Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Software Dev > Flashcards

Software Dev Flashcards

1
Q

First Generation language

A

First Generation language: Machine-level programming languages like Machine Code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Second Generation language

A

Second Generation language: The code is human readable. It must be converted into a machine readable form, a process called assembly, before it can be run. The language is specific to a particular processor family and environment. (example: Assembly)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Third Generation Language

A

Third Generation Language (High-Level Language): Established a logical structure to software. Improve human readability, automate lower level tasks and introduced more abstraction than second generation languages. Can operate independent of processor family or environment. (examples: COBOL, C, Basic)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Fourth Generation language

A

Fourth Generation language: Utilize graphical programmer interfaces to automate and increase the speed of code creation. Many fourth generation languages are interpreted. (examples: Java, ColdFusion, Ruby, Python).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CASE

A

CASE (Computer Aided Software Engineering): contains tools (supporting specific dev tasks), workbenches (supporting multiple activities), and environments (supporting all/part of the sw production process)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Compilers

A

Compilers: Convert source code from third generation, or later, languages into machine code. Compilers parse the instructions into machine code and store them in a separate file like an “.exe”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Assembler

A

Assembler: Converts assembly language into machine language.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Interpreted languages

A

Interpreted languages: These languages are compiled on the fly each time the program is run. The source code is executed line by line by the interpreter. Examples of interpreters include ColdFusion Application Server and the JavaScript Engine in browsers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Procedural Languages

A

Procedural Languages: Use subroutines, procedures, and functions. (examples: Basic, C, Fortran, Pascal).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Object-oriented languages

A

Object-oriented languages: Model the real world through the use of objects which combine tasks (methods) and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RAD

A

Rapid Application Development (RAD): A software development methodology that uses minimal planning in favor of rapid development and construction of iterative prototypes. The goal is to quickly meet business needs and technical concerns are secondary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Configuration Management

A

Configuration Management: tracks changes to a piece of sw

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Change management

A

Change management: broader, tracks changes across an entire sw program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Prototyping

A

Prototyping: A rudimentary working model of an information system or mockup of system design features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Software Escrow

A

Software Escrow: A process of having a third party store and archive software. Escrow is typically requested by customer acquiring software, to ensure maintenance and availability of the software. If the vendor goes out of business or fails to live up to the agreement, software escrow ensures that the customer still has access to the source code for future development and maintenance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data modeling

A

Data modeling: Defines how data components are associated with each other. Considers the data independently of the way it is processed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data Structure

A

Data Structure: Is a representation of the logical relationship between elements of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Cohesive

A 
Cohesive: A cohesive module can perform a single task with little or no help from other modules 
•	Low Cohesion: Scatter brained, does several tasks. 
•	High Cohesion: Focused on one task and is better for security purposes

The best programming uses the most cohesive modules possible, but because different modules need to pass data and communicate, they usually cannot be totally cohesive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Coupling

A 
Coupling: Is a measure of interconnection among modules in an application. 
•	Low Coupling: Promotes module independence and is better for security purposes
•	High Coupling: Depend on other modules

The lower the coupling, the better the software design, because it promote module independence. The more independent a component is, the less complex the application is and the easier it is to modify and troubleshoot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ORB

A

ORB (Object Request Brokers)- allow reuse of mature objects
o COM- MS sharing of objects written in different languages on a local system
o DCOM- MS sharing over multiple systems (eg OLE); supplanted by .NET
o CORBA- OMG networked object broker that separates objects into an object and an IDL (Interface Definition Language)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

DDE

A

Dynamic Data Exchange (DDE): Enables different applications to share data by providing Inter-Process Communications (IPC). It is a communication mechanism that enables direct conversation between two applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DCE

A

Distributed Computing Environment (DCE): Is a set of management services with a communication layer based on Remote Procedure Call (RPC). It is a layer of software that sits on top of the network layer and provides services to the applications above it. The RPC function collects the arguments and commands from the sending program and prepares them for transmission over the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DFS

A

Distributed File Services (DFS): Provides a single integrated file system that all DCE users can use to share files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

.NET

A

.NET framework: An application framework that has a large library which different applications can call upon. The libraries provide functions as in data access, database connectivity, network communication, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

OLE

A

Object linking and embedding (OLE): Provides a way for objects to be shared on a local personal computer and to use COM as their foundation. OLE enables objects—such as graphics, clipart, and spreadsheets—to be embedded into documents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

J2EE

A

Java Platform, Enterprise Edition (J2EE): J2EE is an enterprise Java computing platform. This means it is a framework that is used to develop enterprise software written mainly in the Java programming language. It provides Application Programming Interfaces (API) for networking services, fault tolerance, security, and web services for large-scale, multi-tiered network applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SOA

A

Service-oriented architecture (SOA): A software design and software architecture design pattern based on discrete pieces of software providing application functionality as services to other applications. This is known as service-orientation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Mashup

A

Mashup: The combination of functionality, data, and presentation capabilities of two or more sources to provide some type of new service or functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

SOAP

A

Simple Object Access Protocol (SOAP): An XML-based protocol that encodes messages in a web service environment. It defines an XML schema of how communication is going to take place. The SOAP XML schema defines how objects communicate directly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

SaaS

A

Software as a Service (SaaS): A model that allows applications and data to be centrally hosted and accessed by thin clients, commonly web browsers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Mobile code

A

Mobile code: Code that can be transmitted across a network, to be executed by a system or device on the other end

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Bytecode

A

Bytecode: Intermediate code created by Java platform

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

JVM

A

Java Virtual Machine (JVM): Converts the bytecode to the machine code that the processor on that particular system can understand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Applets

A

Java Applets: Small components (applets) that provide various functionalities and are delivered to users in the form of Java bytecode. Java applets can run in a web browser using a Java Virtual Machine (JVM). Java is platform independent; thus, Java applets can be executed by browsers for many platforms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

ActiveX

A

ActiveX: ActiveX is a loosely defined set of technologies developed by Microsoft for sharing information among different applications. ActiveX is an outgrowth of OLE (Object Linking and Embedding) and COM (Component Object Model).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Authenticode

A

Authenticode: A type of code signing, which is the process of digitally signing software components and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was digitally signed. Authenticode is Microsoft’s implementation of code signing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

OOP

A

Object Oriented Programming treats a program as a series of connected objects that communicate via messages. It utilizes modular design and reusable software components.
• Object Oriented Languages (C++, Java, Ruby, Python)
• Objects contain Data and Methods
• Objects obfuscate the details of the data and methods they contain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Objects

A

Objects: Objects have state/attributes and methods/behaviors. State is data about the object and behaviors are what the object does. An object stores its state in fields and exposes its behavior through methods. (example: A dog is an object with state values of fury, four legged, etc, and methods/behaviors like fetches sticks and barks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Methods

A

Methods: These are actions or operations performed by an object. (example: addition, subtraction, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Class

A

Class: An template for creating objects which provides initial values for data (state) and defines methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Messages

A

Messages: Data sent to or from an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Inheritance

A

Inheritance: When an object or class is based on another object or class, using the same implementation. It automatically inherits the instance variables and member functions of the parent Class/Object

43
Q

Delegation

A

Delegation: Forwarding of a request by an object to another object or delegate. This forwarding is necessitated by the fact that the object receiving the request does not have a method to service the request.

44
Q

Polymorphism

A

Polymorphism: Polymorphic functions behave differently depending on the context of the input message.

45
Q

Abstraction

A

Abstraction: Information hiding

46
Q

OOA

A

OOA- analysis seeks to understand a problem domain

47
Q

OOD

A

OOD- designs a solution

48
Q

Waterfall Model

A 
Waterfall Model 
The Waterfall Model is a linear application development model that uses rigid phases; when one phase ends, the next begins. 
The waterfall model contains the following steps: 
•	System requirements 
•	Software Requirements 
•	Analysis 
•	Program Design 
•	Coding 
•	Testing 
•	Operations

An unmodified waterfall does not allow iteration (going back to previous steps). This places a heavy planning burden on the earlier steps. Also, since each subsequent step cannot begin until the previous step ends, any delays in earlier steps cascade through to the later steps.
The Modified Waterfall Model allows going back at least one step. Omitted in the waterfall method was a final step of destruction.

49
Q

Sashimi Model

A

The Sashimi Model has highly overlapping steps; it can be thought of as a real-world successor to the Waterfall Model (and is sometimes called the Sashimi Waterfall Model).

50
Q

Spiral Model

A

The Spiral Model is a software development model designed to control risk. The spiral model repeats steps of a project, starting with modest goals, and expanding outwards in ever wider spirals (called rounds). Each round of the spiral constitutes a project, and each round may follow traditional software development methodology such as Modified Waterfall. A risk analysis is performed each round.

51
Q

Agile principles

A

Agile principles:
o Individuals and interaction over processes and tools
o Working software over comprehensive documentation
o Customer collaboration over contract negotiation
o Responding to change over following a plan

52
Q

Scrum

A

Scrum (named after Rugby scrum):
o A Scrum is a small team of developers. They are supported by a Scrum Master, a senior member of the organization who acts like a coach for the team.

53
Q

XP

A

Extreme programming (XP) – uses pairs of developers to work on a detailed spec with high customer involvement. Improves a sw project via communication, simplicity, feedback, respect, courage.
XP Principles:
- Planning: Specifies the desired features (called the user story)
- Paired Programming: Programmers work in teams of two
- Forty hour week: Forecasts should be accurate
- Total customer involvement: Customer is available and monitoring project status
- Detailed test procedures: Unit testing

54
Q

SEI CMM

A

The Software Engineering Institutes Capability Maturity Model Integrated is a framework for objectively assessing the formality and optimization of an organization’s software development process.
Normally 15-50 errors/KLOC (1000 lines of code). SEI CMM can lower to 1/KLOC
The five levels of CMM:
1. Initial: The software process is characterized as ad hoc, and occasionally even chaotic.
2. Repeatable: Basic project management processes are established to track cost, schedule, and functionality.
3. Defined: This is the common target for vendors dealing with government agencies. The software process for both management and engineering activities is documented, standardized, and integrated into a standard software process for the organization.
4. Managed: Detailed measures of the software process and product quality are collected, analyzed, and used to control the process. Both the software process and products are quantitatively understood and controlled.
5. Optimizing: Continual process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies.

55
Q

SDLC

A

System Development Life Cycle (SDLC)
SDLC is a system development model that focuses on security in every phase. It is also called Software Development Life Cycle. ISC2 focuses on the security aspects of SDLC.
• **The first step in any SDLC is the security plan
• Most variants of System Development Lifecycle follow the format described in NIST Special Publication 800-14.

56
Q

NIST 800-14

A

NIST 800-14
• Prepare a security plan:
• Initiation: Need and purpose defined
• Development/Acquisition:
o Determine security requirements
o Incorporate security requirements into specifications
o Develop/Obtain the System and related security activities: Develop system’s security features, monitor development process itself for security problems…
• Implementation:
o Install/Turn-on Controls
o Security testing: Certify system
o Accreditation: Formal authorization for system operation
• Operation/Maintenance
o Security Operations and Administration
o Operational Assurance: operating according to security requirements
o Audits and Monitoring
• Secure Disposal:
o Information: information movement, archival, discarded or destroyed.

57
Q

Freeware

A

Freeware (gratis) software: Software that is free of charge to use

58
Q

Shareware

A

Shareware: Software which may be initially available for free, but the licensing agreement normally requires payment for continued use.

59
Q

Crippleware

A

Crippleware: Any software program that cannot be fully utilized until the user registers or purchases the program

60
Q

Public domain

A

Public domain software (Libre): Software which is not copy righted or licensed (e.g. GNU)

61
Q

Open Source licenses

A

Open Source licenses: The software source code is available to the public (e.g. GNU, BSD, Apache)

62
Q

GPL

A

GPL (GNU Public License) is most common and has the following
• The freedom to use the software for any purpose
• The freedom to change the software to suite your needs
• The freedom to share the software with others
• The freedom to share the changes you make
• Modifications to GPL software must free

63
Q

Software vulnerability testing methods

A

Software vulnerability testing methods
• Static: Passive scan of the actual source code or binary files. The code is not executing at the time of the scan.
• Dynamic: Scans the application while it is executing. Most commonly used for testing web applications by scanning the exposed interfaces.
• White Box: The tester has knowledge of the internal workings of the software being tested, has the source code, and understands what the program is supposed to do and how it works.
• Black Box: The tester has no internal details; the application is treated as a black box that receives inputs. Combinatorial testing seeks to ID all unique combinations of input.

64
Q

Software testing levels

A

Software testing levels
• Unit Testing: Low-level tests of software components, such as functions, procedures or objects
• Installation Testing: Testing software as it is installed and first operated
• Integration Testing: Testing multiple software components as they are combined into a working system.
• Regression Testing: Testing software after updates, modifications, or patches
• Acceptance Testing: Testing to ensure the software meets the customer’s operational requirements.
• User Acceptance Testing: testing done by the customer

65
Q

Fuzzing

A

Fuzzing: A type of black box testing that enters random, malformed data as inputs into software programs to determine if they will crash.

66
Q

Attack Surface

A

Attack Surface: The points or interfaces in a software environment where an attacker can leverage system functionality to initiate malicious actions.

67
Q

Client-side validation

A

Client-side validation: When the user input validation is done at the client before being sent back to the server to process. While this can increase application performance, it has limited security value, since the client can be under the control of an attacker.

68
Q

SQL injection

A

SQL injection: Instead of valid input, the attacker puts actual database commands into the input fields, which are then parsed and run by the database.

69
Q

XSS

A

Cross-site scripting (XSS): An attack that takes advantage of a Web site vulnerability in which the site displays or executes un-sanitized user provided data.

70
Q

Parameter validation

A

Parameter validation: Where the values that are being received by the application are validated to be within defined limits before the server application processes them within the system.

71
Q

cookie

A

Browser cookie (HTTP cookie): A small piece of data given to a Web browser by a Web server. The browser stores the data as either a temporary “session cookie” or a permanent “persistent cookie”. Cookies are specific to a domain and are sent back and forth between the browser and server.

72
Q

Web proxy

A

Web proxy: A piece of software installed on a client that is designed to intercept all traffic between the local web browser and the web server. Commonly used for security testing web applications because they allow a tester to modify the requests and responses. (examples Burp Suite, Zed Attack Proxy (ZAP))

73
Q

5 Database Models

A

5 Database Models
• Hierarchical: Data in a hierarchical database is arranged in a tree structure, with the parent records at the top of the database, and the hierarchy of child records in successive layers.
• Network Database: Improved the hierarchical model by allowing records to be networked to other records through paths that are different than the hierarchy.
• Relational Database: Contains two dimensional tables which use attributes (columns) and tuples (rows) to contain and organize information. It allows for the customization of relationships without hierarchical constraints. The relational database model is the most widely used model today
• Object-oriented: These databases store objects which combine both data and functions (code). They use an object oriented framework with similar features as object oriented languages and can have classes, instances, inheritance, etc.
• Distributed Database: Data is stored in more than one database (e.g. DNS), but it is logically connected. The components exist in multiple locations. A distributed database is not really about the database design so much as the fact that it exists in multiple locations.

74
Q

Normalization

A

Normalization: seeks to make the data in a table logically concise, organized, and consistent. Three rules (or forms):
• First normal form (1NF)- divide data into tables
• 2NF- move data partially dependent on primary key to another table
• 3NF- remove data not dependent on primary key

75
Q

DB Tuple

A

Record (Row or Tuple): Collection of related data items

76
Q

DB Table

A

Table: A collection of similar records

77
Q

DB Attribute

A

Attribute: A column in a database table

78
Q

DB View

A

View: Virtual relation defined by the database to control subjects from viewing certain data. Permits one group or a specific user to see certain information, while restricting another group from viewing it altogether.

79
Q

DB Field

A

Field (Cell): Intersection of a row and column

80
Q

Data dictionary

A

Data dictionary: Is a central repository of data elements and their relationships, such as data elements, schema objects and reference keys.

81
Q

Data Schema

A

Data Schema: describes the attributes and values of the tables

82
Q

Cardinality

A

Cardinality: The number of rows in the table.

83
Q

Table Degree

A

Degree: The number of columns in the table.

84
Q

DB Domain

A

Domain: Is a set of allowable values that an attribute can take.

85
Q

Data warehouse

A

Data warehouse: A large database used for reporting and data analysis. It Integrates data from one or more disparate sources and creates a central repository of data.

86
Q

Data mining

A

Data mining: The process of analyzing data from different perspectives and summarizing it into useful information

87
Q

ODBC

A

Open Database Connectivity (ODBC): Provides a standard SQL dialect that can be used to access many types of rational databases.

88
Q

SQL

A

• Structured Query Language (SQL): The most popular relational database query language. It enables interaction with databases. There are many types of SQL. SQL uses two subsets of commands to work with databases: DDL, & DML

89
Q

DDL

A

Data Definition Language (DDL): Used to create, modify and delete tables in a database. It also defines the structure and schema of the database.

  • Structure: table size, key placement, views and data element relationships.
  • Schema: the type of data that will be held and manipulated and their properties.
90
Q

DML

A

Data Manipulation Language (DML): Used to query and update data in a database.

91
Q

Primary key

A

Primary key: Is a unique identifier in the table that uniquely identifies an individual row (tuple) in the table.

92
Q

Foreign key

A

Foreign key: An attribute (column) in one table, that has values matching the primary key in another table. It is used to establish and enforce a link between two tables.

93
Q

Semantic integrity

A

Semantic integrity: Ensures that data entered into a row reflects an allowable value for that row.

94
Q

Referential integrity

A

Referential integrity: Refers to the relationship between tables. Each table in a database must have a primary key. This primary key can appear in other tables because of its relationship to data within those tables. When a primary key from one table appears in another table, it is called a foreign key.

95
Q

Entity integrity

A

Entity integrity: Every table must have a primary key and that the column or columns chosen to be the primary key should be unique and not null.

96
Q

ACID Test

A

ACID Test
o Atomicity- when one part of the transaction fails, the entire transaction fails;
o Consistency- database remains in a consistent state before the start of the transaction and after the transaction is over;
o Isolation- other operations cannot access or see the data in an intermediate state during a transaction;
o Durability- once the user has been notified of success, the transaction will persist, and not be undone;

97
Q

Concurrency

A

Concurrency: Many users can access data at the same time.

98
Q

Rollback

A

Rollback: The process of undoing a change to a database

99
Q

Commit

A

Commit: A permanent change to a database

100
Q

Savepoint

A

Savepoint: Used to make sure that if a system failure occurs or if an error is detected, the user can always return to a point in time before the system crashed

101
Q

Transactions

A

Transactions: Used when there are multiple writes to a database and to make sure all writes occurred without error before committing them. All writes are wrapped within a single transaction and checked for errors after each write. If any write causes an error, they are all rolled back. If all writes occur successfully, you commit the transaction.

102
Q

Polyinstantiation

A

Polyinstantiation: Enables a relation to contain multiple tuples with the same primary keys with each instance distinguished by a security level. A different set of information can be given dependent on access privileges.

103
Q

SSI

A

Server side includes (SSI): An HTML feature that allows a web page to embed contents from another file, before serving the page to the user. This allows web developers to reuse the contents of the include file in multiple web pages.

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions