Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Study Guide > Needs Improvement > Flashcards

Needs Improvement Flashcards

1
Q

DES

A

Symmetric
Key Length: 64 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

3 DES or
TDES
(Triple DES)

A

Symmetric
Key Length 56 bit*3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AES

A

Symmetric
Key Length: 128,192,256 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IDEA

A

Symmetric
128 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Skipjack

A

Symmetric
80 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Blowfish

A

Symmetric
32-448 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

TwoFish

A

Symmetric
2048

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

RC4

A

Symmetric
40-2048

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RC5

A

Symmetric
2048

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CAST

A

Symmetric
40-128 bit & 128-256 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Diffie Hellman

A

Asymmetric
No confidentiality, authentication, or
non-repudiation
* Secure key transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

RSA

A

Asymmetric
4096 bit
Uses 1024 keys
* Public key and one-way function for
encryption and digital signature
verification
* Private key and one-way function for
decryption and digital signature
generation
* Used for encr

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Elgamal

A

Asymmetric
Any Size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Elliptic Curve Cryptosystem (ECC)

A

Asymmetric
Any Size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Symmetric Algorithms

A

Use a private key which is a secret key between two parties.
Each party needs a unique and separate private key.
Number of keys = x(x-1)/2 where x is the number of users. Eg.
DES, AES, IDEA, Skipjack, Blowfish, Twofish, RC4/5/6, and
CAST.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Stream Based Symmetric Cipher

A

Encryption done bitwise and use keystream generators Eg.
RC4.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Block Symmetric Cipher

A

Encryption done by dividing the message into fixed-length
blocks Eg. IDEA, Blowfish and, RC5/6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Asymmetric Algorithms

A

Use public and private key where both parties know the public
and the private key known by the owner .Public key encrypts
the message, and private key decrypts the message. 2x is total
number of keys where x is number of users. Eg. Diffie-Hellman,
RSA, El Gamal, ECC, Knapsack, DSA, and Zero Knowledge
Proof.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Physical (1)

A

Electrical signal : Bits to voltage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Link Layer (2)

A

PPP - PPTP - L2TP - - ARP -
RARP - SNAP - CHAP - LCP -
MLP - Frame Relay - HDLC -
ISL - MAC - Ethernet - Token
Ring - FDDI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Network
layer (3)

A

CMP - BGP - OSPF - RIP - IP -
BOOTP - DHCP - ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Transport (4)

A

TCP - UDP datagrams. Reliable end to end data
transfer -Segmentation - sequencing - and error checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Session (5)

A

TCP - UDP - NSF - SQL - RADIUS - and RPC - PPTP - PPP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Presentation (6)

A

TCP - UDP messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Application (7)

A

TCP - UDP - FTP - TELNET -
TFTP - SMTP - HTTP CDP -
SMB - SNMP - NNTP - SSL -
HTTP/HTTPS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Challenge-Handshake Authentication Protocol (CHAP)

A

Encrypt username/password and
re-authenticate periodically. Use in PPP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Point-to-Point Tunneling Protocol
(PPTP)

A
  • PPP for authentication
  • No support for EAP
  • Dial in
  • Connection setup uses plaintext
  • Data link layer
  • Single connection per session
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Layer 2 Tunneling Protocol (L2TP)

A
  • Same as PPTP except more secure
  • Commonly uses IPsec to secure L2TP packets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Internet Protocol Security (IPsec)

A
  • Network layer
  • Multiple connection per session
  • Encryption and authentication
  • Confidentiality and integrity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

EAP (Extensible
Authentication Protocol)

A

Utilizes PPP and wireless authentication. Compatible with
other encryption technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Discretionary Access Control
(DAC)

A

Uses access control lists (ACLs -
Access-control lists).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Mandatory Access Control
(MAC)

A

Subject authorize according to security labels.
Used by owners to grant or deny access to
other users. ACL defines the level of access
granted or denied to subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Role-BAC (RBAC)

A

Task-based access controls - subjects require
access an object based on its role or
assigned tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Rule-BAC

A

Uses a set of rules or filters to define what
can or cannot be done on a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Lattice based / Label

A

Objects are classified based on control level
using a label.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Non-discretionary access /
Mandatory-Access control

A

Based on policies defined by a central
authority. Role based or task based.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Kerberos

A

Client /server model authentication protocol.
* Symmetric Key Cryptography
* Key Distribution Center (KDC)
* Confidentiality and integrity and authentication,
symmetric key cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

The Kerberos
logon process

A
  • User input username/password in client PC/Device.
  • Client system encrypts credentials using AES to submit
    for KDC.
  • KDC match input credentials against database.
  • KDC create a symmetric key and time-stamped TGT to be
    used by the client and the Kerberos server.
  • Key and TGT are encrypted using client password hash.
  • Client installs the TGT and decrypts the symmetric key
    using a hash.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Risk Management

A

the process of identifying,
examining, measuring, mitigating, or transferring
risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Preventative Risk Management

A

Security Policies
Security Cameras
Callback
Security Awareness Training
Job Rotation
Encryption
Data Classification
Smart Cards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Deterrent Risk Management

A

Security Personnel
Guards
Security Cameras
Separation of Duties
Intrusion Alarms
Awareness Training
Firewalls
Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Detective Risk Management

A

Logs
Security Cameras
IDS
Honey Pots
Audit Trails
Mandatory Vacations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Corrective Risk Management

A

Alarms
Antivirus Solutions
IDS
BCP

44
Q

Recovery Risk Management

A

Backups
Server Clustering
Fault Tolerant Drive Systems
Database Shadowing
Antivirus Software

45
Q

NIST SP 800 Series

A

Computer Security in a variety of areas

46
Q

800-14 NIST SP

A

Securing Information Technology
systems

47
Q

800-18 NIST

A

Develop security plans

48
Q

800-27 NIST SP

A

Baseline for achieving security

49
Q

800-88 NIST

A

Guidelines for sanitation and disposition,
prevents data remanence

50
Q

800-137

A

Continuous monitoring program: define, establish, implement, analyze and report

51
Q

800-145

A

Cloud Computing standards

52
Q

FIPS

A

Federal Information Processing Standards

53
Q

Sniffing

A

Unauthorized monitoring of transmitted data

54
Q

Session Hijacking

A

Monitor and capture of authentication sessions with the purpose of finding and hijacking credentials

55
Q

Incident Response steps

A
  1. Detect
  2. Respond
  3. Report
  4. Recover
  5. Remediate
  6. Review
56
Q

Port 20, 21

A

FTP File Transfer Protocol

57
Q

Port 22

A

SSH Secure Shell

58
Q

Port 23

A

Telnet

59
Q

Port 25

A

SMTP Simple Mail Transfer Protocol

60
Q

53

A

DNS

61
Q

110

A

POP3 Post Office Protocol

62
Q

80

A

HTTP Hypertext Transfer Protocol

63
Q

143

A

IMAP Internet Message Access Protocol

64
Q

389

A

LDAP Lightweight Directory Access Protocol

65
Q

443

A

HTTPS Hypertext Transfer Protocol Secure

66
Q

636

A

Secure LDAP Lightweight Directory Access Protocol

67
Q

445

A

ACTIVE Directory

68
Q

1433

A

Microsoft SQL

69
Q

3389

A

RDP Remote Desktop Protocol

70
Q

137-139

A

NETBIOS

71
Q

Due Dilligence

A

establishing a plan, policy, and process to protect the interests of an organization

72
Q

Due Care

A

Practicing the individual activities that maintain the due diligence effort

73
Q

Asset

A

Anything of Value to the company

74
Q

Vulnerability

A

A weakness: the absence of a safeguard

75
Q

Threat

A

Things that could pose a risk to all or part of an asset

76
Q

Threat Agent

A

The entity which carries out the attack

77
Q

Exploit

A

an instance of compromise

78
Q

Risk

A

The probability of a threat materializing

79
Q

SDN Software Defined Networking

A

Decoupling the network control and the
forwarding functions.
Features -Agility, Central management,
Programmatic configuration, Vendor neutrality.

80
Q

Fibre Channel over Ethernet
(FCoE)

A

Running fiber over Ethernet network.

81
Q

Multiprotocol Label Switching (MPLS)

A

Transfer data based on the short path labels
instead of the network IP addresses. No need of
route table lookups.

82
Q

Internet Small Computer Interface (iSCI)

A

Standard for connecting data storage sites such
as storage area networks or storage arrays.
Location independent.

83
Q

Synchronous
Data Link
Control (SDLC)

A

IBM proprietary protocol use with permanent
dedicated leased lines.

84
Q

High-level Data Link Control (HDLC)

A

Use DTE/DCE communications. Extended
protocol for SDLC

85
Q

MD2

A

128-bit hash, 18 rounds of computations

86
Q

MD4

A

128-bit hash. 3 rounds of computations, 512 bits block sizes

87
Q

MD5

A

128-bit hash. 4 rounds of computations, 512 bits block sizes,
Merkle–Damgård construction

88
Q

MD6

A

Variable, 0<d≤512 bits, Merkle tree structure

89
Q

SHA-1

A

160-bit MD, 80 rounds of computations, 512 bits block sizes,
Merkle–Damgård construction (not considered safe against
well funded attackers)

90
Q

SHA-2

A

224, 256, 384, or 512 bits, 64 or 80 rounds of computations,
512 or 1024 bits block sizes, Merkle–Damgård construction
with Davies–Meyer compression function

91
Q

Type I Error

A

False Rejection Rate

92
Q

Type II Error

A

False Acceptance Rate

93
Q

CER Crossover Error Rate

A

The point at which FRR equals FAR. This is expressed as
a percentage - lower CER is better.

94
Q

Enticement

A
  • Is the legal action of luring an intruder, like in a
    honeypot
95
Q

Entrapment

A
  • Is the illegal act of inducing a crime, the individual had
    no intent of committing the crime at first
96
Q

Business Continuity Plan BCP

A

Concerns the preservation and recovery of business in the
event of outages to normal business operations

97
Q

Business Impact
Analysis (BIA)

A

The process of assessing the impact of an IT disruption.
BIA is part of BCP

98
Q

Disaster Recovery Plan (DRP)

A

A framework of steps and actions that need to be taken
to achieve business continuity and disaster recovery
goals.
End Goal – Revert back to normal operations - planning
and development must be done before the disaster - BIA
should be complete

99
Q

Business Continuity
Steps

A
  1. Scope and plan initiation
  2. BIA - assess impact of disruptive processes
  3. Business Continuity Plan development - Use BIA to
    develop BCP -
    Testing
  4. Plan approval and implementation - management
    approval
100
Q

DBMS Types

A

Hierarchical * Network * Mesh * Object-orientated
* Relational

101
Q

DDL Data definition language

A

defines structure and schema DML

102
Q

Degree of Db

A

number of attributes (columns) in table

103
Q

Tuple

A

rows

104
Q

Foreign Key

A

reference to another table which include primary
key. Foreign and primary keys link is known as
referential integrity.

105
Q

Token-passing

A

Sender can send only when token received indicating free to
send.

CISSP Study Guide (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions