Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Missed questions > Flashcards

Missed questions Flashcards

1
Q

Roles of a security admin

A
  • User who is most likely to be responsible for user account management and reviews of audit date in a client/server architecture
  • Usually have lesser privileges than system admins, but usually responsible for auditing sys admins
  • Often work directly with sys admins and applications admins
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Roles of a System Administrator

A
  • User who monitors and maintains the system and applications in a distributed computing environment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Role of a System Operator

A
  • Users who administer and maintain a mainframe system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Role of a Power User

A
  • A heightened privilege account that enables a user to perform some tasks that ordinary users cannot
  • A role that is found in a distributed computing environment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SP 800-30

A

Used to assess risk - 9 step process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

SP 800-66

A

Similar to SP 800-30, but written for healthcare companies that must comply with HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CRAMM

A

CCTA Risk Analysis and Management Method - establishes a 3-stage approach to risk evaluation that analyzes technical and non-technical security aspects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

FRAP

A

Facilitated Risk Analysis Process - a low-cost method of evaluating risk for one system or process at a time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SOMAP

A

Security Officers Management and Analysis Project - an open-source method for evaluating and managing risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Spanning Tree Analysis

A

Creates a tree of all possible threats and prunes branches that do not apply to an asset 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

VAR

A

Value at risk – identifies a profile of acceptable risk for a company in order to determine the most cost-effective risk mitigation method 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ITIL

A

IT infrastructure library – a methodology created by the UK government that is focused on improving IT service management processes 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

COBIT

A

Control objectives for information and related technology - an ISACA framework that establishes 34 processes in 214 control objectives to assist in developing an IT security management plan 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ISO 27000

A

Establishes a framework for developing security management standards 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SP 800-37

A

Risk management framework (RMF) is a security compliance framework for government entities 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What provides authentication, integrity, and confidentialities over an L2TP tunnel?

A

AH (auth and integrity) and ESP (confidentiality)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

POODLE attack

A

MITM that exploited vulns in SSL (and TLS fall back to SSLv3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

3 Layers of SSH

A

The transport layer, the user authentication layer, and the connection layer 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Five primary methods of testing a DRP

A

Disaster Recover Plan (DRP) Tests
- Read through test
- Structured walk through (table top exercise)
- Simulation test
- Parallel test (move to recovery site)
- Full interruption test (move to recovery site and full shut down at primary location)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Five phases of penetration testing 

A

1) Planning, 2) information gathering and discovery, 3) vulnerability scanning, 4) exploitation, and 5) reporting 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SDL

A

A Seven phase Security development lifecycle (SDL) model developed my by Microsoft: 1) training, 2) requirements, 3) design (threat modeling), 4) implementation (static analysis) 5) verification (dynamic analysis, fuzz testing, attack surface review) 6) release (incident response plan and final Security review) 7) response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

XOR

A

Used for encryption - compares x and y. If they match = 0, if the don’t = 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Technology that uses RFC 6749

A

OAuth 2.0 and OpenID Connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

OpenID Connect

A
  • Used OpenID technologies, but is constructed around the OAuth 2.0 framework, defined by RFC 6749
  • used JSON Web Tokens (JWTs)
  • operates as a REST web service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

OAuth 2.0

A
  • an open standard to find an RFC6749 - an authorization framework that provides a third-party application with delegated access to resources, without providing the owners credentials to the application
  • the version of OAuth that is in most to spell social media sites
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

OpenID

A
  • an open standard method for decentralized authentication that is defined by the open ID foundation
  • redirects a user to an open ID provider. the user is prompted for an open ID password. If the password is correct, the user is then authenticated on the third-party site
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data

A

1) the collection limitation principle
2) the data quality principle
3) the purpose, pacification principle 4) do use limitation principle
5) the security safeguards principal
6) the openness principle
7) the individual participation principle 8) the accountability principle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What principle limits personal data collection to legal means and requires the individuals permission?

A

The collection limitation principle 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What principle requires that the integrity of the personal data be intact and maintained? 

A

The data quality principle 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What principle requires the disclosure of an adherence to the purpose for collecting the personal information 

A

The purpose specification principle 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What principle requires that the information not be disclosed to other parties without the individuals permission? 

A

Do use limitation principle 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What principle requires the reasonable protection of data against modification by or disclosure to an unauthorized individual? 

A

The security safeguards principal 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What principle requires that the information collection policy be open and available for scrutiny? 

A

The openness principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What principle requires than an entity allow individuals to inquire about whether the entity is storing the individuals personal information? In addition, this principle enables the individual to challenge and update the content of the personal information 

A

The individual participation principle 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What principle requires that the entity adhere to the other principles? 

A

The accountability principle 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the first ring of the ring model

A

Kernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the second ring of the ring model?

A

OS components that are not the kernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the third ring of the ring model 

A

Device drivers 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the fourth ring of the ring model 

A

Users 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is a COPE

A

A corporate owned, personally enabled device policy - a cope policy requires employees to use equipment that is purchased for them but they are also allowed to use for personal use 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

ISO 27001

A
  • focused on security governance, the process of directing and controlling IT security
  • used to establish an information security management system (ISMS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

ISO 27002

A
  • provides 14 objectives for security controls based on industry best practices
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How many security associations (SAs) does ISAKMP establish for a VPN tunnel?

A

ISAKMPs are unidirectional, at least two SAs are required. If ESP and AH are used, then four SAs are required.

44
Q

What is forced browsing?

A
  • a brute force attack
  • another name for predictable resource location, file enumeration, directory enumeration, and resource enumeration
45
Q

What is a multi-homed device?

A
  • A device that has more than one network connection
  • Most firewalls are multi-homes
46
Q

MTD

A

Maximum Tolerable Downtime
- the sum of the Recovery Time Objective (RTO) and the Work Recovery Time (WRT)
- sometimes considered synonymous with RTO

47
Q

MTBF

A

Mean Time Between Failures
- typically assigned by the hardware manufacturer

48
Q

MTTR

A

Mean Time to Repair

49
Q

Relation in a relational database

A

A table with rows, columns, and cells

50
Q

Tuple in a relational database

A

A row

51
Q

Attribute in a relational database

A

A column

52
Q

Cell in a relational database

A

A cell - contains the data

53
Q

Objects that are greatly dependent on other objects in Object Oriented Programming are…

A

High coupling and low cohesion

54
Q

How long does it take to bring a warm site online?

A

1-3 days (contains equipment and data circuits, but no data)

55
Q

How long does it take to bring a cold site online?

A

Several days to week (does not contain equipment or data)

56
Q

How long does it take to bring a hot site online?

A

Minutes to hours

57
Q

What are the four security modes for systems that process classified information?

A
  • Dedicated mode
  • System high mode
  • Compartmented mode
  • Multilevel mode
58
Q

How long do companies have to report a data breach under the GDPR?

A

72 hours

59
Q

Pharming

A

DNS cache poisoning attacks

60
Q

Teardrop

A

Denial of Service attack that sends several large overlapping IP fragments (a network layer protocol attack)

61
Q

What are the steps of a Business Continuity Plan?

A

1) Develop the BCP policy statement
2) Conduct a BIA
3) Identify preventive controls
4) Develop recovery strategies
5) Develop an IT contingency plan
6) Perform DRP training and testing
7) Perform BCP/DRP maintenance

62
Q

Code freezing

A

The point at which the application is considered ready for production and no further changes to the code are allowed

63
Q

Code commit

A

AKA Code check-in, occurs when a developer has written and tested code on a local copy of a given project and then uploads the local changes to the code repository

64
Q

Regression testing

A

Performed to ensure that a change has not broken existing functionality or introduced new problems

65
Q

Combinational testing

A

A type of black-box testing that involves entering every possible variation of input data into the application

66
Q

LAND

A

Local Area Network Denial (LAND) - a type of attack where the attacker sends an IP (network layer protocol) packet with the same source and destination address and port

67
Q

Fraggle

A

A denial of service (DOS) attack that sends UDP echo and chargen packets with a spoofed source address.

68
Q

Smurf

A

A DOS attack that sends ICMP echo request packets with a spoofed source address

69
Q

Vigenere cipher

A

Uses a square matrix to encrypt text - constructed by repeating the alphabet 26 times

70
Q

What is a policy?

A

A high-level overview of the company’s security posture that contain mandatory directives. They should contain purpose, scope, responsibilities, and compliance.

71
Q

What is a procedure?

A

Mandatory, low-level guides that explain how to accomplish a task.

72
Q

What are standards?

A

Mandatory technical aspects of a security program, including any hardware and software that is required.

73
Q

What is are baselines?

A

Somewhat discretionary minimum level of security that a company’s employees and systems must meet

74
Q

What are guidelines?

A

Discretionary that recommend helpful bits of advice to employees

75
Q

What standards were developed by OASIS?

A

SAML, SPML, and XACML

76
Q

Bluetooth Info

A
  • IEEE 802.15 standard
  • 2.4 GHz range
  • uses FHSS and AFH
  • v4.1 uses strong encryption (AES-CCM)
  • v2.1 uses weak encryption cipher (E0)
77
Q

What can be used to create multiple broadcast domains?

A

A router or level-3 switch

78
Q

What can be used to create separate collision domains

A

Each port on a bridge, switch, or router creates a separate collision domain

79
Q

Who is the data owner?

A

The information/business owner - responsible for classifying data. It’s typically a manager who is responsible for the security of a particular information asset

80
Q

Who is the data custodian?

A

The data steward - responsible for the hands-on protection of data - like data back-ups, system recovery, etc.

81
Q

The Bell-LaPadula Model

A

No read up, and no write down policy to protect confidentiality

82
Q

The Biba Model

A

No read down and no write up policy to protect data integrity

83
Q

The Lipner Model

A

Uses Bell-LaPadula and Biba models to provide both confidentiality and integrity

84
Q

Chinese Wall Model

A

AKA Brewer-Nash security model, designed to mitigate conflicts of interest - mitigates security risks from third-parties

85
Q

Graham-Denning Model

A

Uses an access control matrix to map subjects and objects to a series of eight rules

86
Q

Harrison-Ruzzo-Ullman Model

A

Extends the Graham-Denning model by including a rights integrity protection system that prevents a subject or object from being created if that subject or object already exists in the ACM

87
Q

ToE, ST, PP, and EAL

A

Terms of Common Criteria:
ToE: target of evaluation, the system or product to be tested
ST: security target, the documentation that describes the ToE and any security requirements
PP: a set of security requirements and objects for the type of product to be tested
Evaluation Assurance Level: a rating level that is assigned to the product after the product has been tested

88
Q

EAL1-EAL7

A

EAL1: functionally tested
EAL2: structurally tested
EAL3: methodically tested and checked
EAL4: methodically designed, tested, and reviewed
EAL5: semi-formally designed and tested
EAL6: semi-formally verified, designed, and tested
EAL7: formally verified, designed, and tested

89
Q

ISC2 Code of Ethics (rank ordered)

A

1) Protect society, the common good, necessary public trust and confidence, and infrastructure
2) Act honorably, honestly, justly, responsibly, and legally
3) Provide diligent and competent service to principals
4) Advance and protect the profession

90
Q

KDC

A

Key Distribution Center (Kerberos)
- Enables SSO services by acting as a trusted third-party authentication server

91
Q

Safest fire suppression system for electrical fires

A

FE-13

92
Q

What are the two modes that IPsec operates in?

A

Transport and Tunnel modes.
- In transport mode, ESP encrypts only the packet data leaving the IP headers unencrypted. AH typically is only used in transport mode because it needs unencrypted headers for authentication
- In tunnel mode, ESP encrypts encrypts both the packet data and IP headers.

93
Q

Serving Parameter Index

A

For IPsec, a 32 bit number generated by the sending device and used to identify each unidirectional SA

94
Q

What are the four types on investigations?

A

1) Civil
2) Criminal
3) Administrative
4) Regulatory

95
Q

Five rules of evidence

A

1) be authentic
2) be accurate
3) be complete
4) be convincing
5) be admissible

96
Q

ALE =

A

ALE = ARO x SLE
Annual loss expectancy = Annualized rate of occurrence x single loss expectancy

97
Q

VLAN Hopping Attack

A
  • attacker attempts to inject packets into other VLANs by accessing the VLAN trunk and double-tagging 802.1Q frames
  • a successful VLAN hopping attack enables an attacker to send traffic over other VLANs without using a router
  • could occur from a VOIP system on the same switch as a data network
98
Q

Due Care

A

A legal liability concept that defines the minimum level of information protection that a business must achieve

99
Q

Due Diligence

A

A legal liability concept that requires an organization to continually review its practices to ensure that protection requirements are met

100
Q

Piracy

A

An IP attack the focuses on infringement of copyright

101
Q

2 FIM Models

A

Federated Identity Management:
1) third-party certification/bridge model
2) cross-certification

FIM is the process of providing access to a company’s data resources to organizations of parties that are not owned by the company. WS-Fed protocol is an example.

102
Q

Class A fire suppression (UK A)

A

wood, paper, and other combustibles

103
Q

Class B fire suppression (UK B)

A

Liquids

104
Q

Class B fire suppression (UK C)

A

gasses

105
Q

Class C fire suppression (UK E)

A

electrical

106
Q

Class D fire suppression (UK D)

A

metals

CISSP (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions