Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 8 > Flashcards

Domain 8 Flashcards

1
Q

__ application security testing involves probing a fielded or running application in order to discover potential flaws. This is considered __ box testing.

A

dynamic application security testing or dynamic application testing, black box testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

__ computing includes client/server (user over server-based applications by interfacing via the client), 3-tier (web apps e.g. web front-end, middleware, backend data store), peer-to-peer (each endpoint equally capable.

A

distributed computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

__ is if you find a vulnerability in Microsoft’s code and you publicly release it, that forces Microsoft to fix it. __ is going straight to Microsoft and waiting for them to release it.

A

full disclosure, closed disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

__ is the acronym for “Secure: by Design, by Default, by Deployment and Communications”

A

SD3+C, Application security is always best when integrated from the beginning e.g. Windows 8 will always be more secure than Windows XP since security wasn’t a critical design goal at that time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

__ is the development of a working model with test or real data using an iterative approach supported by user and developer interaction. This SDLC model typically implies frequent customer/client interaction throughout the project.

A

software prototyping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

__ occur in applications which request and later improperly release memory. Sensitive information can also be divulged.

A

memory leaks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

__ overflow can add a bit and overwrite information on the stack. Potential issues with this attack are: Memory holding an overflowed variable may be reset to zero (UID 0 is root on Unix), other memory may be corrupted, program logic can misfire due to unexpected values

A

integer overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

__ seeks to address issues that can arise from the separation of development and the operational environment.

A

DevOps (Development + Operations): application issues can stem from code, but can also stem from the operational environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

__ tools can be used to develop application systems faster and to increase programmers’ and analysts’ productivity.

A

CASE Tools: Computer-Aided Software Engineering tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A __ can mitigate a simple stack-smashing attack since this value is checked before the function returns. If it is changed, the function will normally exit with an error since the return pointer is eliminated (so you know malicious software is running).

A

canary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A __ tool is a computer-based product aimed at supporting one or more activities within any aspect of the software development process. It might support only one particular part of this process (such as compilers, editors or UI generators).

A

CASE Tools: Computer-Aided Software Engineering tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Application issues can arise from flaws in code, but also from issues within the operational environment. This approach seeks better understanding, communication and integration among the development and operations portions of an organization.

A

DevOps (Development and Operations)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Canaries may be used in a heap (where dynamic memory allocation normally occurs). What does Microsoft call a heap canary?

A

cookie

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Difference between open source and closed source.

A

open source: source is provided to you. Closed source: source is not provided to you. It is not free vs commercial. Sometimes commercial vendors will provide the source code so you could validate it from security perspective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Different types of canaries include a terminator canary (smashing the stack will normally alter and kill the canary), null canary (all null bytes) and a random canary (each byte is a random number). Which is the most secure form of canary?

A

random canary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Eclipse and MS Visual Studio are two popular __.

A

IDEs (Integrated Development Environment)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

For this CMMI level continuous process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies.

A

Level 5 Optimizing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In addition to avoiding flaws, this approach also seeks to streamline the process of deploying an application into operations, which can make for more efficient application updates.

A

DevOps (Development + Operations)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In distributed applications a client can send input to a remote system process to carry out an action. This communication is referred to as a __. __ is a traditional solution to this problem.

A

RPC (Remote Procedure Call), CORBA (Common Object Request Broker Architecture) employs an Object Request Broker as an intermediary to solve the problem of coordinating the communication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In order to finish a project, 5 people slept in the office for 5 days. Which level of the CMMI does this indicate?

A

Level 1 Initial (ad hoc, chaotic, few processes, occassionally chaotic. Success depends on individual efforts and heroics.

21
Q

In software security testing, __ involves running tools against application source code to look for known patterns that suggest particular types of security flaws (buffer overflows, SQL injection, OS Command injection)

A

static analysis

22
Q

In this level of CMMI, the necessary process discipline is in place to repeat earlier successes on projects with similar applications.

A

Level 2 Managed

23
Q

In this SDLC model, phases occur in succession and after each phase is completed, it is closed and not revisited.

A

waterfall model: phases occur in succession like water falling down a waterfall

24
Q

Methodologies for software development to improve the process and end-product.

A

SDLC (Software Development Life Cycle), also referenced as Systems Development Life Cycle

25
Q

Microsoft’s __ establishes 16 practices divided amongst traditional development phases.

A

MS SDL: Microsoft Security Development Lifecycle. Key practices are under “MS SDL key practices - D8 pg19”

26
Q

Name the software development methodologies aka SDLC models.

A

waterfall, spiral, prototyping, agile, scrum, XP (Extreme Programming). For exam think evolution - waterfall: too much time between delivery, spiral: more increments but still not what customer wants, prototyping: customer now actively engaged in design but team still went off for too much time; Agile is where we’re meeting every 3-4 weeks instead of 3-4 years

27
Q

Pair programming, continuous integration and continuous deployment are some terms often associated with this SDLC approach.

A

Agile: Pair programming (two developers coding from one machine in which the 2nd developer reviews code as it is written), Continuous integration (regularly integrating developer contributions back into the main branch, thereby find out about issues earlier), continuous deployment (similar to continuous integration but the code is actually deployed into production rather than just pushed back into main branch)

28
Q

Programmers can harden their applications via the use of secure __ such as Libsafe and SSP/ProPolice e.g. Libsafe will confirm that all variables are checked.

A

standard libraries. These include additional protections against vulnerabilities such as buffer overflows e.g. stack canaries

29
Q

QA and UAT are types of __ application testing, primarily to ensure functionality and usability of the application are appropriate. While not overtly security-focused they can be built to include security relevant test cases.

A

dynamic application testing

30
Q

SD3+C stands for __, a centerpiece of Microsoft’s SDL

A

Secure: by Design, by Default, by Deployment and Communications, Application security is always best when integrated from the beginning e.g. Windows 8 will always be more secure than Windows XP since security wasn’t a critical design goal at that time.

31
Q

Some numeric values are often stored in fixed length memory locations. What type of attack seeks to exploit this characteristic to achieve memory corruption or more?

A

integer overflow since it’s fixed length memory locations; buffer overflow is NOT fixed length

32
Q

The __ focuses on quality management practices and established a basis for evaluation of the development process.

A

CMMI (Capability Maturity Model Integration) D8 pg 7

33
Q

The __ level of CMMI has measurable metrics, can measure processes and make sure quality is being done correctly.

A

Level 4 Quantitatively Managed

34
Q

The __ model is a software development methodology that is also known as the “Traditional Method”.

A

waterfall model

35
Q

The __ model of the SDLC features a cyclic approach and set of anchor-point milestones. It is driven by risk.

A

spiral model

36
Q

The __ serves as the developer’s workspace and typically includes at least a code editor, debugger, and builder/compiler. It typically goes beyond simple code editing and debugging to increase the efficiency of the development.

A

IDE (Integrated Development Environment)

37
Q

The Agile approach is comprised of __ (5-10 min call every day with the customer and testing on the following day; worst case we’ve lost 24 hours) and __ (having customer be part of development team so customer representative is always there; what is the simplest thing to add value to customer).

A

Scrum, XP (Extreme Programming)

38
Q

The primary focus of employing SDL is different from SDLC. What is the main purpose of SDL?

A

Security since SDL (Security Development Lifecycle) vs SDLC (Software Development Lifecycle)

39
Q

The primary purpose of __ and __ is to ensure that the functionality and usability of the application are appropriate.

A

QA testing and UAT testing

40
Q

The SDLC model of __ allows you to prove concepts for the development of software, systems or applications.

A

software prototyping

41
Q

There is a risk of not meeting what the customer wants in which SDLC model (since there is no customer involvement).

A

waterfall model

42
Q

There is no customer invovement and no going back in which SDLC model?

A

waterfall model

43
Q

This SDLC model can simply be a non-operational mock-up.

A

software prototyping

44
Q

We are concerned that although apps are validated, there will be unforeseen issues in the operational environment. This is most closely tied to what approach?

A

DevOps (Development + Operations)

45
Q

We are concerned that although apps are validated, there will be unforeseen issues in the production environment This is most closely tied to what approach?

A

DevOps (Development + Operations)

46
Q

What are the CMMI levels?

A

Level 1 Initial (ad hoc, chaotic), Level 2 Managed (basic processes), Level 3 Defined (documenting, having predictable outcome), Level 4 Quantitatively Managed (metrics), Level 5 Optimizing (continuous improvement)
‘Capability Maturity Model Integration: D8 pg 7’

47
Q

What is the number one way to reduce risk in code development?

A

all code should undergo code reviews aka security reviews before implementation. This is an ISC2 golden rule. Other important points: developers should never by directly modifying production code; you always want detailed logging. Mimimize buffer overflow, escalation of privilege and backdoors.

48
Q

Which level of CMMI is where you have formal documentation and can start planning out projects?

A

Level 3 Defined (software process documented/standardized)

49
Q

Which type of testing would be most appropriate to ensure that all expected functionality of the application is present and working properly?

A

UAT testing or if that’s not there, it is a subset of QA testing so you can choose that as well

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions