Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSCE 465 > Final Exam > Flashcards

Final Exam Flashcards

1
Q

The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of information system resources

A

Computer Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Ensuring timely and reliable access to and use of information

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A potential security harm to an asset

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A system configuration issue or a mistake in software that allows access to information or capabilities that can be used by a hacker as a stepping-stone into a system or network

A

Exposure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A weakness in the computational logic (e.g., code) found in software and some hardware components (e.g., firmware) that, when exploited, results in a negative impact to confidentiality, integrity, OR availability

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A flaw in the specification, design, implementation, or operation of information system / asset

A

Bug

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A threat that uses a vulnerability or exposure to violate the security of system

A

Exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Address a vulnerability typically though code changes, but could also include specification changes or even specification deprecations (e.g., removal of affected protocols or functionality in their entirety)

A

Mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Attempt to learn or make use of information from the system that does not affect system resources

A

Passive Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Attempt to alter system resources or affect their operation

A

Active Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A subject should be given only those privileges that it needs in order to complete its task.”

A

Least Privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Unless a subject is given explicit access to an object, it should be denied access to that object. (Whitelisting)

A

Fails-Safe Default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Security mechanisms should be as simple as possible. (KISS principle)

A

Economy of Mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Requires that all accesses to objects be checked to ensure that they are allowed.

A

Complete Mediation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Security of a mechanism should not depend on the secrecy of its design or implementation

A

Open Design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A system should not grant permission based on a single condition.

A

Separation of Privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Security mechanisms should be designed so that users understand

A

Principle of Least Astonishment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Security Implementation

A

Identify, Prevent, Detect, Respond, Recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

the act of taking the low level technical artifact and abstracting logic to understand what the program does

A

Reverse Engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

looking at source code for vulnerability or algorithm details

A

White Box Analysis

23
Q

looking at low level implementation with inferred abstractions

A

Grey-Box Analysis

24
Q

Using only input and output relations, make conclusions about how the system behaves

A

Black-Box Analysis

25
Q

Inputting large amounts of random data in hopes that some data will encounter edge case and change execution path

A

Fuzzing

26
Q

Marking input data and marking each intermediate state of data all the way to output

A

Taint Analysis

27
Q

Running unknown files and collecting statistics on usage

A

Sandbox Analysis

28
Q

Inspecting control flow and type information

A

Manual Static Analysis

29
Q

Stepping through execution to follow important code

A

Manual Dynamic Analysis

30
Q

Matching strings for algorithms, magic numbers, and common code structures

A

String Pattern Matching Analysis

31
Q

Selective restrictions for access to a place, to data, or to otherresources

A

Access Control

32
Q

Decentralized
Access based on the identity of the requestor and on access rules established by the owner or administrator
(Typically) Owner is the “Rights Controller”
Individual users can set an access control mechanism to allow/deny access to an object
Relies on the object owner to control access.

A

Discretionary access control (DAC)

33
Q

Centralized
Access based on comparing security labels with security clearances
(Typically) Administrator is the “Rights Controller”
A system-wide policy decrees who is allowed to have access
Individual user cannot alter access
Relies on the system to control access

A

Mandatory access control (MAC)

34
Q

Controls access based on:
Roles that users have within the system
Rules stating the accesses allowed to users in given roles

A

Role-based access control (RBAC)

35
Q

Controls access based on attributes of:
The User
The Object
Current environmental conditions

A

Attribute-based access control (ABAC)

36
Q

a computational system where code execution, outside of the specifications of a given program, may occur

A

Weird Machine

37
Q

Exploits that allow an attacker to alter the command flow of a program to execute arbitrary code through specially crafted input

A

Memory Corruption Exploits

38
Q

A program that is inserted into a system, usually covertly, with the intent of: Compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system, or otherwise annoying or disrupting the victim.

A

Malware

39
Q

Software that infects existing programs

A

Viruses

40
Q

Program that actively seeks out more machines to infect

Exploits software vulnerabilities in client or server programs

A

Worms

41
Q

Set of hidden programs installed on a system to maintain covert access to that system

A

Rootkits

42
Q

“Tricking” users to assist in the compromise of their own systems

A

Social Engineering

43
Q

Involves the collection of data relating to the behavior of legitimate users over a period of time

A

Anomaly Detection

44
Q

Uses a set of known malicious data patterns or attack rules that are compared with current behavior

A

Signature-based (Heuristic/Misuse) Detection

45
Q

Four Means for Authenticathing an user

A

Knows, Is, Has, Does

46
Q

A precomputedlist of hashesand associated plaintext passwords used to crack/recover plaintext passwords

A

Rainbow Table

47
Q

A malicious (or hacked) web site sends innocent victim a script that steals information from an honest web site

A

XSS – Cross-site scripting

48
Q

Bad web site sends request to good web site, using credentials stolen form an innocent victim who “visits” the site

A

CSRF – Cross-site request forgery

49
Q

XSS VULNERABILITY. Data provided by the browser (in the URL) is used by server-side scripts to dynamically generate a page that “echoes” the malicious script back to the user’s browser

A

Non-persistent / Reflected

50
Q

XSS VULNERABILITY.Data (malicious script) is provided to a web application and stored on the server to be used, later, to “render” pages for a user

A

Persistent / Stored

51
Q

XSS VULNERABILITY.The malicious script is generated through the (local) client-side DOM processing

A

DOM-Based / Local

52
Q

A TOCTOU Race Condition exists when an attackercan influence the state of aresourcebetweencheckand use

A

TOCTOU Race Condition

53
Q

The attacker initiates large number of TCP SYN packets (typically with spoofed source addresses) but does not respond to SYN-ACK requests

A

SYN flood: A (D)DOS attack

CSCE 465 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions