Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 4 > Flashcards

Domain 4 Flashcards

1
Q

IKE

A

Internet Key Exchange uses diffie-hellman style of negotiation Use public key certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IPSec

A

IP Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which Port is IPSEC on

A

UDP port 500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Phase 2 of IPSec

A

Tunnel is created and is the “production channel”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What gets hashed in ESP Auth

A

old combined fields 3,4 and payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Phase 1 of IPsec

A

Negotiation of tunnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define SPI in IPSec

A

Security Parameter Index (SPI) is an identification tag added to the header while using IPsec for tunneling the IP traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

L2TP

A

Layer 2 tunneling protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what layer does IPSec operate on

A

Layer 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ESP

A

Encapsulating Security Payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When Combining two systems on a network with IPSec the risk is

A

There could be duplicate IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define RFC 1918

A

Request for Comment 1918 (RFC 1918), “Address Allocation for Private Internets,”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

MTU

A

Maximum Transmission Units

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

PPTP

A

Point-to-point tunneling protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ESP Header

A

Contains info showing which security association to ue and the packet sequence number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

MPLS

A

Multi-protocol label switching

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define MPLS

A

Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on short path labels rather than long network addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

ESP Payload

A

Contains the encrypted part of the packet. If the encryption to use when the security association is establsihed

19
Q

ISAKMP

A

Internet security association key management protocol

20
Q

Characteristics of ISAKMP

A

Bi Directional. RFC 2048

21
Q

ESP Trailer

A

May include padding (filler bytes) if requires by the encryption ALGO or to align fields

22
Q

Authentication field (ESP Auth)

A

This field contains the integrity check (hash) of the ESP packet.

23
Q

Steps of IPSec

A
  1. Sender created segment with port address set to 500 2. sender sends segment to device that is set to create and ipsec tunnel if “interesting traffic” shows up 3. interesting traffic arrives at device, device looks at layer 3 header and figures out where its going to tunnel to 4. device invokes ISAKMP and builds bi-directional tunnel 5. If key pairs, uses diffie hellmen called ISAKMP-Oakily 6. Security Parameter Index appears on each device 7. Enter Phase 2, creates permanent tunnel 8. Data is then passed between phase 2 tunnel
24
Q

SSAE 16

A

Replaced SAS 70 Auditing Standard. Replaced by SSAE18

25
Q

SSAE 18

A

Newer version of SSAE 16 Scope is to look for control gaps referred to as a “finding”

26
Q

AT 801

A

AT 801 applies to examination engagements to report on controls at organizations that provide services to user entities when those controls are likely to be relevant to user entities’ internal control over financial reporting.

27
Q

ISAE 3402

A

Global Standard of Auditing

28
Q

Auditing type 1

A

Audits a Point in time. Checks on that the process of what you are currently doing (snap shot) ( present time only)

29
Q

Auditing type 2

A

Audits a period of time. Checks on historical business operations. Most in depth and covers a period of time (ex. past 10 years)

30
Q

Auditing Word Pair

A

Qualified Report - A qualified report is one in which the auditor concludes that most matters have been dealt with adequately, except for a few issues. An auditor’s report is qualified when there is either a limitation of scope in the auditor’s work, or when there is a disagreement with management regarding application, acceptability or adequacy of accounting policies. For auditors an issue must be material or financially worth consideration to qualify a report. The issue should not be pervasive, that is, the issue should not misrepresent the factual financial position. Unqualified Report - In an unqualified report, the auditors conclude that the financial statements of your business present fairly its affairs in all material aspects. The opinion embodies the assumptions that your business observed compliance with generally accepted accounting principles and statutory requirements. Also known as a clean report, such a report implies that any changes in the accounting policies, their application and effects, are adequately determined and divulged.

31
Q

SAS 70 (old) consists of two types of audits

A

Type 1. “report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design of the controls to achieve the related control objectives included in the description as of a specified date. Type 2: report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives included in the description throughout a specified period”

32
Q

SOC 1

A

Requirements describe system, control objective, finances

33
Q

SOC 2

A

cyber security needs

34
Q

SOC 3

A

systrust, webtrust, trust services (smaller in effort, cost, and size)

35
Q

SOC

A

Service Organization Control

36
Q

Only SOC 2/3 have type 1 and type 2 Audits

A

True

37
Q

gold standard of Auditing is

A

SOC 2, Technology, Type 2 (most in depth and shows historical process)

38
Q

Which type of Auditing report do you desire to get

A

unqualified

39
Q

Which type of Auditing report do you desire to get

A

unqualified

40
Q

high trust audit, PCI audits are not included in SOC audits

A

True

41
Q

high trust audit, PCI audits are not included in SOC audits

A

True

42
Q

Steps of planning phase

A
  1. RFP (request for Proposal) 2. Response (bids) 3. Negotiate Contract (terms, and terms of disposal and decommission) 4. Statement of work (what you can, cannot do, will, will not do) signing “as is” statement 5. Follow on - routine maintenance, updates, improvements, patches to software 6. disposal and decommission
43
Q

Importance of signing statement of work

A

This is the “as is” signing. Any issues or bugs found before this point will be paid for by developer (contracted company) Any issues or bugs found after this point will be paid for by the customer company

44
Q

SDLC

A

Software Development Lifecycle

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions