Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Software Development Security > Flashcards

Software Development Security Flashcards

1
Q

What is a distributed application?

A

An application that consists of components that reside on separate, networked systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 distinct issues to be aware of when securing distributed systems?

A
  • Software integrity
  • Data integrity
  • Access Control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an agent in relation to distributed systems?

A

A software component in a distributed system that performs a particular service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Patch Management, Host base Intrusion Detection systems and Performance & Capacity Management Systems are all examples of what?

A

Agents in a distributed system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an applet in a distributed system?

A

A component that’s downloaded and executed by a web browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the two most common applets?

A

Java and Active X

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Java code runs in a constrained environment meaning that it can only communicate with the host from which it was downloaded? What is this commonly known as?

A

A sandbox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How does the security philosophy for Active X differ to that of Java?

A

The person running the web browser gets to determine whether they trust all Active X applets coming from a particular server. Digital certificates prove whether the Active X applet is genuine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following applets doesn’t use a concept of a sandbox? Java or Active X?

A

Active X

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Mobile code thats downloaded from a server and run on a client is otherwise known as what?

A

An applet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Should Active X be blocked by enterprises?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Web 2.0?

A

web features such as wikis, blogs, web services, mashups, communities, information sharing, etc. that utilises different features on other websites.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In terms of applets, what is a mashup?

A

A web page or applications that combines functionality from external applications through their published Application Programming Interfaces (API)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An online map that displays locations that come from different online applications implement what?

A

Mashups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the principle of an Object-oriented environment?

A

Objects after they are written, can be used again and again making an enterprises entire software development more efficient over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is encapsulation with regards an object oriented environment?

A

inner workings of the object are hidden

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What term is used to describe an object performing a function?

A

A method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What term is used to describe an object that is running?

A

An instance (also refers to an object that is a member of a class of objects)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a behaviour in relation to an object oriented environment?

A

The result of an object having received a message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A template that defines the methods and variables to be included in a particular type of object is known as what?

A

A class

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Real world example of a class?

A 
Class = Cake
Object = Chocolate Cake
Method = recipe
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

the tree structure of a collection of classes and objects is known as what?

A

Class hierarchy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is delegation in relation to OO?

A

An object that delegates a message to another object that contains the correct method. Happens when an object doesn’t have the requested method.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An object that gets some of it’s characteristics from a class is known as what?

A

Inheritance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How do objects communicate with one another?

A

Through messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is Multi-inheritance?

A

When an object inherits characteristics from more than one class

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the basic unit in OO?

A

The Object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is Poly-instantiation?

A

the process of developing one object from another object, but with different values in the new object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is Polymorphism?

A

the ability to hide implementation details behind a common message interface. permits objects to be added to the system without having to re-write existing procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the 4 most common types of databases in use today?

A

Relational
Hierarchical
Object-oriented
Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is one way of simplifying security issues in a database, by allowing granular access, but through a virtual table using fields and rows from one or more tables in the database.

A

A View

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does aggregation mean with regards databases?

A

the process of combining separate low sensitive data items to produce a high sensitive data item

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which concept refers to the ability of someone to deduce or infer something about sensitive data that beyond normal reach because of its sensitivity level

A

Inference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

An application that cites the existence of highly sensitive information within it to users is know as what?

A

Inference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a database of databases known as?

A

Data dictionary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What 3 things can you control with a data dictionary?

A
  • create or re-create tables
  • manage security access
  • a control point for managing the schema of an applications database
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the difference between a data warehouse and production database?

A

production database used for business operations, whereas data warehouse is used for research, decision support, planning, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Why should a production database not be used for data warehousing purposes?

A

can impact the performance of normal business operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

In a data warehouse, figuring out trends about customers/business activities is commonly known by which two terms?

A

Data Mining

Business Intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Data mining can be used to detect fraud. true or false?

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q 
Which type of database is arranged in a tree structure with parent records at the top of the database and child records at successive layers?
Relational
Hierarchical 
Object-oriented
Network
A

Hierarchical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which type of database is an improvement to the design of hierarchical databases where records can be networked to other records via paths that don’t follow the normal tree structure?
Relational
Object-oriented
Network

A

Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which type of database has relationships between datasets with the freedom of a network database, but without the constraints of a hierarchical database?
Relational
Object-oriented

A

Relational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q 
Which type of database is part of the overall object oriented application design?
Relational
Hierarchical 
Object-oriented
Network
A

Object-oriented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are two characteristics of a Relational Database?

A
  • is defined by its schema

- records are often called rows and rows are stored in tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

In a relational database what would you use to query a table to look for a specific record?

A

A primary key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is a primary key?

A

A field in a table that contains a unique value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

In relational databases, what is a foreign key?

A

A field in a table that points to the primary key in another table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

A sub-routine that can be accessed by software applications is know by what term?

A

Stored procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Prepared statements are basically canned statements that can be called by the application. What are they also known as?

A

Parametrised statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

In a relational database what 2 methods can be used to protect against SQL injection attacks?

A

Stored procedures and Prepared statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is a distributed database?

A

A database whose components exist in multiple physical locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

A distributed database can be network, object oriented, relational, hierarchical or any other design. True or False?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

An action performed on a database that results in the addition, alternation or removal of data on a database is called what?

A

Transaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What can be used to protect data in a database and permit users to alter certain data in that database?

A

Database management System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is the dominant computer language used to manipulate data in a database?

A

SQL (Structured Query Language)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

In databases a mechanism used to avoid collisions in which two or more programs may be trying to update the same table or row at the same time is known as what?

A

Locking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is used to describe a system that can make decisions or predict the future based on historical data?

A

Knowledge Based System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Which type of system builds a database of past events in order to predict outcomes in future situations?

A

Expert Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Expert systems are designed to work with a degree of uncertainty. In what two ways do they do this?

A
  • Fuzzy logic

- Certainty factors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is fuzzy logic?

A

the component of an expert system that produces a quantitative result based on uncertainties. breaks down the factors influencing a decision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is a certainty factor?

A

Operates on the numeric probabilities of yes/no, true/false, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is a neural network?

A

accumulates knowledge by observing events, measuring their input and outcome. Overtime it becomes proficient at predicting the correct outcome. Learns that input components are weighted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What is the central component of an operating system?

A

The kernel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are the 4 primary activities carried out by the kernel?

A
  • Process Management: controls execution/termination of programs
  • Memory Management: allocated memory to itself as well as running processes
  • Interrupts: signal sent to the kernel to temporarily suspend processing
  • Hardware Resource Management: manage process access to computer hardware.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What part of the OS permits interaction between the kernel and specific hardware connect to the computer?

A

Device Drivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are the two primary OS interfaces?

A

Graphical and Command Line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What are the 5 main security functions that an OS carries out on a computer?

A
  • Authentication
  • Access Control
  • Process isolation
  • Network communication
  • File-system Access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What are the 2 objectives of a system development life-cycle?

A
  • A system that performs its intended function correctly and securely
  • A development project that’s completed on time and in budget
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

In which type of system development model are stages performed sequentially?

A

Waterfall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q 
In a Waterfall model which of the following is used to provide a high level description of a system?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Conceptual Definition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q 
In a Waterfall model which of the following lists required characteristics/features of a system?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Functional Requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q 
In a Waterfall model at which stage should a test plan be outlined detailing characteristics of the system that should be tested?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Functional Requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q 
In a Waterfall model at which stage are the "what we think we can build" statements included?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Functional Specifications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q 
In a Waterfall model at which stage should details about authentication, authorisation, access control, confidentiality, transaction auditing, integrity, availability, etc. be contained?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Functional Specifications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q 
In a Waterfall model at which stage would database schemas, data flow diagrams, over the wire protocols etc. be inlcuded?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q 
In a Waterfall model At which stage would unit testing (process of verifying all the modules that are built) be carried out?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Coding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What is OWASP (The Open Web Applications Security Project)?

A

Provides guidelines for secure coding practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q 
In a Waterfall model At which stage would you check for programming erros?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Code review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What is Unit Testing?

A

allows a tester or developer to verify the correct functioning of individual modules of an application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q 
In a Waterfall model At which stage is a system tested end to end?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

System test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q 
In a Waterfall model At which stage is a system evaluated and declared fully functional?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Certification & Accreditation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

What is the difference between certification and accreditation?

A

Certification is a formal system evaluation whereas accreditation is done by senior management tat have said it’s ok to put the system into production.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q 
In a Waterfall model At which stage is change management and configuration management carried out?
Conceptual Definition
Functional Requirements
Functional Specifications
Design
Design Review
Coding
Code review
System test
Certification & Accreditation
Maintenance
A

Maintenance

85
Q

The process of approving modifications to a production environment is known as what?

A

Change Management (the what)

86
Q

the process of recording modifications made to a production environment is called what?

A

Configuration Management (the how)

87
Q

name 4 common system development life-cycle models?

A

Waterfall
Spiral
Scrum
RAD (Rapid Application Development)

88
Q

What should the 5 security principles be in software development?

A
  • Security in the requirements
  • Security in the design
  • Security in testing
  • Security in the implementation
  • Ongoing security testing
89
Q

What 12 applications security controls should be considered when developing a system?

A
  • process isolation
  • hardware segmentation
  • separation of privilege
  • accountability
  • defence in depth
  • abstraction
  • data hiding
  • system high mode
  • security kernel
  • reference monitor
  • supervisor and user mode’s
  • SLA’s
90
Q

Application Security: What is process isolation?

A

running processes aren’t allowed to view or modify memory or cache assigned to another process (isolation carried out by OS so developer shouldn’t have to worry about this)

91
Q

Application Security: What is hardware segmentation?

A

the practice of isolating functions to separate hardware platforms to ensure the integrity and security of system functions, ie separation of a development environment and a production environment.

92
Q

Which two of the following are used to re-enforce the concept of separation of duties and least privilege?

  • process isolation
  • hardware segmentation
  • separation of privilege
  • accountability
  • defence in depth
  • abstraction
  • data hiding
  • system high mode
  • security kernel
  • reference monitor
  • supervisor and user mode’s
  • SLA’s
A
  • hardware segmentation

- separation of privilege

93
Q

Application Security: What is separation of privileges?

A

assures that no individuals or objects have excessive functions on a system

94
Q

Application Security: What is Abstraction?

A

a process of viewing an application from its highest level functions, which make all lower level functions into abstractions.

95
Q

In abstraction, lower level functions are treated as black boxes. What does this mean?

A

Known to work, even if we don’t know how.

96
Q

Application Security: What is system high mode?

A

refers to a system that operates at the highest level of information classification.

97
Q

Application Security: What is the Security Kernel?

A
  • composed of hardware, software and firmware components that mediate access and functions between subjects and objects.
  • part of the protection ring model in which the OS kernel operates the innermost ring and has full access to all system data/hardware with user programs occupying outer rings with fewer access privileges.
98
Q

What does the security kernel use to enforce access control on a system?

A

Reference Monitor

99
Q

Why should a business application run in user mode rather than supervisor mode?

A

An application running in supervisor mode could bypass some or all security controls

100
Q

What 8 minimum standards should be defined in an SLA?

A
  • Hours of availability
  • Average and peak number of concurrent users
  • Transaction throughput
  • Data storage capacity
  • Application Response Times
  • Service Desk Response Times
  • Security Incident Response Times
  • Escalation process during times of failure
101
Q

What are the characteristics of a virus?

A
  • to replicate itself. spreads by making identical copies of itself on files that are likely to be transported to other computers.
  • can be booted from media, run from a .exe, macros in documents/image files, Javascript, Active X, etc.
102
Q

A virus that can spread by both using the boot sector and executable files is called what?

A

A multi-partite virus

103
Q

What is the difference between a worm and a virus?

A

Worms propagate by attacking known weaknesses on systems whereas viruses propagate via programs, ie .exe

104
Q

Conficker, Code Red, NIMDA and Storm are all types of what?

A

Worms

105
Q

A malicious program that hides itself within the target machine in order to evade detection is known at what?

A

A rootkit

106
Q

Name 5 types of rootkits?

A
  • Hardware
  • Firmware
  • Hypervisor
  • Kernel
  • Library
107
Q

Which type of rootkit normally requires a compromise in the manufacturers supply chain that permits the substitution of a component in a computer with one that includes rootkit code?

  • Hardware
  • Firmware
  • Hypervisor
  • Kernel
  • Library
A

Hardware

108
Q

What is the most likely scenario in which a firmware could be infected by a rootkit?

A

Firmware updates

109
Q

What are the characteristics of a Hypervisor rootkit?

A
  • Operates as a virtual machine running between the hardware and the OS.
  • The running OS is a guest on the hypervisor environment.
  • can intercept all communications such as input/output with devices such as disk drives.
110
Q

What is a kernel rootkit?

A

Utilises malicious code to insert itself into the OS kernel.

111
Q

What is a Library rootkit?

A

Inserts rootkit code into an OS code’s library. Rather than alter the disk copy of a library file, a rootkit alters the memory image only.

112
Q

Why are rootkits difficult to detect?

A

rootkits exist in a location that the Anti-Virus program is unable to access or is not designed to access.

113
Q

An object that claims to be one thing, but turns out to be something else is known as what type of malicious code?

A

Trojan Horse

114
Q

What are the characteristics of a trojan horse?

A
  • generally don’t spread by replicating themselves
  • normally delivered either via email with a malicious payload such as .exe or file with macros or via a pop-window with a link.
115
Q

Which two types of malicious could generally spread through replication?

A

Worms and Viruses

116
Q

A pop-up windows trojan that attempts to pressure a user into installing software because their machine is infected is known as what?

A

Scareware

117
Q

A phony virus warning message that is designed to cause panic is otherwise known as what?

A

A hoax

118
Q

Which type of program is designed to cause damage when some sort of computer/network event has occurred?

A

Logic Bomb

119
Q

What are the characteristics of a logic bomb?

A
  • invokes when a specific computer/network event occurs.

- don’t replicate, but can be delivered via viruses or worms

120
Q

What would be two ways of combating logic bombs?

A
  • code reviews

- controls that prevent unauthorised changes from being inserted into software and systems.

121
Q

What is a malicious applet?

A

Active X/ Java applet carrying malicious code.

122
Q

Why is it easier to write a destructive Active X applet than a Java applet?

A

Active X applets normally have unfettered access to the entire computer, whereas a Java applet is sandboxed.

123
Q

Which type of logic bomb functions as part of a program and performs an undocumented function whenever certain conditions are met to bypass security controls?

A

Trapdoor

124
Q

What is Hidden Code in relation to Malicious Code?

A

If an attacker can modify or replace programs on the target system, he or she may elect to install hidden code that usually carries out some sort of malicious act.

125
Q

An applications reporting program that also happens to erase certain entries fro an audit trail can be categorised as which type of malicious code?

A

Hidden code

126
Q

An attack where the attacker attempts to insert instructions into a computer programs input field, in an attempt to prompt the program to perform functions unintended by the programs developer is known as which type of attack?

A

Injection Attack

127
Q

What are two common types of injection attacks?

A

SQL injection: injects SQL statements in an attempt to trick a backend database to perform specific funtions.

Frame injection: attacker attempts to load arbitrary code into a browser into order to steal other data from other frames present in the browser session.

128
Q

Frame injections are also commonly known by which two names?

A

Cross Frame Scripting

XFS

129
Q

Which type of attack is one where an attacker is able to inject client-side scripts into web pages viewed by other intended victims and allows an attacker to bypass security mechanisms in websites/browsers?

A

Cross-site scripting attack (XSS)

130
Q

What are the two principal types of XSS attacks?

A

Non-persistent and persistent

131
Q

Which type of XSS attacks tricks a user to clicking a malicious URL containing a malicious script, which for instance could steal the users session cookies?

A

Non-persistent XSS attack.

132
Q

Which type of XSS attack is malicious code stored within a browser/website?

A

Persistent XSS attack

133
Q

In which type of an attack, does an attacker attempt to trick a victim into clicking on a link which then performs some sort of action that the victim would not approve?

A

Cross-site request forgery (CSRF)

134
Q

What are two common methods of protecting against Cross-site request forgery attacks?

A
  • the inclusion of a one-time-use hidden variable such as a nonce on important web pages. the website keeps track of these hidden variables and any variation indicates potential tampering.
  • inclusion of a secondary approval dialogue for any significant transaction, ie on a banking website.
135
Q

What is the purpose of a Denial of Service attack?

A

To make a system unavailable

136
Q

What are the two types of Dos Attacks?

A
  • attacker floods the victims system with a large number of network packets that legitimate users of the system cannot reach.
  • attacker creates a specific message that is designed to cause the target system in malfunction and stop running
137
Q

What is a DoS SYN attack?

A
  • exhausts a systems resources to the point that it can no longer function.
138
Q

What is the Ping of Death attack?

A

a malformed or extremely large ping packet is sent to the target system

139
Q

What is a Distributed Denial of Service attack (DDoS)?

A

occurs when an attacker uses multiple systems to attack a target system simultaneously

140
Q

Which type of attack is used to crack computer passwords using common words found in the dictionary?

A

A dictionary attack

141
Q

What does a dictionary attack first require in order to be successful?

A

A copy of the Unix password/shadow file or Windows SAM file.

142
Q

Which type of attack changes the network identity of a computer or program so as to trick the targeted system into granting access? ie a target system may only accept telnet requests from specific IP’s which the attacker masquerades as

A

Spoofing

143
Q

In a spoofing attack, when the target system replies, will the reply go to the attacker spoofing the address or the actual address itself?

A

Address itself

144
Q

What are 4 ways of preventing spam?

A
  • Centralised appliance: appliance connected to the network ahead of the email server.
  • Spam blocking service: third party service receives the email, blocks out the spam. advantage is a complete absence of spam consuming network resources.
  • Spam blocking software: anti-spam software running on email server removing spam when they enter or after they are stored. less widely used.
  • Workstation based software: almost never used anymore.
145
Q

What are the most effective spam blocking services?

A

those that are centralised and placed as far ahead of the email servers as possible.

146
Q

What are 4 technical forms of social engineering?

A

Phishing
Pharming
Spear-phishing
Whaling

147
Q 
Which technical form of social engineering involves the create of genuine looking email messages that direct a user to a fake site such as on-line banking to enter details?
Phishing
Pharming
Spear-phishing
Whaling
A

Phishing

148
Q 
Which technical form of social engineering hacks a user's DNS to re-direct them to a fake site?
Phishing
Pharming
Spear-phishing
Whaling
A

Pharming

149
Q

What is spear phishing?

A

An attacker targets certain users or groups of users, ie a phisher may know the specific online financial institutions that a group of users use.

150
Q

What is Whaling?

A

A type of phishing attack that targets seniot executives in an organisation.

151
Q

Which type of social engineering attack is a special form where an attacker poses as an admin or vendor, telling unsuspecting users that a flaw has been discovered in the system and they should install a certain patch (usually a trojan horse)

A

Pseudo flaw attack

152
Q

A developer that buries software code in order to expose features, functionality, data , etc is known as what?

A

A maintenance hook

153
Q

What can be the problems with identifying maintenance hooks?

A

Normally undocumented and are designeed to evade detection

154
Q

What is a technical form of eavesdropping?

A

packet sniffers

155
Q

How can an attacker use traffic analysis and inference?

A

Analyse traffic patterns and other types of transmissions in order to make inferences about something her or she wants to know more about, ie sabotage a system during high network utilisation. normally part of a bigger plan.

156
Q

Which type of attack involves an attacker attempting to login with a user ID using every possible password?

A

Brute force attack

157
Q

How can a brute force attack easily be prevented?

A

Account lockout after a number of failed attempts.

158
Q

how does Anti-Virus software work?

A

intercepts OS routines that store files and open files.

159
Q

What is heuristics in relation to AV?

A

the AV software detects certain kinds of anomalous behaviour instead of checking for a virus signature such as the replacement of a .exe with a newer version.

160
Q

What are the two common methods used by AV vendors today?

A

Signatures and heuristics

161
Q

What are the 3 benefits of using heuristics?

A
  • conservation of space: signature files grow large.
  • decreased download time: rate of virus creation means that you need to update signatures more and more frequently.
  • improved computer performance: computer is focused on symptoms rather than does or doesn’t a file possess a virus signature.
162
Q

What is the difficulty in preventing new forms of malware?

A

virus code is scrambled each time it is sent to another computer meaning that a new signature is required for each one

163
Q

Other than AV, what are 3 other ways of commonly fighting against malware?

A
  • Application whitelisting: permit only registered applications to execute on a workstation
  • Data Leakage Prevention: Programs and network devices are designed to detect possible data leakage
  • malware callback detection: network devices that listen for signs of malware calling home, ie point of origin
164
Q

What is a hacker?

A

A broad-brush term describing anyone with computer hacking skills?

165
Q

An individual with a low technical acumen of that of real hackers and that use programs developed by hackers are called what?

A

Script kiddies?

166
Q

What was the original terms to describe someone that cracked long distance telephone networks in order to get free long distance calls?

A

Phreakers (often used to describe hackers that break into systems in order to obtain free services)

167
Q

What is the difference between a black hat hacker and white had hacker?

A

Black hat = bad guys

White hat = good guys

168
Q

What is bounds checking?

A

Field size, time, date, etc. think of buffer overflow attacks

169
Q

software development is covered in which ISO standard?

A

ISO 9000

170
Q

Which type of software development method is preferred for system security?
Non-iterative or iterative

A

Non-iterative

171
Q

What are three types of non-iterative security models?

A
  • Structured Programming Development: requires defined processes and modular development. Each phase is subject to reviews and approval
  • Spiral Method: nested version of Waterfall model. each phase of waterfall has 4 sub-stages based on the common Deming PDCA (Plan-Do-Check-Act). incudes risk assessment.
  • Cleanroom: engineering process for development of high quality software. method of controlling bugs in software. goal is to write code correctly the first time. more time spent on early phases to reduce testing. quality achieved through design rather than testing.
172
Q

What is the difference between iterative and non-iterative system development models?

A

Iterative allow for refinements of design, coding, requirements.

173
Q

What are 5 types of iterative system development models?

A
  • Prototyping: objective is to build a simplified version of the app.
  • Modified Prototype Model (MPM): form of prototyping that’s ideal for web app development. maintenance phase begins straight after deployment. app evolves as business requirements evolve.
  • Rapid Application Development (RAD): form of rapid prototyping. disadvantage is rapid development can result in poor decisions on design.
  • Joint Analysis Development (JAD): Integral part of RAD and other methods. based on key players communicating at critical phases of project
  • Exploratory Model: based on assumptions without structure. due to this security may play second fiddle.
174
Q

What 4 system development methods do not rely on the iterative/non-iterative model?

A
  • Computer Aided Software Engineering (CASE):
  • Component Based Development (similar to Object oriented programming)
  • Reuse Model (object oriented)
  • Extreme Programming:based on values or simplicity, communication and feedback. fairly structured approach.
175
Q

What 3 sub-languages are there in SQL?

A
  • Data Definition Language (DDL):used to create databases, tables, views.
  • Data Manipulation Language:used to query, insert,extract data
  • Data Control Language:used to control access to data
176
Q

Which sub-language of SQL is of primary concern in relation to security?

A

Data Control Language (DCL)

177
Q

What are the 5 database interface languages?

A
  • Open Database Connectivity (ODBC)
  • Java Database Connectivity (JDBC)
  • eXtensible Markup Language (XML)
  • Object Linking and Embedding Database (OLE DB)
  • Active X Data Objects (ADO)
178
Q

Which Database Language Interface is the dominant means of standardised data access?

A

ODBC

179
Q

What are common security issues with ODBC?

A
  • username and password stored in plaintext
  • call and returned data sent in cleartext
  • calling applications must be checked to ensure they don’t combine data from multiple sources, ie data aggregation.
  • calling applications must be checked to ensure they do not exploit ODBC drivers.
  • poor user verification
180
Q

How can access to databases through the internet be secured?

A

create a tiered application approach that manages data in layers. most use a three tier approach: presentation layer, business logic layer and data layer (internet computing model)

181
Q

What are the advantages and disadvantaged to the internet computing model for db access via the web?

A

Advantage is that the user does not directly access the data.
Disadvantage is that if the db has security featuresm they may be lost through the middle translation layer.

182
Q

What is a general metadata standard relating to the retrieval of information resources? (particularly form the web)

A

The Dublin Core Metadata Element Set

183
Q

What is Online Analytical processing?

A

provide an analyst with the ability to formulate queries, and based on the outcome of the queries, define further queries.

184
Q

The locking of data in a database and related requirements is known as an ACID test. What does this stand for?

A
  • Atomicity: when all parts of a transaction’s execution is committed or rolled back.
  • Consistency: occurs when a database is transformed form one valid state to another valid state.
  • Isolation: isolating one transaction from another
  • Durability: ensures completed results are permanent.
185
Q

In which SQL standards can individual object rights be assigned?

A

SQL 92

186
Q

In a non object oriented database, how can restrictions be applied to a database?

A

by user
by view
by individual items

187
Q

What 3 security controls can be applied to object oriented databases?

A

Metadata controls ,ie data dictionary
Data contamination controls, ie input/output controls
Online Transaction Processing: record all busines transactions

188
Q

What are the security concerns for OLTP systems?

A

Concurrency and Atomicity

189
Q

What is “Full Disclosure” in relation to software licensing?

A

where an individual publicly disseminates information regarding vulnerabilities they have found in software.

190
Q

What is a low level programming language?

A

machine and assembly languages (closer in form to the binary language of the computer)

191
Q

What are high level languages?

A

High level languages become closer to human language and introduce standards which can be beneficial for security. Java and C are examples.

192
Q

Languages are generally separated into generations what are they?

A

1st: binary, hex
2nd: symbols as abbreviations for instructions
3rd: meaningful words
4th: query languages
5th: natural language interfaces

193
Q

What is JavaScript?

A

allows control over most of the features of a web browser. security management in javascript is minimal. either its enabled or disabled.

194
Q

What are the 3 parts of the Java Security approach?

A
  1. Verifier: memory and bounds checking
  2. Class Loader: Load and unloads classes
  3. Security Manager: protects against rogue functionality
195
Q

What is a weakness of the 3 part java security model?

A

if any of the 3 parts fail to operate the security model may be compromised.

196
Q

Security enhancements to Java can provide:

A
  • validating certification paths
  • managing certificate revocation lists
  • kerberos support
  • authentication and access controls
  • encryption, key generation, message authentication
  • Java Secure Sockets Extension: implements java version of SSL/TLS and inlcudes data encryption, serevr authentication, message integrity, optional client authentication.
197
Q

What is a “Between the Lines Attack”?

A

occurs when telecommunications lines used by an authorised user are tapped into and data falsely inserted.

198
Q

Klez and SirCam are which type of virus?

A

have the ability to send data files form your system to another system.

199
Q

Jerusalem is a type of which virus?

A

File Infector

200
Q

Brain, Stoned and Michaelangelo are types of which type of virus?

A

Boot sector

201
Q

What is a Companion/Spawning virus?

A

doesn’t physically touch the target file. if files are copied to a certain directory in a specific order then the directory will get infected.

202
Q

Melissa, Loveletter, Hybris and SirCam are common viruses that are delivered by what means?

A

Email

203
Q

Concept and CAP are common examples of which type of virus?

A

Macro Virus

204
Q

What is a Macro Virus?

A

uses macro programming of an application such as a word processor. most common use visual basic for applications in microsoft word.

205
Q

What is a script virus?

A

usually standalone files that can be executed by an interpretor, ie Microsoft Windows Script Host ,.vbs.

206
Q

CodeRed, LION and Nimda are types of what?

A

Worms

207
Q

What is a Remote Access Trojan (RAT)?

A

designed to be installed, usually remotely, after systems are in production, not in development as is the case with logic bombs and backdoors.

208
Q

BlackShades, Back Orifice, Netbus, Bionet and SubSeven are types of what?

A

Remote Access Trojans

209
Q

What is a “Processor Privileged State”?

A

protects the processor and the activities it performs.

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions