Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Weak Areas > Domain 5! > Flashcards

Domain 5! Flashcards

All cards done 10/15/18

1
Q

What are the 3 types of authentication factors? (in order from 1 to 3)

A

1) Something you KNOW (a password)
2) Something you HAVE (a Token)
3) Something you ARE/DO (biometrics)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are some examples of Type 3 (biometrics) authentication factors that are considered, “something you ARE?” (there are 6)

A

1) Fingerprints
2) Face Scan
3) Retina Scan
4) Iris Scan
5) Palm Scan
6) Hand Geometry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a Biometrics Type 1 Error?

A

Type 1 Error is a False Negative. This occurs when a valid subject is not authenticated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a Biometrics Type 2 Error?

A

Type 2 Error is a FALSE POSITIVE. This occurs when an invalid subject is authenticated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are some examples of Type 3 (biometrics) authentication factors that are considered “something you DO?” (there are 4)

A

1) Heart/Pulse Patterns
2) Voice Pattern Recognition
3) Signature Dynamics
4) Keystroke Patterns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a False Acceptance Rate (FAR)?

A

FAR is the ratio of Type 2 Errors to valid authentications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a False Rejection Rate (FRR)?

A

FRR is the ratio of Type 1 Errors to valid authentications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a Crossover/Equal Error Rate (CER/ERR)?

A

CER/ERR is used to compare the overall quality of biometric devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Centralized Access Control?

A

Centralized Access Control is when all authorization verification is performed by a single entity within a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Decentralized Access Control?

A

Decentralized Access Control is when various entities located throughout the system perform authorization verification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Name a few SSO Mechanisms (name 3).

A

LDAP, PKI, and Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How should you think of LDAP as an SSO Mechanism?

A

Think of LDAP as a telephone directory for network services and assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Describe PKI as an SSO Mechanism.

A

PKI uses LDAP when integrating digital certificates into transmissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe Kerberos as an SSO Mechanism.

A

Kerberos is the most common/well-known ticket system. Ticket authentication employs a third-party entity to prove identification and provide authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does Kerberos provide regarding CIA?

A

Kerberos provides Confidentiality & Integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What 2 attacks does Kerberos help prevent?

A

Kerberos helps prevent Replay & Eavesdropping attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Name the 4 Kerberos Elements.

A

1) Key Distribution Center (KDC)
2) Kerberos Authentication Server
3) Ticket-Granting Ticker
4) Ticket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe Kerberos’ Key Distribution Center.

A

The KDC is the trusted third party that provides authentication services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe the Kerberos Authentication Server/

A

The Kerberos Authentication Server hosts the functions of the KDC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Describe the Kerberos Ticket-Granting Ticket.

A

The Ticket-Granting Ticket provides proof that a subject has authenticated through KDC and is authorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Describe the Kerberos Ticket.

A

The Ticket is an encrypted message that provides proof that a subject is authorized to access an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Implicit Deny?

A

Implicit Deny is (an Authorization Mechanism) when access to an object hasn’t been explicitly granted, then access is (implicitly) denied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a Permission?

A

A Permission is the access granted for an object and determine what you can do w/it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a Right?

A

A Right refers to the ability to take an action on an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a Privilege?

A

A Privilege is a combination of rights and permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What Authorization Mechanism consults a table that consists of subjects, objects, and assigned privileges?

A

An Access Control Matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What Authorization Mechanism is subject focused and identifies privileges assigned to subjects?

A

Capability Tables

28
Q

What Authorization Mechanism is object focused and identifies all of the users that are authorized access to specific objects?

A

An Access Control List (ACL)

29
Q

What Authorization Mechanism consists of applications that use constrained/restricted interfaces to restrict what users can do or see based on their privilege?

A

Constrained Interface

30
Q

What Authorization Mechanism restricts access to data based on the content within an object? Ex: a database view

A

Content-Dependent Control

31
Q

What Authorization Mechanism requires specific activity before granting users access? Ex: users must put item in cart before making purchase.

A

Context-Dependent Control

32
Q

What strategy uses multiple layers or levels of access controls to provide layered security such as physical, administrative, and technical/logical controls? Organizations implement access controls using this strategy.

A

Defense-In-Depth

33
Q

Which Access Control model has owners, creators, or custodians that control the access to objects? *It also uses ACL’s which makes it more flexible.

A

Discretionary Access Controls (DAC)

34
Q

Which Access Control model is centrally managed; meaning, it has administrators controlling access to objects?

A

Nondiscretionary Access Controls (Non-DAC). Central management makes it easy to manage.

35
Q

What Access Control Model is based on a subjects role or task assignment?

A

Role-Based Access Control

36
Q

What Access Control Model enforces Least-Privilege by preventing Privilege Creep?

A

Role-Based Access Control

37
Q

What Access Control Model uses a set of rules to determine what can and cannot occur on a system? Ex: a firewall

A

Rule-Based Access Control

38
Q

What Access Control Model uses policies that include multiple attributes for rules? Hint: this model is an advanced implementation of Rule-BAC.

A

ABAC; Attribute-based Access Control

39
Q

What Access Control Model relies on the use of classification labels for all subjects and objects to determine access?

A

MAC; Mandatory Access Controls

40
Q

What are the three MAC Model Environments?

A

1) Hierarchical
2) Compartmentalized
3) Hybrid

41
Q

What Access Control model enforces NTK?

A

MAC

42
Q

Which Access Control model is more scalable or flexible because it uses multiple ACLs to assign permissions?

a) DAC
b) MAC

A

DAC is more scalable/flexible b/c its managed by custodians that customize permissions for each subject.

43
Q

Which Access Control model is more secure?

a) DAC
b) MAC

A

MAC

44
Q

What MAC Model Environment relates various classification labels in order from low to high security?

a) Hierarchical
b) Compartmentalized
c) Hybrid

A

Hierarchical

45
Q

In which MAC Model Environment does each security domain represent a separate isolated compartment where there is no relationship between one domain and another?

a) Hierarchical
b) Compartmentalized
c) Hybrid

A

Compartmentalized

46
Q

Which MAC Model Environment combines both hierarchical and compartmentalized so that each hierarchical level may contain numerous subdivisions that are isolated from the rest of the domain?

a) Hierarchical
b) Compartmentalized
c) Hybrid

A

Hybrid

47
Q

What are the 3 steps early in the risk management process that help to understand attacks that may occur?

A

1) Identify Assets
2) Identify Threats
3) Identify Vulnerabilities

48
Q

What is it called when asset value is identified in order to prioritizing the asset?

A

Asset Valuation

49
Q

What is Threat Modeling?

A

Threat Modeling is the process of identifying, understanding and categorizing potential threats.

50
Q

What are the 3 Threat Modeling approaches?

A

1) Asset Focused - identifies threats to assets
2) Attacker Focused - identifies potential attackers & the threats they pose
3) Software Focused - identifies potential threats to software the org develops

51
Q

What attack collects non-sensitive information and combines (aggregating) it to learn sensitive info?

A

Access Aggregation Attack

52
Q

What is considered a Strong Password?

A 
8 Character minimum with a combination of at least 3 of the below:
•	Uppercase
•	Lowercase
•	Numbers
•	Special Characters
53
Q

What attack attempts discover password by using every possible password in a predefined database or list of common or expected passwords?

A

Dictionary Attack

54
Q

What attack systematically attempts all possible combinations of letters, numbers, and symbols?

A

Brute-Force Attack

55
Q

What attack attempts a dictionary attack and then performs a type of brute-force attack with a one-upped constructed password?

A

Hybrid-Attack

56
Q

What attack focuses on finding collisions?

A

Birthday Attack

57
Q

What can reduce the success rate of Birthday Attacks?

A

Salts & Hashing algorithms

58
Q

What attack is it when the attacker guesses a password, hashes it, and then puts both the guessed password and the hash into the rainbow table?

A

Rainbow Table Attack

59
Q

What is a Rainbow Table?

A

A Rainbow Table is a large database of pre-computed hashes.

60
Q

What attack is when an attacker uses a sniffer to capture information transmitted over a network?

A

Sniffer Attack

61
Q

In which attack does an attacker pretend to be someone or something else?

A

Spoofing Attack

62
Q

What attack tricks users into giving up sensitive information, opening an attachment, or clicking a link?

A

Phishing Attack

63
Q

What attack is a phishing variant that targets a specific groups of users?

A

Spear Phishing

64
Q

What attack is a phishing variant targets senior executives within a company?

A

Whaling

65
Q

What attack is a phishing variant that uses VoIP or the phone system (automated calls)?

A

Vishing

CISSP Weak Areas (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions