Random CISSP Flashcards
Sniffing attack
A sniffing attack uses a sniffer (also called a packet analyzer or protocol analyzer) to capture data and can be used to read passwords sent across a network in cleartext.
A side-channel attack
is a passive, noninvasive attack used against smart cards. Methods include power monitoring, timing, and fault analysis attacks.
role-based access control
A role-based access control policy grants specific privileges based on roles, and roles are frequently job based or task based.
Discretionary access controls
Discretionary access controls allow owners of information to control privileges
mandatory access controls
mandatory access controls use labels to control privileges
Clipping levels
Clipping is a form of nonstatistical sampling that reduces the amount of logged data based on a clipping-level threshold.
Log analysis reviews
Log analysis reviews log information looking for trends, patterns, and abnormal or unauthorized events.
Audit trails are considered to be what type of security control
Passive detective
Audit trails
Audit trails are a passive form of detective security control.
Synchronous token
A synchronous token generates one-time passwords and displays them in an LCD, and this password is synchronized with an authentication server.
asynchronous token
An asynchronous token uses a challenge-response process to generate the token.
Type 1 biometric error
A Type 1 error occurs when a valid subject is not authenticated and is also known as a false negative authentication.
Type 2 biometric error
A Type 2 error occurs when an invalid subject is authenticated. This is also known as a false positive authentication.
crossover error rate
The crossover error rate (also called equal error rate) compares the rate of Type 1 errors to Type 2 errors and provides a measurement of the accuracy of the biometric system.
What is the best choice to support federated identity management systems?
Service Provisioning Markup Language (SPML)
Service Provisioning Markup Language (SPML)
SPML is an XML-based framework used to exchange user information for single sign on (SSO) between organizations within a federated identity management system.
Access control matrix
An access control matrix includes multiple subjects and objects and lists subjects’ access to various objects.
federation
refers to a group of companies that share a federated identity management system for single sign-on.
User entitlement audit
A user entitlement audit can detect when users have more privileges than necessary.
A Type 2 authentication factor
is “something you have,” including a smart card, token device, or memory card.
Type 3 authentication
is “something you are,” and some behavioral biometrics include “something you do.”
Type 1 authentication
“something you know.”
All of the following are needed for system accountability except for one. Which one is not needed?
A) Identification
B) Authentication
C) Auditing
D) Authorization
Authorization
What type of access controls rely upon the use of labels?
Mandatory
A VPN can be established over what types of connections?
A) Wireless LAN connection
B) Remote access dial-up connection
C) WAN link
Which of the following IP addresses is not a private IP address as defined by RFC 1918?
A) 10.0.0.18
B) 169.254.1.119
C) 172.31.8.204
D) 192.168.6.43
The 169.254.x.x subnet is in the APIPA range, which is not part of RFC 1918.
network segmentation
security practice of dividing a computer network into smaller, isolated segments to enhance security, manage traffic, and improve performance.
4 types of network segmentation
Physical
Logical
Role-Based
Policy-Based
Which of the following is not an example of network segmentation?
A) Intranet
B) DMZ
C) Extranet
D) VPN
VPN
permanent virtual circuit (PVC)
A permanent virtual circuit (PVC) can be described as a logical circuit that always exists and is waiting for the customer to send data.
Control Transparency
characteristic of a service, security control, or access mechanism it is unseen by users.
addresses in RFC 1918
0.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, and 192.168.0.0-192.168.255.255.
Frame Relay
Frame Relay is a layer 2 connection mechanism that uses packet-switching technology to establish virtual circuits between the communication endpoints.
Which of the following is not defined in RFC 1918 as one of the private IP address ranges that are not routed on the Internet?
A) 169.172.0.0-169.191.255.255
B) 192.168.0.0-192.168.255.255
C) 10.0.0.0-10.255.255.255
D) 172.16.0.0-172.31.255.255
169.172.0.0-169.191.255.255 is a public IP address range.
Dynamic packet filtering
Dynamic packet-filtering firewalls enable the real-time modification of the filtering rules based on traffic content.
Stateful inspection firewalls
Stateful inspection firewalls are able to grant a broader range of access for authorized users and activities and actively watch for and block unauthorized users and activities.
IPSec
standards-based mechanism for providing encryption for point-to-point TCP/IP traffic.
