Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP2020 > Domain 8 - Software Development Security > Flashcards

Domain 8 - Software Development Security Flashcards

1
Q

What does the Stride threat model stand for?

A

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Escalation of Privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the mitigation for Spoofing?

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the mitigation for Tampering?

A

Integrity Verification (Message Digest etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the mitigation for Repudiation?

A

Non-Repudiation (Digital Signatures, Keys etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the mitigation for Information Disclosure?

A

Confidentiality through encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the mitigation for Denial of Service?

A

High Availability/Redundancy/Fault Tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the mitigation for Escalation of Privilege?

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does the DREAD bug tracking classification stand for?

A 
D - Damage Potential
R - Reproducibility
E - Exploitability
A - Affected User Base
D - Discoverability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the difference between Verification and Validation checks?

A

Verification is the assessment of whether a system was built to specification. Validation is the acceptance of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the nature of Object-Oriented Programming?

A

Object Orientated is modular and reusable through using objects, classes, methods and functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are Classes and Objects?

A

Class is a concept (ie people) and an Object brings that concept to life (ie user accounts).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an example of a Primary Key in a database?

A

ID=1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Entity Integrity in Databases?

A

Primary key (ID=1) cannot be NULL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Normalization in Databases?

A

Each attribute in a database must describe ONLY the primary key. This helps to prevent duplicate information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are Attributes in Databases?

A

They are the entries in a table which reference the Primary key (for example name, address etc of ID=1)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the Tulpes in a Database?

A

Tuples is the data in rows, usually called records (this is important for the exam)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Foreign Key in a Database?

A

Is when the Primary Key from one table appears in a secondary database (Customer ID and Order ID etc).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the Cardinality in a Database?

A

How many times a Primary key is referenced in another databases row relation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Degree in a Database?

A

How many times a Primary key is referenced in another databases column relation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the threat of Aggregation and Inference in Databases?

A

When you can draw a connection between two datasets (somebody was sick, didn’t drink and went to the doctor = pregnant)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Polyinstantiation for Databases?

A

Lying (instead of marking the destination of a ship as top secret, it should be marked as delivering food in Africa so that it doesn’t draw attention)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does the Atomicity test for Databases?

A

Transactions are either fully committed or rolled back (halfway through paying and the power cuts out)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does the Durability test for Databases mean?

A

Once a change has been committed, the transaction can’t be rolled back

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does the Isolation test for Databases mean?

A

Transactions are invisible until committed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does the Consistency test for Databases mean?

A

Database rules are enforced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does ACID stand for in relation to Database testing?

A

A - Atomicity
C - Consistency
I - Isolation
D - Durability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

A process that provides clear and logical steps that should be followed to ensure that the system which emerges at the end of the development process provides the intended functionality, with an acceptable level of security.

A

System Development Life Cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

A collection of computer instructions written using some readable (human readable) computer language.

A

source code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

These deliver instructions directly to the processor using binary instructions without an interpreter or compiler. Characteristics include: time consuming, prone to errors, short in length, and rudimentary progress.

A

machine languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

This category emerged in the 1990’s. The goal is to create software that can solve problems on its own rather than requiring a programmer to create code to deal with a problem. AI and knowledge-based processing fall within this category.

A

natural languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

This category is one step above machine languages and uses symbols or mnemonics to represent sections complicated binary code. This uses a simplified code and an assembler to convert code to machine language; requires extensive architecture knowledge; code is hardware specific; and it is difficult to create/write.

A

assembly languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Developed in the 1960’s it uses “if-then-else” statements. Characteristics include: independent processor; human-like syntax (easier to use); does not require a compiler or interpreter to convert instructions into machine code.

A

high-level languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A fourth generation of languages that focuses on abstract algorithms that hide some of the complexity from the programmer. This frees the programmer to focus on the real-world problems to be fixed in the software (to solve) rather than focusing on behind the scenes.

A

very high-level languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

A code that has already been translated to binary language; it is difficult to detect malicious code in this type of code.

A

compiler (compiled)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

This type of code uses a piece of software that allows the end user to write human-like, readable code; a program can then be executed directly by this component, which make it somewhat easier to read (see) malicious code.

A

Interpreters (interpreted)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

A type of programming in which objects are organized in a hierarchy in classes with characteristics called attributes attached to each. This programming type emphasizes the employment of objects and methods rather than types of transformations as in other software approaches.

A

Object-Orientated Programming (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

The software program allows for objects to be created on demand, through request from objects that need a new function to be performed. Requests are instantiated (built in) with the necessary code. The objects can be written in any language as long as the objects can communicate with each other.

A

created classes/objection (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Objects are able to communicate with each other regardless of the language type, to make requests. This is what makes the communication possible.

A

application program interface (API) (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Functionalities or procedures of objects organized into classes; defines how an object behaves or reacts to a message.

A

methods (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

This allows for methods to be passed from a class to a subclass.

A

inheritance (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

The object contains attribute values (messages to be sent to another object’s API).

A

encapsulate (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

When different objects may communicate or react differently to the same message (the code that defines how an object will react with respect to the message is called the method).

A

behaviors (OOP object behaviors)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Encapsulation is another name of this technique. It is the process of hiding or keeping private some parts of an object’s internal data operations.

A

data binding (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Is the ability to suppress unnecessary details.

A

abstraction (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Uses data types with define ranges; programmers must identify all data objects and their relationships using this technique. The object is then generalized into an object class, defined as part of a log sequence (method) used to manipulate an object.

A

data modeling (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Examples of this category include C++, Simula 67, and smalltalk.

A

languages (OOP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Modularity in design through autonomous objects; definition of internal components without impacting other parts of the system; reusable components; and more readily maps to business needs.

A

Advantages of OOP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

The ability of different objects with a common name to react to the same message or input with different output.

A

polymorphism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

A process used to prevent data inference violations. It does this by enabling a relation to contain multiple tuples with the same primary keys with each instance distinguished by a security level. It prevents low-level database users from inferring the existence of higher level data.

A

polyinstantiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

In software development, this technique protects objects by preventing direct access to data that is in the object; makes it hard to apply the appropriate security policies to an object because it is hard to determine.

A

encapsulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

A term used to describe how many different tasks a module can carry out; if a module is limited (small number) or has a single function it is said to have high this quality.

A

cohesion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Changes can be made to the model without affecting the other modules; it makes reuse of the object easier.

A

high cohesion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Limiting the scope of a module’s operations.

A

How the highest cohesion achieved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Refers to how much interaction one module requires from another module to do its job. If this is low or loose, it indicates a module does not need much help from other modules to do its job and a high value means it needs more help.

A

coupling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

High cohesion and low coupling.

A

Best programming situation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

The logical relationship between elements of data. It describes the extent to which elements, methods of access, and processing alternatives are associated and the organization of data elements.

A

data structure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Systems whose components must be able to both locate each other and communicate on a network. When an application operates in a client/server framework the solution is performing this type of computing.

A

distributed object-orientated systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Common Object Request Broker Architecture

A

CORBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

An open object-orientated standard developed by the Object Management Group (OMG).

A

Common Object Request Broker Architecture (CORBA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

CORBA is responsible for enforcing the security in four types of policies:

A
  1. Access control; 2. Data protection; 3. Non-repudiation; and 4. Auditing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

It accepts requests for service from the client application, directs the request to the server, then relays the response back to the client application. It can be used for objects written in different languages.

A

CORBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

A model for communication between processes on the same computer.

A

Component Object Model (COM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

A model used for communication between processes in different parts of the network.

A

Distributed Component Object Model (DCOM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

This works as middleware between remote processes; also referred to as interprocess communication (IPC).

A

The function of DCOM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Services provided by DCOM.

A
  1. Data connectivity; 2. Message services; 3. Distributed transaction services. These functions are integrated into one technology that uses the same interface as COM.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

A method for sharing object on a local computer that uses COM as its foundation. It is described as the predecessor of COM. It allows objects to be embedded into spreadsheets and graphics.

A

Object Linking and Embedding (OLE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Placement of data into a foreign program or document.

A

embedding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Relationship between one program and another.

A

linking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

A distributed component mode; its framework is used to develop software that provides APIs for networking services and uses interprocess communication process that is based on CORBA.

A

Java Platform Enterprise Edition (J2EE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

To provide a standard method of providing a back-end code that carries out business logic for enterprise applications.

A

J2EE goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

An approach that provides web-based communication functionality without requiring redundant code to be written per application. It uses standard interfaces and components called service brokers to facility communication among web-based applications.

A

Service Orientated Architecture (SOA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Instructions passed across a network and executed on a remote system. As a security concern, it can be remotely executed without the user’s knowledge.

A

mobile code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

A small component created using Java that runs in a web browser. It is platform independent and creates intermediate code called “byte code.” As a security issue, these have the potential to download loose code.

A

Java applet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

It resides on the destination machine and converts byte code to machine code. It executes Java applets in a sandbox called the Java Security Mode (JSM). This helps to mitigate malicious code but cannot completely stop it.

A

JVM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

A Microsoft technology that uses object-orientated programming (OOP) and is based on COM and DCOM. It uses “authenticode” technology to digitally sign controls, which can become malicious if the user has Admin rights.

A

Active X

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Most suspicious: Java applets or Active X?

A

Active X

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

The Five Phases of software development.

A
  1. Initiate. 2. Acquire and develop. 3. Implement. 4. Operate and maintain. 5. Dispose
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

A predictable framework of procedures designed to identify all requirements with regard to functionality, cost, reliability, and delivery schedule and ensure that all these requirements are met in the final software solution.

A

Software Development Life Cycle

79
Q

Recognize the need for a change. Initiate the change. Decide if it is something that needs to be purchased or internally developed. Create a preliminary risk assessment to conducer how to maintain the security of the CIA triad tenets.

A

Project Initiation (Phase 1 of the System Development Life Cycle)

80
Q

The organization works to determine and consider questions to help decide whether to purchase (acquire) or develop the new software.

A

Acquire and Development (Phase 2 of the System Development Life Cycle)

81
Q

This is the “acquire and develop” stage and the questions to consider include: What does the new system need to perform? What CIA risks does the solution pose? What levels of protection are needed to satisfy legal/regulatory requirements? How do third-parties address these concerns? How will security controls for the new solution affect other parts of the organization? And, what metrics will be used to measure success of the security?

A

Questions to ask in Phase 2 (Acquire and Develop phase of the System Development Life Cycle)

82
Q

Complete certification and accreditation before introducing the solution into the live environment.

A

Implement (Phase 3 of the System Development Life Cycle)

83
Q

The technical evaluation of a system. It is the process of evaluating software for its security effectiveness with regards to the customer’s needs.

A

certification

84
Q

The formal acceptance of the adequacy of a system’s overall security by the management. This has two forms: provisional and full.

A

accreditation

85
Q

A baseline performance is measured after the system is installed. The baselines are monitored for changes as that may need to be quickly addressed. The formal change management process is used to ensure the changes are approved and documented, then the baselines are re-monitored for changes after the implementation. Last, a vulnerability and penetration test is completed to review security.

A

Operate and maintain (Phase 4 of the System Development Life Cycle)

86
Q

The IT process which ensures that all changes are both approved and documented.

A

Change Management Process

87
Q

When the solution reaches the end of its life cycle questions are considered prior to ending the solution: Will security holes be left after removing the solution? How can the solution be removed without disrupting other operations that were part of, or depend on, or interact with the solution? What legal/regulatory issues have to be considered before removing the solution?

A

Disposal (Phase 5 of the System Development Life Cycle)

88
Q
  1. Plan and initiate he project; 2. Gather requirements; 3. Design; 4. Develop; 5. Test and validate; 6. Release and maintains; 7. Certify and accredit; and 8. Change management and configuration management and or replacement.
A

Steps in the Software Development

89
Q

The organization formally plans the project. Security of the application is considered. The owner assigns value. Legal/regulatory requirements are documented. Application controls are used to protect input/output data. The types of network needs are determined. Analyze all data source and the effects of the use of the application on the organization’s operations.

A

Plan and initiate the project (Step 1 of the SDLC)

90
Q

Functionality and security requirements are identified. Identify vulnerabilities and threats. Consider the intended purpose of the software. Consider the sensitivity of the data that will be generated. Assign a privacy impact rating to help guid all measures used to protect the data.

A

Gather requirements (Step 2 of the SDLC)

91
Q

This involves writing of the code with an emphasis on strict coding security.

A

Develop (Step 3 of the SDLC)

92
Q

Runs several types of testing, and validating. Looks for functional errors and security issues. Tests are “attacked” to show the software includes resilience to buffer overflows and DoS attacks, this is done in unit testing. The testing goals are: 1. verification and 2. validation.

A

Test and validate (Step 5 of the SDLC)

93
Q

Test determines whether the original purpose of the software has been achieved.

A

Validation testing

94
Q

Test determines if the original design specifications have been met.

A

Verification testing

95
Q

This type of testing is done by the development staff. It tests that the data is part of the specifications previously outlined. This type of testing checks for out-of-range values and out-of-bound conditions. Correct test output results should be developed and known before hand. Types of this test include: integration testing, acceptance testing, and regression testing.

A

Unit testing

96
Q

Assess the way in which the modules work together and determines whether functional and security specifications have been met.

A

Integration testing

97
Q

Testing to ensure that the customer’s (either internal or external) is satisfied with the functionality of the software.

A

acceptance testing

98
Q

Takes place after changes are made to the code to ensure the changes have neither reduced functionality or security.

A

regression testing

99
Q

Implementation of the software into the live environment. Continued monitoring of its operation; this is where problems may appear, such as zero-day vulnerabilities, because no one knows it is there.

A

Release and maintain (Step 6 of the SDLC)

100
Q

This is not a two-step process. One can be done without the other. In the certification process the software will be evaluated for its security effectiveness in regards to the customer’s needs. Accreditation list he formal acceptance of the adequacy of the a system’s overall security by management. The process can include provisional accreditation or full accreditation.

A

Certification and accreditation (Step 7 of the SDLC)

101
Q

A specific time frame until changes that are listed, have been made, prior to granting full accreditation.

A

provisional accreditation

102
Q

This is granted once everything has been completed, analyzed, and approved by a certifying body.

A

full accreditation

103
Q

If changes need to be made to the software code, the changes are done first through a formal change and configuration management process.

A

Change management and Configuration Management/replacement (Step 8 of the SDLC)

104
Q

A software development method, not discredited, but remains a template for how NOT to manage a development process. Software is developed as quickly as possible and then released. There is no formal mechanism to provide feedback during the process. It quickly gets the product to market with problems that will later need to be patched or have service packs applied.

A

Build and Fix

105
Q

A software development model that breaks the software development process into distinct phases. While somewhat of a right approach, it sees the process as a sequential series of steps that are followed without going back to the earlier steps. This approach is called the incremental development and it never returns to the earlier steps.

A

Waterfall Model

106
Q

Each phase of the software development is its own milestone in the project management process. There is no backward iteration. Problems are dealt with after the project is complete. Product verification/validation are done in this model.

A

Modified Waterfall Model

107
Q

A software development model in which verification and validation are performed at each step. The result is a higher likelihood of success.

A

V-Shaped Model

108
Q

A software development method that uses a sample code to explore a specific approach to solving a problem before investing extensive time and money in the approach. This method saves time and money by building and designing before a full model is built.

A

Prototyping

109
Q

Three testing types: Integration, Acceptance, and Regression.

A

Unit Testing

110
Q

Software Development Acquisition Stages

A

Monitor, Plan, Contract, and Maintain

111
Q

Phases of System Development Life Cycle

A

Initiate, Acquire/Develop, Implement, Operate/Maintain, and Dispose

112
Q

Steps in the Software Development Life Cycle

A

Plain and Initiate, Gather requirements, Design, Develop, Test and validate, Release and Maintain, Certify and Accredit, Change and configuration management or replacement

113
Q

System Development Life Cycle (SDLC) versus Software Development Life Cycle (processes)

A

The Software Development Life Cycle processes and the System Development Life Cycle processes are both parts of the overall System Life Cycle.

114
Q

An API used with software the provides encryption.

A

Cryptographic Application Programming Interface (CASE)

115
Q

An encryption API that is used with developing and maintaining software. It provides the following functions: analysis of business functions, system design, code storage, uses compilers, provides translation, and software testing.

A

Computer Aided Software Engineering (CASE)

116
Q

Types of validation controls.

A

Pre-validation, Parameter validation, and Post-validation.

117
Q

This input control is implemented on the client side and occurs before being submitted to an application.

A

Pre-validation control

118
Q

This input control has validated values that are entered into an application. The values must be within the server’s set limits.

A

Parameter validation control

119
Q

This input control validates an application’s output is restricted to a pre-defined definition.

A

Post-Validation control

120
Q

Confidence in the security mechanism(s) being provided in the software.

A

Assurance

121
Q

Two parts of the Life Cycle Assurance process.

A

Product Development and Product Maintenance

122
Q

Trusted distribution, design specification, unit and integration testing, configuration management, and clipping level configurations.

A

Types of Life Cycle Assurance Parameters

123
Q

Software Assurance (Acquisition) Phases (SwA)

A

Planning phase, Contracting phase, Monitoring and Accepting phase, and Follow-on Phase.

124
Q

SwA Phase: The company sets out the objectives and the goals are described; meeting with the different teams; and overall proper security assessment (such as in an acquisition or merger) is addressed.

A

Planning Phase

125
Q

SwA Phase includes: Creating a request for proposal (RFP); accepting vendor bids; and the company choses a vendor’s bid. The vendor reviews the contract to ensure it meets all the required conditions. A Code Escrow should also be put in place during this phase.

A

Contracting Phase

126
Q

SwA Phase includes: Deployment of software; working with vendor to ensure all requirements are being met; focus on training and understanding how the deployed program is functioning.

A

Monitoring and Acceptance Phase

127
Q

SwA Phase includes: Organization ensures the product is kept up-to-date and maintained by the third-party or vendor. It could also include decommissioning the program if it has reached the end of its life cycle.

A

Follow-On Phase

128
Q
  1. Determine the state of the organization’s current software development processes.
  2. Use the software development process to gain support from within the organization for a software processes improvement program.
  3. Develop an action plan for a continuous software process improvement plan.
A

Software processes assessment

129
Q

This interface language is used for web technologies and it also uses tags.

A

extensible markup language (XML)

130
Q

This is has an API that allows Java to communicate with a database.

A

Java Database Connectivity (JDBC)

131
Q

This links data between different databases.

A

object linking and embedding database (OLE DB)

132
Q

This uses ActiveX data objects and is an API that allows ActiveX programs to query databases.

A

ActiveX Data Objects (ADO)

133
Q

A type of API that provides encryption.

A

Cryptographic API (CAPI)

134
Q

This is a software tool that is used to develop and maintain application software. It can be used to review business functions, the design of the system, store code, compile, translate, and test software during the development process.

A

Computer-aided software engineering (CASE)

135
Q

Two parts of the System Life Cycle (SLC)

A

Operations and Maintenance Support (post installation); and Revisions and System Replacement

136
Q

In this phase of software acquisitions the product is deployed, the complier completes the contract, and the buyer of the product formally accepts the final product.

A

Monitoring Phase

137
Q

In this phase of software acquisitions the software requirements are documented, an acquisition strategy is created, and the evaluation criteria is developed.

A

Planning Phase

138
Q

In this phase of software acquisitions a request for proposal (RFP) is issued, the proposal is evaluated, and the final contract is negotiated and completed between the seller and the buyer.

A

Contracting Phase

139
Q

In this phase of software acquisitions the software is maintained and later considers the decommission of the software when it is no longer needed or updatable.

A

Maintaining Phase

140
Q

This ensures that the attributes in a database table depend only on the primary key.

A

Normalization

141
Q

This prevents repetitive information from appearing in a database.

A

Normalization

142
Q

This makes it easier to manage and maintain consistency in a database.

A

Normalization

143
Q

In this process the software is debugged, checked for valid parameters, and allows for corrections to be made where needed.

A

Unit Testing

144
Q

This allows for direct communication between two applications using the interprocess communications (IPC). It is based on a client/server model and allows the exchange of data between the client and the server.

A

Dynamic Data Exchange (DDE)

145
Q

This type of attack occurs a little at a time, over time, and is repeated often, most likely by an insider. It is also similar to Data Diddling.

A

Salami Attack

146
Q

In the SDLC, this includes identification of threats and vulnerabilities; requires getting management approval; performs a risk analysis and evaluates the environment in which the software will run data processing.

A

Project initiation and Planning

147
Q

Certification and Accreditation occur in this phase of the SDLC.

A

Testing and Evaluation Control

148
Q

In this phase of the SDLC the formal functional baselines and security tasks are defined in the design of the software.

A

Functional Requirements and Definitions

149
Q

A communication paths that is not controlled by any security mechanism and gains access to information via an unauthorized means to violate the security policy.

A

Covert Channel

150
Q

TSCEC B3 addresses this type of Covert Channel.

A

Covert Timing Channel

151
Q

TSCEC B2 address this type of Cover Channel.

A

Covert Storage Chanel

152
Q

This is a type of ICMP back door tunneling attack that is considered a covet channel attack.

A

Loki Attack

153
Q

Configuration Management versus Change Management

A

Change Management falls under Configuration Management.

154
Q

Configuration: Identification, Control, Status Accounting, and Audits.

A

Configuration Management (steps)

155
Q

Configuration Management

A
  1. Make formal request
  2. Analyze request
  3. Record the change request
  4. Submit the change request for approval
  5. Make changes
  6. Submits the results to management for review
156
Q

A Microsoft high-level interface for many types of data.

A

ActiveX Data Objects (ADP)

157
Q

Maturing model focused on quality management processes and has five maturity levels that contain several key practices within each maturity level.

A

Capability Maturity Model for Software (CCM or SW-CMM)

158
Q

A set of standards that addresses the need for interoperability between hardware and software products.

A

Common Object Request Broker Architecture (CORBA)

159
Q

A program written with functions and intent to copy and disperse itself without the knowledge and cooperation of the owner or user of the computer.

A

Computer Virus

160
Q

Monitoring and management changes to a program or documentation.

A

Configuration Management (CM)

161
Q

An information flow that is not controlled by a security control.

A

Covert Channel

162
Q

The conversion of electronic data into an other form, called cipher text, which cannot be easily understood by anyone except authorized parties.

A

Encryption

163
Q

The practice of examining large database in order to generate new information.

A

Data Mining

164
Q

A suite of application programs that typically manages large, structured sets of persistent data.

A

Database Management System (DBMS)

165
Q

Describes the relationship between the data elements and provides a framework for organizing the data.

A

Database Model

166
Q

An approach based on lean and agile principles in which business owners and the development, operations, and quality assurance departments collaborate.

A

DevOps

167
Q

A record of the events occurring within an organization’s systems and networks.

A

Log

168
Q

A management technique that simultaneously integrates all essential acquisition activities through the use of multidisciplinary teams to optimize the design, manufacturing, and supportability processes.

A

Integrated Product and Process Development (IPPD)

169
Q

Development models that allow for successive refinements of requirements, design, and coding.

A

Iterative Models

170
Q

A mathematical, statistical, and visualization method of identifying valid and useful patterns in the data.

A

Knowledge Discovery in Databases (KDD)

171
Q

Information about the data.

A

Metadata

172
Q

A form of rapid prototyping that requires strict time limits on each phase and relies on tools that enable quick development.

A

Rapid Application Development (RAD)

173
Q

The level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its life cycle, and that it functions in the intended manner.

A

Software Assurance (SwA)

174
Q

Allows the operating system to provide well-defined and structured access to processes that need to use resources according to a controlled and tightly managed schedule.

A

Time Multiplexing

175
Q

Takes advantage of the dependency on the timing of events that takes place in multitasking operating system.

A

Time of Check/Time of Use (TOC/TOU) Attacks

176
Q

The collection of all the hardware, software, and firmware within a computer system that contains all elements of the system responsible for supporting the security policy and the isolation of objects.

A

Trusted Computing Base (TCB)

177
Q

A development model in which each phase contains a list of activities that must be performed and documented before the next phase begins.

A

Waterfall Development Model

178
Q

Initiating, Diagnosing, Establishing, Acting, Learning

A

IDEAL model

179
Q

Conception, Initiation, Analysis, Design, Construction, Testing, Deployment

A

Agile model

180
Q

Change Management steps

A

Request control, change control, release control

181
Q

Configuration Management steps

A

Configuration identification, configuration status accounting, configuration audit

182
Q

full commitment of transaction

A

atomicity

183
Q

enforces integrity rules in the database

A

consistency

184
Q

commit must be received 100% before transaction can be viewed

A

isolation

185
Q

transaction can’t be rolled back after committed

A

durability

186
Q

The process of brining the database into compliance or minimizing redundancy.

A

normalization

187
Q

The purpose of this model is to define the organization’s maturity level in the software development process and project management cycle.

A

Software Capability Mature Model (SW-CMM)

188
Q

SW-CMM steps

A

Initial, Repeatable, Defined, Managed, Optimized

189
Q

Describes the nature of the Ad hoc process of the SW-CMM rating.

A

Initial

190
Q

Describes the managed stage and improvement in process in the SW-CMM rating.

A

Repeatable

191
Q

Describes the well-defined process and quality management of the SW-CMM rating.

A

Defined

192
Q

Describes the continuous improvement processes and “kaizen” of the SW-CMM rating.

A

Optimizing

193
Q

In the software development life cycle these two processes should always fall under separation of duties to prevent a conflict of interest.

A

testing and development

CISSP2020 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions