Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Domain 8 > Domain 8 Flash Cards > Flashcards

Domain 8 Flash Cards

1
Q

ActiveX Data Objects (ADO)

A

A Microsoft high-level interface for all kinds of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Acceptance

A

formal, structured hand-off of the completed software system to the customer org; usually involves test, analysis and assessment activites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Accreditation

A

AKA Security Accreditation a formal declaration by a designated accrediting authority (DAA) that an information system is approved to operate at an acceptable level of risk, absed onthe implementation an approved set of technical, managerial, and procedural safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ACID Test

A

data integrity provided by means of enforcing atomicity, consistency, isolation, and durability policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Aggregation

A

ability to combine non-sensitive data from separate sources to create sensitive info; note that aggregation is a “security issue”, where as inference is an attack (where an attacker can pull together peces of less sensitive info to derive info of greater sensitivity)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Arbitrary code

A

alternate set of instructions and data that an attacker attempts to trick a processor into executing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Buffer overflow

A

source code vulnerability allowing access to data locations outside of the storage space allocated to the buffer; can be triggered by attempting to input data larger than the size of the buffer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Bypass attack

A

attempt to bypass front-end controls of a database to access information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Capability Maturity Model for
Software (CMM or SW CMM)

A

Maturity model focused on quality management processes and has five maturity levels that contain several key practices within each maturity level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Common Object Request
Broker Architecture (CORBA)

A

A set of standards that addresses the need for interoperability between hardware and software products. residing on different machines across a network; providing object location and use across a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Computer virus

A

A program written with functions and intent to copy and disperse itself without the knowledge and cooperation of the owner or user of the computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Configuration management
(CM)

A

A formal, methodical, comprehensive process for establishing a baseline of the IT environment (and each of the assets within that environment).
collection of activities focused on establishing and maintaining integrity of IT products and information systems, through the control of processes for initialization, changing and monitoring the configurations of those products and systems throughout the system development lifecycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Covert channel

A

An information flow that is not controlled by a security control and has the opportunity of disclosing confidential information.
a method used to pass information over a path that is not normally used for communiction; communication pathways that violate security policy or requirement (deliberately or unwittingly); basic types are timing and storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Certification

A

comprehensive technical security analysis of a system to ensure it meets all applicable security requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Change Advisory Board (CAB)

A

purpose is to review and approve/reject proposed code changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Citizen programmers

A

organizational members who codify work-related knowledge, insights, and ideas into (varying degress of) usable software; the process and result is ad hoc, difficult to manage, and usually bereft of security considerations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Code protection/logic hiding

A

prevents one software unit from reading/altering the source/intermediate/executable code of another software unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Code resuse

A

reuse of code, rather than re-invented code means units of software (procedures/objects) means higher productivity toward development requirements using correct, complete, safe code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Complete coverage

A

testing all of the functions of software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Configuration Control

A

process of controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modifications prior to, during, and after system implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data mining

A

A decision-making technique that is based on a series of analytical techniques taken from the fields of mathematics, statistics, cybernetics, and genetics.
analysis and decision-making technique that relies on extracting deeper meanings from many different instances and types of data; often applied to data warehouse content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data base Management
System (DBMS)

A

A suite of application programs that typically manages large, structured sets of persistent data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Database model

A

Describes the relationship between the data elements and provides a framework for organizing the data. design process that identifies all data elements that the system will need to input, create, store, modify, output, and destroy during operational use; should be one of the first steps in analysis and design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

DevOps

A

An approach based on lean and agile principles in which business owners and the development, operations, and quality assurance departments collaborate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Data Contamination
attackers attempt to use malformed inputs, at the field, record, transaction, or file level, in an attempt to disrupt the proper functioning of the system
26
Data Lake
a data warehouse incorporating multiple types of streams of unstructured or semi-structured data
27
Data Protection and Data Hiding
restricts or prevents one software unit from reading or altering the private data of another software unit or in preventing data from being discovered or accessed by a subject
28
Data Type Enforcement
how a language protects a developer from trying to perform operations on dissimilar types of data, or in ways that would lead to erroneous results
29
Data Warehouse
collection of data sources such as separate internal databases to provide a broader base of info for analysis, trending and reference; may also involve databases from outside the org
30
Data-centric Threat Modeling
methodology and framework focusing on the authorized movements and data input/output into and from a system; corresponds with protecting data in transit, at rest, and in use when classifying organizational data
31
Defensive Programming
design/coding allowing acceptable but sanitized data inputs to a system; lack of defensive programming measures can result in arbitrary code execution, misdirection of the program to other resoruces/locations, or reveal info useful to an attacker
32
Design Reviews
should take place after the development of functional and control specifications but before the creation of code
33
Dirty read
occurs when one transaction reads a value from a database that was written by another transaction that didn't commit
34
Emerging Properties
an alternate/more powerful way of looking at systems-level behavior characteristics such as safety and security; helps provide a more testable, measurable answer to questions such as "how secure is our system?"
35
Encapsulation
enforcement of data/code hiding during all phases of software development and operational use; bundling together data and methods is the process of encapulation (opposite of unpacking/revealing)
36
Executable/Object Code
binary representation of the machine language instruction set that the CPU and other hardware of the target computer can directly execute
37
Extensible Markup Language (XML)
is a set of HTML extensions providing for data storage and transport in networked environments; frequently used to integrate web pages with databases; XML is often embedded in the HTML files making up elements of a web page
38
Functional requirements
describes a finite task or process the system must perform; often directly traceable to specific elements in the final system's design and construction
39
Hierarchical database model
data elements and records are arranged in tree-like parent-child structures
40
Integrated Product and Process Development (IPPD)
A management technique that simultaneously integrates all essential acquisition activities through the use of multidisciplinary teams to optimize the design, manufacturing, and supportability processes. Management technique that simultaneously integrates essential acquisition activities through the use of multidisciplinary teams to optimize the design, manufacturing, and supportability processes
41
Integrated Product Team
team of stakeholders and individuals that possess different skills and who work together to acheive a defined process or product
42
Infrastructure as Code (IaC)
instead of viewing hardware config as a manual, direct hands-on, one-on-one admin hassle, it is viewed as just another collection of elements to be managed in the same way that software and code are managed under DevSecOps
43
Interactive Application Security Testing (IAST)
testing that combines or integrates SAST and DAST to improve testing and provide behavioral analysis capabilities to pinpoint the source of vulnerabilities
44
Knowledge Discovery in Databases (KDD)
A mathematical, statistical, and visualization method of identifying valid and useful patterns in data.
45
Knowledge Management
efficient/effective management of info and associated resources in an enterprise to drive business intelligence and decision-making; may include workflow management, business process modeling, doc management, db and info systems, and knowledge-based systems
46
Log
A record of actions and events that have taken place on a computer system.
47
Level of abstraction
how closely a source-code/design doc represents the details of the underlying object/system/component; lower-level abstractions generally have more detail than high-level ones
48
Living off the land (non-malware based ransom attack)
system attack where the system/resources compromised are used in pursuit of additional attacks (i.e. the attacker's agenda); anti-malware defence doesn't detect/prevent the attack given the attacker's methodology
49
Metadata
Information about the data. info that describes the format or meaning of other data, which can be used to provide a systematic method for describing resources and improving info retrieval
50
Malformed input attack
not currently handling input data is a common source of code errors that can result in arbitrary code exec, or misdirection of the program to other resources/locations
51
Markup Language
non-programming language used to express formatting or arrangement of data on a page/screen; usually extensible, allowing users to define additional/other operations to be performed; they etend the language into a programming language (e.g. in the same way JavaScript extends HTML)
52
Mobile code (executable content)
file(s) sent by a system to others, that will either control the execution of systems/applications on that client or be directly executed
53
Modified prototype model
approach to system design/build that starts with a simplified version of the application; feedback from stakeholders is used to improve design of a second version; this is repeated until owners/stakeholders are satisfied with the final product
54
Network database model
database model in which data elements and records are arranged in arbitrary linked fashion (.e.g lists, clusters, or other network forms)
55
Nonfunctional requirements
broad characteristics that do not clearly align with system elements; many safety, security, privacy, and resiliency can be deemed nonfunctional
56
Object/Memory reuse
systems allocate/release and reuse memory/resources as objects to requesting processes; data remaining in the object when it is reused is a potential security violation (i.e. data remanence)
57
Object
encapsulation of a set of data and methods that can be used to manipulate that data
58
Object-oriented database model
database model that uses object-oriented programming concepts like classes, instances, and objects to organize, structure, and store data and methods; schemas define the structure of the data, views specify table, rows, and columns that meet user/security requirements
59
Object-oriented security
systems security designs that make sue of object-oriented programming characteristics such as encapsulation, inheritance, polymorphism, and polyinstantiation
60
Open-source software
source code and design info is made public, and often using licenses that allow modification and refactoring
61
Pair programming
requires two devs to work together, one writing code, and the other reviewing and tracking progress
62
Pass-around reviews
often done via email or code review system, allows devs to review code asynchronously
63
PERT
chart that uses nodes to represent milestones or deliverables, showing the estimated to to move between milestones
64
Polyinstantiation
creates a new instance (copy) of a data item, with the same identifier or key, allowing each process to have its own version of that data; useful for enforcing and protecting different security levels for a shared resource; polyinstantiation also allows the storage of multiple different pieces of info in a database at different classification levels to prevent attackers from inferring anything about the absence of info
65
Procedural programming
emphasizes the logical sequence of steps to be peformed, where a procedure is a set of software that performs a particular function, requiring specific input data, producing a specific set of outputs, and procedures can invoke other procedures
66
Query attack
use of query tools to access data not normally allowed by the trusted front end, including the views controlled by the query application; could also result from malformed queries using SQL to bypass security controls; improper/incomplese checks on queries can be used in a similar way to bypass access controls
67
Ransom attack
form of attack that threatens destruction, denial, or unauthorized public release/remarketing of private information assets; usually involves encrypting assets and withhold the decryption key until a ransom is paid by the victim
68
Refactoring
partial or complete rewrite of a set of software to perform the same functions, but in a more straightforward, more efficient, or more maintainable form
69
Regression testing
test a system to ascertain whether recently approved modifications have changed performance of other approved functions or introduced other unauthorized behavior;testing that runs a set of known inputs against an app and compares to results previously produced (by an earlier version of the software)
70
Relational database model
AKA relational database management system (RDBMS), data elements and records arranged in tables which are related or linked to each other to implement business logic, where data records of different structures or types are needed together in the same activity
71
Representational State Transfer (REST)
software architectural style for synchronizing the activities of two or more apps running on different systems on a network; REST facilitiates these processes exchanging state information, usually via HTTP/S
72
Reputation monitoring
defensive tactic that uses the trust reputation of a website or IP address as a means of blocking an org's users, processes or systems from connecting to a possible source of malware or exploitations; possibly the only real defense against zero-day exploits; involves monitoring URLs, domains, IP addresses or other similar info to separate untrustworthy traffic
73
Runtime Application Security Protection (RASP)
security agents comprised of small code units built into an app which can detect set of security violations; upon detection, the RASP agent can cause the app to terminate, or take other protective actions
74
Software assurance (SwA)
The level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its life cycle, and that it functions in the intended manner.
75
Security Assessment
testing, inspection, and analysis to determine the degree to which a system meets or exceeds the required security posture; may assess whether an as-built system meets the requirements in its specs, or whether an in-use system meets the current perception of the real-world security threats
76
Software Quality Assurance
variety of formal and informal processes that attempt to determine whether a software app or system meets all of its intended functions, doesn't perform unwanted functions, is free from known security vulns, and is free from insertion or other errors in design and function
77
Software Development LifeCycle (SDLC)
is a framework and systematic associated with tasks that are performed in a series of steps for building, deploying, and supporting software apps; begins with planning and requirements gathering, and ends with decommissioning and sunsetting; there are many different SDLCs, such as agile, DevSecOps, rapid prototyping, offering different approaches to defining and managing the software lifecycle
78
Source code
program statements in human-readable form using a formal programming language's rules for syntax and semantics
79
Spyware/Adware
software that performas a variety of monitoring and data gathering functions; AKA potentailly unwanted programs/applications (PUP/PUA), may be used in monitoring employee activities/use of resources (spyware), or advertising efforts (adware); both may be legit/authorized by system owners or unwanted intruders
80
Strong data typing
feature of a programming language preventing data type mismatch errors; strongly typed languages will generate errors at compile time
81
Time multiplexing
Allows the operating system to provide well-defined and structured access to processes that need to use resources according to a controlled and tightly managed schedule.
82
Time of Check vs. Time of Use (TOC/TOU) Attacks
Takes advantage of the dependency on the timing of events that takes place in a multitasking operating system.
83
Trusted computing bases (TCB)
The collection of all of the hardware, software, and firmware within a computer system that contains all elements of the system responsible for supporting the security policy and the isolation of objects.
84
Threat surface
total set of penetrations of a boundary or perimeter that surrounds or contains system elements
85
Trapdoor/backdoor
AKA maintenance hook; hidden mechanism that bypasses access control measures; an entry point into an architecture or system that is inserted in software by devs during development to provide a method of gaining access for modification/support; can also be inserted by an attacker, bypassing access control measures designed to prevent unauthorized software changes
86
User Acceptance Testing (UAT)
typically the last phase of the testing process; verifies that the solution developed meets user requirements, and validates against use cases
87
Waterfall development methodology
A development model in which each phase contains a list of activities that must be performed and documented before the next phase begins

Domain 8 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions