Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PCS CISSP MM, EC, Thor series > Domain 3B - Security Architecture and Engineering > Flashcards

Domain 3B - Security Architecture and Engineering Flashcards

1
Q

number one overarching primary goal of physical security is?

A

safety of people, people are the most valuable asset of an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what are the 5 pieces to physical security

A
  1. deter
  2. delay
  3. detect
  4. assess
  5. respond
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

deter control explain

A
  1. discourage things like trespassing, property damage, theft and intrusion with signage and other environmental design of a building and the land around it
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

delay control explain

A
  1. delay an attacker from gaining unauthorized access
    example: locks delay and attacker from gaining unauthorized access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

detective control explain

A
  1. detect if a risk has occurred
    example: CCTV
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

assess controls

A
  1. used to determine the method of attack and the target
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

respond controls

A
  1. take appropriate action to remediate the risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is the best way to secure a perimeter

A
  1. minimize the number of entrances and exits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

landscape - what role does this play in physical security

A
  1. part of perimeter control
  2. foliage should be maintained to provide clear sight lines for cameras and that would-be attacker cant just climb up a tree and into the building
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

physical security grading (perimeter) explain

A
  1. part of perimeter control
  2. the ground should slope down and away from the building so if there was a flood you are not part of the flood
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

passive infrared devices - what must happen if ambient air temp changes

A
  1. they must automatically recalibrate themselves
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

lighting does what

A
  1. helps deter crime
  2. important to safety of people
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

2 major types of card reader systems

A
  1. contact
  2. contactless
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

contact card reader

A
  1. employee must swipe their card through the reader for older magnetic readers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

contactless card reader

A
  1. employee only need to hold their card near the rfid (radio frequency identification system) reader
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

social engineering attack on doors is called what

A
  1. tailgating
  2. piggybacking
    - - an intruder follows and authorized person through the door after they have unlocked it
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what are preventions for tailgating and piggybacking

A
  1. mantraps
  2. turnstiles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

explain mantrap

A
  1. it involves 2 doors
  2. you must unlock the fist door, and walk into a small space, close the door behind you, then can you unlock the second door
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

should locks ever be used as a single line of defense

A

no, locks are delay only and should only be part of a layered defense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

sensors to help monitor if a window has been broken

A
  1. shock - detects a small shock wave when a window breaks
  2. glass break sensors - essentially microphones listening for specific frequencies of sound when glass breaks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is skimming

A

an attacker uses an electronic device to steal card information from valid transaction.
example: install an small electronic device attacked to an ATM machine to record debit card numbers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what are two devices used to provide a consistent supply of clean power

A
  1. UPS
  2. Generator
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what is a black out

A

no power for a long period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what is a brownout

A

prolonged low voltage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what is a power fault

A

short loss of power

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what is a power surge

A

prolonged high voltage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what is a power spike

A

temporary high voltage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is a sag and a dip

A

temporary low voltage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

4 goals of cryptography and its mnemonic

A

P.A.I.N

  1. Privacy (confidentiality)
  2. authenticity
  3. integrity
  4. non-repudiation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

class A fire –

  1. what is it
  2. what puts it out
A
  1. common fire (ash)
  2. water, soda, acid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

class B fire –

  1. what is it
  2. what puts it out
A
  1. Liquid (boil)
  2. Gas (halon, C02 etc.) and soda acid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

class C fire –

  1. what is it
  2. what puts it out
A
  1. electrical (conductive)
  2. any gas (C02, Halon etc.)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

class D fire –

  1. what is it
  2. what puts it out
A
  1. metal
  2. dry powder
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

humidity in data centers

  1. if its too dry what do you get
  2. if its too humid what do you get
A
  1. static electricity
  2. condensation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

explain positive pressurization when it comes to HVAC units in data centers

A

nice clean filtered air is blown into the data center slightly above ambient temperature, positively pressurizing the data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

why do you want positive pressurization

A

if there are any cracks in the data center. the clean air is blowing out rather than dirty (outside) air blowing into the data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

why do you want positive pressurization

A

if there are any cracks in the data center or someone opens an door, the clean air (HVAC) is blowing out rather than dirty (outside) air blowing into the data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

whenever we implement controls we want what combination if possible

A
  1. preventive
  2. detective
  3. corrective
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

fire detection - 3 main types are

A
  1. flame detectors
  2. smoke detectors
  3. heat detectors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

flame detectors do what

A

detect the infrared and ultraviolet light created by flames - essentially video cameras

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

smoke detection why use them and what are the two main types and when to use each type

A
  1. one of the best ways to detect fire as early as possible
  2. ionization - respond more quickly to flaming or fast fires
  3. photoelectric - (called optical detectors) respond quickly to smoldering fires
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

define heat sensors

A
  1. thermal sensors
  2. temp sensors, monitoring for rapid rise in temperature
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q
  1. what is the earliest fire detection
A

smoke detection (smoke before fire)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q
  1. what is the most concerning fire
  2. what detection system do we use for it
A
  1. flaming or fast fires
  2. ionization detection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

two major types of fires suppressions systems

A
  1. water based - office spaces , motels etc.
  2. gas based - cost justified in data centers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

4 types of water based suppression systems

A
  1. wet
  2. dry
  3. pre-action
  4. deluge
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

wet pipe system attributes

A
  1. cheapest
  2. pressurized water at all time
  3. cant be used where it can freeze
  4. eventually will have leaks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

dry pipe system attributes

A
  1. look identical to wet pipe systems
  2. pressurized with gas so they can be used where it can freeze
  3. water is only realized when triggered
  4. closed sprinkler head
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

deluge attributes

A
  1. similar to dry pipe
  2. sprinkler heads are open
  3. larger sprinkler heads
  4. pipes are not pressurized
  5. water held back by deluge valve
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

4 types of gas-based fire suppression systems

A
  1. Inergen
  2. Argonite
  3. FM-200
  4. Aero-K - supposedly safe for servers and people
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

why is halon no longer used at a gas-based fires suppression

A
  1. ozone depleting
  2. turns to toxic gas at 900F
  3. like many gas-based fires suppression, it removes oxygen = bad for human life
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

why is C02 fire suppression preferred in data centers

A
  1. non-corrosive
  2. it does not leave residue
  3. will not damage equipment
  4. doesn’t conduct electricity
    5 if you do not use too much, its not harmful to humans
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

social engineering - cryptographic attacks is what

A

going after the weakest link - people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

birthday attacks - cryptographic attacks

A

finding collisions in hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

rainbow tables - cryptographic attacks
how do you defeat rainbow tables

A
  1. a giant database of most common passwords and their associated hash values
  2. salting the password before hashing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

dictionary attack - cryptographic attacks

A
  1. a form of brute force
  2. dictionary attack try the most likely combinations first
  3. can be more efficient and faster than brute force
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

radiation emissions - cryptographic attacks

A

a side channel attack - the electromagnetic waves that are emanated are closely monitored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

timing attack - cryptographic attacks

A
  1. measure how long certain operations take
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

power attack - cryptographic attacks

A
  1. measure how much power is consumed during certain calculations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

side channel attack explain - cryptographic attacks

A
  1. any attack where sensitive information is gathered by carefully monitoring a system that is performing some cryptographic tasks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

implementation attack - cryptographic attacks

A
  1. target weaknesses in how an algorithm, cryptosystem, protocol or application has been implemented.
    example: WEP (wired equivalency protocol) does a terrible job of implementing rc4 encryption algorithm.
    IV (initialization vectors) too short, a portion is static among other issues
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

temporary files attack - cryptographic attacks

A
  1. temporary files my not be sufficiently secured.
  2. in a temporary file attack the attacker gains access to the sensitive plaintext or encryption keys by accessing encrypted and decrypted temp files
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

replay attack attributes - cryptographic attacks

A
  1. a form to man-in-the-middle
  2. attacker eavesdrops and intercepts data being
    sent
  3. they not necessary can decipher the data. they replay it, resend it later on in an attempt to use that information to their advantage
    example: intercepting a users hashed password being sent to a server to authenticate the user. the attacker could resend that hash of a users password later on to gain unauthorized access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

man-in-the-middle - cryptographic attacks

A
  1. attacker places themselves in the middle of a conversation, allowing them to eavesdrop on the communication
  2. possibly alter communications or decipher them
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

factoring (cryptanalytic) -what algorithm would this be used against?

A

RSA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

chosen ciphertext - (cryptanalytic)

A
  1. the attacker has access to the machine or algorithm that is performing the encryption and decryption
  2. the attacker is choosing what ciphertext to feed into the algorithm then looking at the resultant plaintext to try and deduce the key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

chosen plaintext - (cryptanalytic)

A
  1. the attacker has access to the machine or algorithm that is performing the encryption and decryption
  2. the attacker is choosing what plaintext to feed into the algorithm then looking at the resultant ciphertext to try and deduce the key
68
Q

known plaintext attack - (cryptanalytic)

A
  1. attacker has access to both ciphertext and plaintext
  2. bad - they can now use this information to deduce the key to decrypt all messages or forge new message
69
Q

ciphertext only attack - (cryptanalytic)

A
  1. the cryptanalysis only has the ciphertext to deduce the key
  2. very difficult
70
Q

brute force attack attributes - (cryptanalytic)

A
  1. brute force will not be possible on algorithms that use 128 bit or more, especially 256 bit
  2. key space doubles every time the key length is increased by 1 bit
  3. this becomes and insurmountable problem
71
Q

the primary goal of cryptanalytic attack is

A
  1. deduce the key
  2. find the crypto variable (the key) that can be used to decrypt the ciphertext
72
Q

2 major types of cryptanalysis

A
  1. cryptanalytic attacks
  2. cryptographic attacks
73
Q

cryptanalysis definition

A

the process of decoding secrets and gaining access to encrypted messages and even forging new messages

74
Q

what does zero trust security use as the control plane

A

the user identity as the new perimeter

75
Q

secure design principles take from NIST 800-160

  1. secure defaults
  2. fail securely
A
  1. default configurations reflect a restrictive and conservative enforcement of security policy.
  2. components should fail in a state the denies rather than grants access
76
Q

what has trust but verify pretty much been replaced by

A

zero trust model

77
Q

explain trust but verify

A
  1. an older secure design principle that is being replaced by zero trust
  2. this depended on an initial authentication to gain access to an internal “secured” environment the relied on generic access control methods
  3. the “secure perimeter” was on the edge thought process
78
Q

privacy by design principles

A
  1. Proactive not reactive, preventive not remedial
  2. Privacy as the default setting
    3 Privacy embedded into Design
  3. full functionality - positive-sum, not zero-sum
  4. End-to-End Security — Full Lifecycle Protection
  5. visibility and Transparency- Keep it Open
  6. Respect for User Privacy - Keep it User-Centric
79
Q

privacy by design - what does
proactive not reactive, preventive not remedial mean

A

systems should be designed to prevent privacy risks from occurring in the first place, not just to respond to privacy lapses to that occur

80
Q

privacy by design - what does
Privacy as the default setting mean

A
  1. systems should protect the privacy of individuals even if those individuals don’t action to raise the level of privacy.
  2. the default approach should be to protect privacy unless the user specifically does an action to reduce the level privacy
81
Q

privacy by design - what does
Privacy embedded into Design mean

A
  1. privacy should be a primary design consideration, not a bolted on afterthought
  2. privacy is a core requirement of the system
82
Q

privacy by design - what does
full functionality - positive-sum, not zero-sum mean

A
  1. privacy should not be treated as requiring trade offs to accomplish
  2. privacy by design seeks win-win situations, where privacy objectives are achieved alongside other objectives
83
Q

privacy by design - what does
End-to-End Security — Full Lifecycle Protection mean

A
  1. security practices should persist throughout the entire information lifecycle
  2. information should be securely collected, retained and disposed of to preserve individual privacy
84
Q

privacy by design - what does
visibility and Transparency- Keep it Open mean

A
  1. the component parts of systems preserving privacy by design should be open for inspection by users and providers
85
Q

privacy by design - what does
Respect for User Privacy - Keep it User-Centric mean

A
  1. Privacy is about protecting personal information and personal information belongs to individual people empowering data subjects with user-friendly privacy practices
86
Q

best-in-suite over best-in-bread solutions. how does this simplify security in-depth

A
  1. security suites will incorporate layers of intelligence that wok better together to secure your environment
  2. this simplicity also helps to avoid configuration mistakes
  3. your layers will be integrated better
  4. your overall solution is generally going to be smarter
  5. it does not mean you will only have one security vender, it means you will likely have fewer security vendors - your foundation might be MS, google, cisco, amazon - its not the vendor, its the concept
  6. this will allow the org to move forward incrementally rather than expecting perfection
    - — when you try to find the best vendor at every layer, you spend a lot of time shopping, testing and vetting how well the different vendors work together adds work, time and complexity
87
Q

what is IPSEC

A
  • Internet protocol security
  • its a secure network protocol suite that authenticates and encrypts packets of data to provide secure communication between two computers over an insecure media (like the internet).
  • highly used in VPNs
88
Q

where is asymmetric encryption widely used

A
  • Transport Layer Security (TLS)
  • Secure socket Layer (SSL)
  • Hypertext Transfer Protocol Secure (HTTPS)
89
Q

what are components of public key encryption

A
  • plaintext
  • cyphertext
  • encryption algorithm
  • decryption algorithm
  • private key
  • public key
90
Q

what are two ways to create a key pair for PKI

A
  • using a CA (certificate authority)
  • self sign (certificate not signed by a CA)
91
Q

what is the disadvantage of self signing your cert

A
  • its not a trusted certificate
  • the other end of the conversation will need to manually trust that cert
92
Q

list some components of PKI

A
  • certificate requestor
  • certificate signing CA
  • root CA
  • certificate revocation list (CRL)
93
Q

what is a collision in hashing

A

• when the hashing tool gets the same output from two or more different inputs

94
Q

what is done with the root CA to keep it from being compromised

A

• root CA is kept offline

95
Q

what does PKI stand for

A

• public key infrastructure

96
Q

what two ways to find that status of a certificate (find if its good or bad)

A
  • certificate revocation list - all CAs right to this list at certain intervals for updates - verify what certs are still good and what certs need to be cut out of their chain of trust
  • OCSP (online certificate stat protocol) - faster but only shows the status not give details of the ticket as well as why it was revoked.
97
Q

what does IETF stand for what what is it

A
  • internet engineering task for
  • the body that defines standard operating internet protocols such as tcp/ip
98
Q

who supervises the IETF (internet engineering task force)

A

• IAB (Internet Architecture Board)

99
Q

what IETF protocol is the standard for PKI digital certs

100
Q

what is RIR with IPs and what does it do

A
  • regional internet registry
  • manages the allocation and registration of internet number resources within the regions of the world
  • internet number resources include IP address
101
Q

what are the 5 regions of RIP

A
  • AFRINIC (African network information center) -Africa
  • ARIN (American Registry of internet numbers) - Antarctcia, canada, caribbean and unites stats
  • APNIC (Asia-Pacific network information center - east asia, oceania, south asia, and southeast asia
  • LACNIC (Latin America and Caribbean network information center) - most of caribbean and all of latin america
  • RIPE NCC (Roseaux IP Europeen Network Coordination Centre) – Europe, central Asia, Russia and west Asia
102
Q

what to know about a HASH

A
  • one way function (not reversible)
  • typically fixed length
  • also called message digest
  • provides encryption using an algorithm with no key
103
Q

what happens during a TLS handshake

A

A. `Specify which version of TLS
B. Decide on which cipher suites they will use
C. Authenticate the identity of the server via the
server’s public key and the SSL certificate authority’s
digital signature
D. Generate session keys in order to use symmetric
encryption after the handshake is complete

104
Q

explain all you see in this cipher suite
TLS_ECDHE_RSA_with_AES_128_GCM_SHA256

A

TLS_ECDHE_RSA_with_AES_128_GCM_SHA256
ECDHE - elliptic curve diffie-hellman ephemeral – key exchange
RSA – (Rivest–Shamir–Adleman) public key authentication mechanism - verify server is who they say they are by checking public key certificate to verify digital signature
AES – encryption cipher
128 – key size
GCM – mode of operations
SHA256 – hash

105
Q

worm media is what

A

anything that is (write once, read many) Rdvd, Rcd, some tape drives, there is some media that has write protection applied
ensures the highest level of integrity and data security

106
Q

IDEA encryption

A

A: International Data Encryption Algorithm
B: was intended as a replacement for DES
C: 64 bit cipher
D: 128 bit key
E. was patented so it was not commonly used because of added cost

107
Q

we are using a cloud computing and have chosen to use IaaS. who is responsible for the database
A: the security team
B: the vendor
C: the customer
D: the network team

A

the answer is
C:

108
Q

explain IaaS

A

A: infrastructure as a service
B: vendor provides infrastructure up the OS
C: customer adds the OS and up

109
Q

MAC when talking about hashing means what

A

Message Authentication Code

110
Q

what handles all access between objects and subjects in the computer kernel

A

reference monitor

111
Q

what would we use Distributed control systems (DSC)j for?

A

computerized control system for a process or plant

112
Q

what can we use digital signatures to provide

A

A: none repudiation
B: integrity

113
Q

NSA wanted to embed the clipper chip on all motherboards. which encryption algorithm did the chip use?
A: skipjack
B: 3DES
C: DSA
D: RSA

A

the answer is
A:

114
Q

The clipper chip was created by the NSA for what

A

A: promoted as an encryption device that secured voice and data messages
B: it had a built-in backdoor
C: used skipjack - a block cipher

115
Q

which of these symmetric encryption types are no longer considered secured and should not be considered to use

A: twofish
B: AES
C: RC4
D: 3DES K1

A

the answer is
C:

116
Q

what is nonce

A

an arbitrary number used only once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks

117
Q

name some asymmetric key algorithms

A

RSA, Diffie-Hellman, El Gamal, Merkle-Hellman (trapdoor) Knapsack, Elliptic Curve

118
Q

name some symmetric key algorithms

A

Data encryption standard (DES), Triple DES, Advanced Encryption Standard (AES), International Data Encryption Algorithm (IDEA), Rivest Cipher 5, (RC5)

119
Q

how do you create a message digest

A

by using a way-way hashing function

120
Q

is sha-1 a valid hashing function

A

Sha-1 is considered obsolete and should be replaced with sha-3

121
Q

3 digest algorithms

A

MD5, sha-w,sha-256, sha-384, sha-512

122
Q

what does digital signature do

A

a simple way to verify the authenticity and integrity of a message

123
Q

3 digital signature algorithms according to Federal Information Processing Standard (FIPS)

A

RSA digital signature
DSA (digital signature algorithm) - based on modified EL Gamal
ECDSA (elliptic curve digital signature algorithm)

124
Q

define ephemeral port

A

a communication port of a transport layer protocol(TCP/UDP) of the internet protocol suit (IP suite) that is used only for a short period of time, for the duration of that session only.

125
Q

What feature enables code to be executed without the usual security checks?

A. Temporal isolation
B. Maintenance hook
C. Race conditions
D. Process multiplexing

A

the answer is B.

Maintenance hooks get around the system’s or application’s security and access control checks by allowing whoever knows the key sequence to access the application and most likely its code. Maintenance hooks should be removed from any code before it gets into production.

126
Q

What is an advantage of RSA over DSA?

A. It can provide digital signature and encryption functionality.
B. It uses fewer resources and encrypts faster because it uses symmetric keys.
C. It is a block cipher rather than a stream cipher.
D. It employs a one-time encryption pad.

A

Answer is A:

RSA can be used for data encryption, key exchange, and digital signatures. DSA can only be used for digital signatures.

127
Q

what are clark-wilson model attributes

A
  • integrity model
  • prevents authorized users from making improper modifications (separation of duties)
  • maintain internal/external consistency (well formed transactions)
  • access triple
  • ••• subjects and objects can only access what they are allowed
  • ••• separation of duties is enforced
  • ••• auditing of each transaction
128
Q

what is IPSEC, what is it used for and when might it be used

A
  • Internet Protocol Security
  • it provides authentication and encrypts packets of data to provide secure encrypted communication between two computers over an unsecure media (like the internet)
  • this is highly used in VPNs
129
Q

3 main components of IPSEC are

A
  • IKE (internet key exchange)
  • AH (authentication header)
  • ESP (encapsulation security protocol)
130
Q

what does IKE (internet key exchange) do in IPSEC

A

• establishes SA (security association) between communicating hosts, negotiating the cryptographic keys and algorithms the will use during the session

131
Q

what does AH (authentication header) do in IPSEC

A
  • adds a header field to the packet that includes cryptographic hash
  • provides authentication
  • provides integrity (HMAC - hashed message authentication codes)
  • does not provide confidentiality
  • protects against replay attacks
132
Q

what does ESP (encapsulation security protocol) do in IPSEC`

A

• encrypts the payload
• adds a sequence number so the host is sure it isn’t
getting duplicate information
• provides confidentiality
• it can provide authentication and integrity

133
Q

explain SA (security association)

A

•. simplex connections (communication one way)
• if using both AH and ESP you need 2 SAs for each
communication, so for bidirectional you would need 4
SA connections
• each SA has a unique 32 bit SPI (security parameter
index)

134
Q

what does ISAKMP stand for and what does it do

A

• internet security and key management protocol)
• manages the SA creation process and key exchange
mechanics

135
Q

what are the two modes ISPEC can be used

A
  • Tunnel mode
  • Transport mode
136
Q

what does tunnel mode in IPSEC do and when to use it

A
  • encrypts and authenticates the entire package (including headers)
  • used when a system does not natively speak IPSEC
137
Q

does does transport mode do in IPSEC

A
  • only encrypts and authenticates the payload
  • used when both systems already understand IPSEC
138
Q

what 3 things do digital signatures provide

A
  1. authenticity
  2. integrity
  3. non-repudiation of both origin and delivery
139
Q

what does DAC stand for

A

• discretionary access control

140
Q

what does MAC stand for with access controll

A

• Mandatory access control

141
Q

what does RBAC stand for

A

• roll based access control

142
Q

what does ABAC stand for

A

• attribute based access control

143
Q

explain DAC

A
  • discretionary access control
  • this allows the owner or creators the ability to control access given in any way they feel the need
144
Q

explain MAC with access control

A

• mandatory access control
• think military
• labels and categories
• you have to request access to every level
• classified access does not give you access to everything under classified. you will need to request access to each level under the top level
Example: you have top secret access. you still need to request access to nuclear submarine even when it is under top secret

145
Q

explain RBAC

A
  • role based access control
  • access based on the role of the subject
146
Q

explain ABAC

A
  • attribute based access control
  • access granted by attributes
  • location
  • subject (user)
  • environment - location and/or time of access
147
Q

explain RUBAC

A
  • rules based access control
  • example firewall
  • access granted off if/then statements
148
Q

Bell Lapadula security model - where does is belong on the triad and what access control is it

A
  • confidentiality
  • Mandatory access control (classified information)
149
Q

bell lapadula - what are the 3 rules

A
  • simple security - no read up
  • * (star property) - no write down
  • strong * (star) property - no read or write up or down. subjects can only access data at their level
150
Q

what is a digital certificate

A

• its a file or electronic password that proves the authenticity of a device, server, or user through the use of cryptography and the public key infrastructure (PKI)

151
Q

what are the steps in tls handshake

A
  • ClientHello
  • ServerHello - certificate - ServerHelloDone
  • clientkeyexchange - changecipherspec - finished
  • changecipherspec - finished
152
Q

TCP handshake

A
  • syn
  • syn ack
  • ack
153
Q

when does the TLS handshake occur

A
  • whenever a user navigates to a website over https and the browser first begins to query the website
  • when other communications use https, including API calls and DNS over HTTPS
154
Q

what does TLS handshake follow, what always happens first

A

• TCP handshake, which creates the connection

155
Q

what does TLS handshake follow, what always happens first

A

• TCP handshake, which creates the connection for all communications after that

156
Q

firs step in TLS handshake (client hello) what is in that message

A
  • max TLS version this client can support
  • random number to prevent replay attacks
  • list of cipher suites options
157
Q

second step of TLS handshake (server response)

A
  • server hello (will contain the follow for the encrypted communication)
  • chosen TLS version to use
  • chosen cipher suite to use
  • random number to prevent replay
158
Q

second half of the second step of the TLS handshake, the server sends a second message that includes?

A
  • certificate with the agreed encryption and a public key
  • server key exchange (parameters for Diffie_Hellman key exchange)
  • •••• digital signature as part of key exchange this includes (summarized version previous messages hashed and signed with the private key of the server to prove who they are)
  • Server hello done
159
Q

TLS handshake step 3 (client reply) what is sent

A
  • client key exchange
  • change cipher spec message (i have all i need, i will not start encrypting the message with agreed specs)
  • finish message (this will contain a summary of all the messages to this point, encrypted)
160
Q

last step of TLS handshake (server final reply) what is in the message

A
  • change cipher spec message
  • finish message (this contains a summary of all the message to this point, encrypted)
161
Q

once the TLS handshake is completed how long does that TLS session last

A
  • this based off a few things
  • if you browse to another site obviously you will create a TLS session with that site
  • there are refresh times, after 30 minutes or so (not a standard time) the handshake will happen again to verify there are new random numbers etc
  • possibly session resumption (resume sessions based off certain criteria) based configuration of server
162
Q

Graham-Denning security model attributes

A

• uses objects, subjects and rules
• there are 8 rules to specific subject can execute on an object
1. transfer access
2. grant access
3. delete access
4. read object
5. create object
6. destroy object
7. create subject
8. destroy subject

163
Q

harrison Ruzzon Ullman security model (HRU) attributes

A

• deals with integrity of access rights
• an operating system level computer security model
• an extension of Graham-Denning
• considers subjects to be objects
• 6 primitive operations
1. create object
2. create subject
3. destroy subject
4. destroy object
5. enter right into access matrix
6. delete right from access matrix

164
Q

EAP attributes

A
  • eap is a is a framework for authentication instead of an actual protocol
  • eap was originally desined to work over physical isolated channels, thus assumed a secured pathway
  • some eap methods use encryption, some do not .
  • over 40 EAP methods - leap, peap, eap-sim, eap-fast, eap-tls, eap-ttls ETC.
165
Q

do we ever send anyone our asymmetric public key?

A

absolutely not, we send them our digital certificate

PCS CISSP MM, EC, Thor series (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions