Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Software Development Security > Flashcards

Software Development Security Flashcards

1
Q

What is a virus?

A

Piece of code that attaches itself to another piece of code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the majority of todays viruses doing?

A

Building/ running botnets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a Logic Bomb?

A

Like a Zero Day. Code that lies dormant until defined activation event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an agent?

A

Human run piece of autonomous/ distributed code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an Applet?

A

Code sent from a server to run on a client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What technology can create Active X controls?

A

Java, C++, VB, C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a key security difference between Java and Active X?

A

Java has a Sandbox function to limit memory access and ActiveX does not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Cardinality in a relational database?

A

Number of rows in a table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the Degree in a relational database?

A

Number of columns in a table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the “domain” in a relational database table?

A

The allowable values of a database field.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a candidate key?

A

Fields/ attributes that can uniquely identify a record in a database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a primary key?

A

Key identity fields for a database table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a foreign key?

A

Enforces the relationships between two or more tables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the ACID model for database transactions?

A

A - Atomic transactions (all or nothing)
C - Consistency of transactions
I - Isolation (one transaction at a time)
D - Durability (Once done they stay done)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is concurrency control?

A

Use of things like record locks to ensure data is not overwritten.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is cell suppression?

A

Encryption of a specific field to impose security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is polyinstantiation?

A

Two or more identical rows in a database designed for different classification levels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is noise or perturbation?

A

Insertion of false or misleading data into a database to thwart a confidentiality attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is ODBC

A

database access layer to ease database interaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Name some example aggregation methods in SQL?

A

avg(), min(), max(), count(), sum()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is an inference attack?

A

The combination of non-sensitive data to derive sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is metadata?

A

Data about data. More powerful than the actual data itself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Primary Memory

A

RAM

24
Q

What is secondary storage?

A

HDD, CD, tape, etc

25
Q

What is an example of virtual storage?

A

RAM disk

26
Q

What is a covert channel attack?

A

reading system memory or disks to gather information.

27
Q

What is an expert system?

A

The accumulation of knowledge from experts on a particular subject to apply consistent decision making.

28
Q

What is a knowledge base?

A

Series of rules in the form of if/ then statements.

29
Q

What is an inference engine?

A

Use of logical reasoning and/ or fuzzy logic to draw conclusions.

30
Q

What is a decision support system?

A

a knowledge based system that analyzes business data in such a way to ease decision making.

31
Q

What is a neural network?

A

System with “chain” of computational units to mimic the human brain.

32
Q

What is an assurance process?

A

Method to assure trust in a new system.

33
Q

What is a limit check?

A

Method to ensure entered data does not fall outside of its expected range.

34
Q

What is fail secure?

A

When a system crashes a fail secure ensures the system is not left in an insecure state.

35
Q

What is fail open?

A

System fails into an open or insecure state.

36
Q

Name the different levels of programming languages and provide examples of each.

A 
1GL - Machine
2GL - Assembler
3GL - C, C++
4GL - SQL
5GL - VB
37
Q

Name the processes in the Software Development Lifecycle.

A 
Conceptual Definition
Functional Requirements
Controls definition.
Design review
Code review
System test review
Maintenance/ change management
38
Q

Waterfall Methodology

A

Sequential step-wise

39
Q

Spiral Methodology

A

Higher repetition than waterfall.

40
Q

Agile Methodology

A

…

41
Q

Name the stages of Software Maturity

A 
1 - Initial... nothing defined
2 - Repeatable... basic processes
3 - Defined... defined processes
4 - Managed... quantitative methods used
5 - Optimizing... anomalies removed
42
Q

What is the IDEAL model?

A 
Initiating - Outline needs
Diagnosing - Analyze current state
Establishing - Develop plans from diag phase
Acting - "Do" phase
Learning - QA process.
43
Q

What happens during Request Control?

A

Users request, developers prioritize, and managers do cost/ benefit.

44
Q

What is change control

A

Organized framework that allows multiple developers to work effectively together.

45
Q

What is release control?

A

Orderly process to roll code forward.

46
Q

What happens during configuration management?

A

Configuration identification
Configuration control
Configuration status accounting
Configuration Audit

47
Q

What is white-box testing

A

Code walk

48
Q

What is black-box testing

A

End user perspective review

49
Q

What is grey-box testing

A

Combination of white and black box testing

50
Q

What is static code testing

A

Use of automation to find flaws.

51
Q

What is dynamic code testing?

A

Test of run time environment. used when code is not available.

52
Q

Name of layers in a protection ring

A

Layer 0 - OS reside here. Protected.
Layer 1 & 2 - Device drivers & other OS
Layer 3 - Application space (user mode, protected mode)

53
Q

What is encapsulation?

A

Development of increasingly complicated objects that draw from lower level objects.

54
Q

What is compartmented security mode?

A

System that can process two or more types of data.

55
Q

What is dedicated security mode?

A

Can process only specific classifications at a time.

56
Q

What is multi-level security mode?

A

Allowed to process more than one type of information.

57
Q

What is system high security mode?

A

Allowed to process only information that all users are cleared for.

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions