime numbers?

A

RSA

84
Q

What is an extension of the Diffie-Hellman key exchange algorithm that depends on modular arithmetic and is less common?

A

El Gamal

85
Q

What algorithm provides more security than other algorithms when both are used with keys of the same length?

A

Elliptic Curve

86
Q

What encryption algorithm is currently approved based on FIPS 186-4?

A

DSA
Digital Signature Algorithm

87
Q

What encryption algorithm is currently approved for use based on ANSI X9.31?

A

RSA

88
Q

What encryption algorithm is currently approved for use based on ANSI X9.62?

A

ECDSA
Elliptic Curve Digital Signature Algorithm

89
Q

What describes a system that is always secure no matter what state it is in, is based on the finite state machine, and is a snapshot of a system at a specific moment in time?

A

State machine model

90
Q

What is it called when each possible state transition results in another secure state?

A

Secure state machine

91
Q

What model focuses on the flow of information, is based on the state machine model?

A

Information flow model

92
Q

What are two information flow models?

A

Biba
Bell-LaPadula

93
Q

What information flow model focuses on preventing information flow from a high security level to a low security level?

A

Bell-LaPadula

94
Q

What information flow model focuses on the flow of information from a low to high security level?

A

Biba

95
Q

What is loosley based on the information flow model, ensure that the actions of different objects and subjects are not seen by other objects and subjects on the same system, and is concerned with how actions of a subj of a high security level affects the system state or the actions of a subj at a lower security level?

A

Non-Interference model

96
Q

What model is used to define the levels of security that an obj may have and that a subject may have access to?

A

Lattice-based models

97
Q

What state machine model enforces confidentiality, uses mandatory access control to enforce DOD multilevel security policy, and has “no read up” and “no write down” properties?

A

Bell Lapadula

98
Q

What is a lattice-based model developed to address concerns of integrity, has a “no read down” and “no write up” properties, and prohibits a subject at one level of integrity from invoking a subject at a higher level of integrity?

A

Biba

99
Q

What uses security labels to grant access to objects?

A

Clark-Wilson

100
Q

What describes any data item whose integrity is protected by the security model?

A

Constrained Data Item
CDI

101
Q

What describes any data item that is not controlled by the security model?

A

Unconstrained Data Item
UDI

102
Q

What describes a procedure that scans data items and confirms their integrity?

A

Integrity Verification Procedure
IVP

103
Q

What are the only procedures that are allowed to modify a CDI?

A

Transformation Procedures
TP

104
Q

What is a confidentiality-based model that supports four basic operations: take, grant, create, and revoke?

A

Take Grant Model

105
Q

What is a confidentiality-based model, also called the “Chinese Wall model” that was developed to prevent conflict of interest problems?

A

Brewer and Nash Model

106
Q

What model uses a formal set of protection rules for which each object has an owner and a controller, focuses on secure creation and deletion of both subjects and objects, and has a collection of eight primary protection rules that define the boundaries of certain secure actions?

A

Graham-Denning Model

107
Q

What security mode permits access to all info processed by the sys, approval for all info processed by the sys, and valid need-to-know for all info processed by the sys through security clearance?

A

Dedicated Mode

108
Q

What security mode can process info at different levels even when all sys users don’t have the required security clearance to access all info processed by the sys?

A

Multilevel Mode

109
Q

What security mode requires users to have a valid security clearance, access approval for ALL info, and a valid need-to-know for a least SOME info on the sys?

A

System High Mode

110
Q

What security mode requires each user to have a valid security clearance, access approval for ALL info processed by the sys, but requires valid need-to-know for ALL info they will have access to on the sys?

A

Compartmented Mode

111
Q

What is the logical part of the trusted computing base that confirms whether a subject has the right to use a resource prior to granting access and enforces access control?

A

Reference monitor

112
Q

What enables an objective evaluation to validate that a particular product or sys satisfies a defined set of security requirements?

A

Common Criteria

113
Q

What is a structured set of criteria for evaluating computer security within products and systems?

A

Trusted Computer System Evaluation Criteria
TCSEC

114
Q

What are the levels of the Common Criteria and their associate label?

A

EAL0,EAL1 - Minimal/no protection
EAL2 - Discretionary security mechanisms
EAL3 - Controlled access protection
EAL4 - Labeled security protection
EAL5 - Structured security protection
EAL6 - Security domains
EAL7 - Verified security design

115
Q

What method is used to pass info over a path that is not normally used, and may not be protected by the system’s normal security controls?

A

Covert channels

116
Q

What is a multipurpose solution, for full disk encryption through key management, by providing the OS w/ access to keys, but prevents drive removal and data access?

A

Trusted Platform Module
TPM

117
Q

What enforces an access policy that is determined by the system not the object owner, relies on classification labels that are representative of security domains and realms?

A

Mandatory Access Control
MAC

118
Q

What permits the owner or creator of an obj to control and define its accessibility?

A

Discretionary Access Control

119
Q

What enables the enforcement of system-wide restrictions that override object-specific access control?

A

Non-discretionary Access Control

120
Q

What defines specific functions for access to requested objects, commonly found in firewall systems?

A

Rule-based Access Control

121
Q

What role uses a well-defined collection of named job roles to endow each one w/ specific permissions?

A

Role-based Access Control

122
Q

What permits multiple concurrent tasks to be performed within a single process?

A

Multithreading

123
Q

What are chips that have a small windows that when illuminated with a special ultraviolet light, erases contents?

A

UVEPROM

124
Q

What memory type uses electric voltages delivered to the pins of the chip to force erasure and is more flexible alternative to UVEPROM.

A

EEPROM

125
Q

What memory type if nonvolatile and can be electronically erased and rewritten?

A

Flash memory

126
Q

What storage type is the same as memory?

A

Primary storage

127
Q

What storage type consists of magnetic, flash, and optical media that must be first read into primary memory before the CPU can use the data?

A

Secondary storage

128
Q

What storage type can be read at any point by the CPU?

A

Random access storage

129
Q

What storage type requires scanning through all the data physically stored before the desired location?

A

Sequential access storage

130
Q

What are the three main security issues surrounding secondary storage devices?

A

Removable media can be used to steal data
Access controls and encryption must be applied to protect data
Data can remain on the media even after file deletion or media formatting

131
Q

What are the security risks of input and output devices?

A

Subject to eavesdropping and tapping
Can be used to smuggle data out of an org
Can be used to create unauthorized, insecure points of entry into an org’s systems and networks

132
Q

What ensures that individual processes can access only their data?

A

Process isolation

133
Q

What creates different realms of security within a process and limits communication between them?

A

Layering

134
Q

What creates black-box interfaces for programmers to use without requiring knowledge of an algorithms or device’s inner workings?

A

Abstraction

135
Q

What prevents info from being read from a different security level?

A

Data hiding

136
Q

What is also known as a Virtual machine monitor and is the component of virtualization that creates, manages, and operates the virtual machines?

A

Hypervisor

137
Q

What is a native or bare-metal hypervisor where there is no host OS, and instead the hypervisor installs directly onto the hardware where the host OS would normally operate?

A

Type I hypervisor

138
Q

What is a hosted hypervisor, where a standard regular OS is present on the hardware, and the hypervisor is then installed as a another software application?

A

Type II hypervisor

139
Q

What is the functional order of security controls?

A

Deter
Deny
Detect
Delay
Determine
Decide

140
Q

What type of fires are common combustibles such as wood, paper, etc and should be extinguished with water or soda acid?

A

Class A (ASH)

141
Q

What type of fires are burning alcohol, and oil and should be extinguished with gas or soda acid?

A

Class B (BOIL)

142
Q

What type of fires are electrical fires which are fed by electricity and must be extinguished with any type of gas?

A

Class C (CONDUCTIVE)

143
Q

What type of fires are burning metals are extinguished with dry powder?

A

Class D (DILYTHIUM)

144
Q

What type of fires are kitchen fires, such as burning oil or grease and are extinguished with wet chemicals?

A

Class K (Kitchen)

145
Q

What water suppression sys uses closed sprinkler heads and the pipe is charged with compressed air instead of water?

A

Preaction systems

146
Q

What water suppression sys are filled with water and are activated when a predefined temperature is reached?

A

Wet pipe systems

147
Q

What water suppression sys is filled with compressed air and is held back by a valve that remains closed as long as sufficient air pressure remains in the pipes?

A

Dry pipe systems

148
Q

What water suppression sys are similar to dry pipes but the sprinkler heads are open and larger than dry pipes and the pipes are empty at normal air pressure and water is held back by a deluge valve?

A

Deluge system

149
Q

What are usually more effective than water systems but should not be used in environments where people are located because it removes oxygen from the air.

A

Gas suppression systems

150
Q

What type of lock type can be easily picked?

A

Conventional locks

151
Q

What are the key elements for site selection?

A

Visibility
Composition of the surrounding area
Area accessibility
The effects of natural disasters

152
Q

How to design and configure secure work areas?

A

No equal access to all areas
Valuable and confidential assets should be located at the center of protection
Centralized server and cpu rooms should not be human compatible

153
Q

What describes when someone is using another’s security ID to gain entry to a facility?

A

Masquerading

154
Q

What are protections for media storage facilities?

A

Lock cabinets or safes
Use a librarian/custodian
Implement a check-in/check-out process
Use media sanitization

155
Q

What is used to retain logs, drive images, virtual machine snapshots, and other datasets for recovery, internal investigations, and forensic investigations?

A

Evidence sotrage

156
Q

What are the protections for evidence storage?

A

Lock cabinets/safes
Have a dedicated/isolated storage facility
Offline storage
Access restrictions and activity tracking
Hash management and encryption

157
Q

What are useful tools for managing physical access controls?

A

Audit trails and access logs

158
Q

What is a type of self-charging battery that can be used to:
Supply consistent, clean power to sensitive equipment
Supply power for minutes or hours in the event of a power failure?

A

UPS

CISSP (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions