Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Software Security > Flashcards

Software Security Flashcards

1
Q

Data normalization

A

ensures that attributes in a database table depend only on the primary key.

It removes redundant data and improves the integrity and availability of the database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which testing technique focuses only on testing the design and internal logical structure of the software product rather than its functionality?

A

white-box testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which test design typically focuses on testing functional requirements?

A

black-box testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which database feature ensures that the entire transaction is executed to ensure data integrity?

A

two-phase commit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Rapid Application Development (RAD)

A

rapidly develops software via the use of prototypes, “dummy” GUIs, back-end databases, and more.

The goal of RAD is quickly meeting the business need of the system; technical concerns are secondary.

The customer is heavily involved.

It relies on tools that enable quick development Such as: GUI builders, CASE, DBMS, OO.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Joint Analysis Development (JAD)

A

helps developers to work directly with users to develop a working application.

disadvantage is involvement of large numbers of users may lead to political pressures that influence against security considerations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is degree?

A

the number of columns in a table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is cardinality?

A

is the number of rows.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Atomic values?

A

mean that at every row/column position in every table there is always exactly one data value and never a set of values.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Open Database Connectivity (ODBC)?

A

an application programming interface (API) that can be configured to allow any application to query databases. The

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the security issues with ODBC?

A

 The username and password for the database are stored in plaintext.
 The actual call and the returned data are sent as cleartext over the network.
 Calling applications must be checked to ensure they do not attempt to combine data from multiple data sources, thus allowing data aggregation.
 Calling applications must be checked to ensure they do not attempt to exploit the ODBC drivers and gain elevated system access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is OLE DB?

A

method of linking data from different databases together.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ORB?

A

Object Request Brokers (ORBs), which can be used to locate objects: they act as object search engines.

ORBs are middleware. Common object brokers included COM, DCOM, and CORBA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Normalization?

A

it removes redundancies in the data, and ensures that attributes in a database table depend only on the primary key.

This makes the database consistent and easy to maintain and improves the integrity and availability of the database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the risk of metadata?

A

risk of privacy violations and integrity of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is OLAP

A

an Online Analytical Processing (OLAP) designed to record all of the business transactions of an organization as they occur in real-time and concurrently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How compromising database views happen?

A

difficulty in verifying how the software performs the view processing.

The view just limits the data the user sees; it does not
limit the operations that may be performed on the views.

the layered model frequently used in database interface design may provide multiple alternative routes to the same data, not all of which may be protected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Atomicity?

A

is when all the parts of a transaction’s execution are either all committed or all rolled back—do it all or not at all.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Consistency?

A

occurs when the database is transformed from one valid state to another valid state based on user-defined integrity constraints.

20
Q

What is Isolation?

A

the process guaranteeing the results of a transaction are invisible to the transactions until the transaction is complete.

21
Q

What is durability?

A

ensures the results of a completed transaction are permanent and can survive future system and media failures.

22
Q

What OLAP is necessary?

A

used when databases are clustered to provide fault-tolerance and higher performance.

The main goal of OLTP is to ensure that transactions happen properly or they don’t happen at all by rolling back using transaction logs.

23
Q

What is security concerns for OLTP systems?

A

concurrency and atomicity.

24
Q

What is Noise and perturbation?

A

a technique of inserting bogus information in the hopes of misdirecting an attacker enough that the actual attack will not be fruitful.

25
Q

What is the benefit of database view.?

A

used to provide a constrained user interface, by implementing least privilege, need-to-know and provide content-dependent access restrictions.

26
Q

What is CORBA?

A

an open object-oriented standard architecture developed by the Object Management Group (OMG), vendor neutral networked object broker competing with Microsoft’s DCOM.

enforces fundamental object-oriented design, as low-level details are encapsulated (hidden) from the client.

27
Q

What are the characteristics of CORBA?

A

communicate via a message interface, described by the
interface definition language (IDL).

a middleware that establishes a client–server relationship

enables applications to communicate with one another no matter where the applications are located or who developed them.

enforces fundamental object-oriented design, as low-level details are encapsulated from the client.

28
Q

What is Dynamic Data Exchange (DDE)?

A

enables applications to work in a client/server model by providing direct communication between two applications using interprocess communication (IPC).

29
Q

Verification phase

A

include activities to verify compliance of the system with security requirements.

Verification determines if the product accurately represents and meets the design specifications given to the developers.

This step ensures that the specifications are properly met and closely followed by the development team.

30
Q

Validation phase

A

determines if the product provides the necessary solution intended real-world problem.

It validates whether or not the final product is what the user expected in the first place and whether or not it solve the problem it intended to solve.

Verification -> Validation

31
Q

Timestamping

A

provides a window of time indicating how long a message is valid.

32
Q

Nonce

A

is a random value that is used to periodically authenticate the receiving system.

33
Q

To ensure integrity.

A

You need to implement time and date stamps in an application program while transactions are being recorded

34
Q

Software Capability Maturity Model (CMM)

A

a maturity framework for evaluating and improving the software development process. Carnegie Mellon University’s (CMU) Software Engineering Institute (SEI) developed the model.

The goal of CMM is to develop a methodical framework for creating quality software
that allows measurable and repeatable results

35
Q

The five levels of CMM

A 
initial
Repeatable
Defined
Managed
Optimizing
36
Q

Artificial neural networks

A

simulate neural networks found in humans and animals.

capable of making a single decision based on thousands
or more inputs.

37
Q

An artificial neural network learns by

A

example via a training function; synaptic weights are changed via an iterative process until the output node fires correctly for a given set of inputs.

Used for “fuzzy” solutions, where exactness is not always required (or possible), such as predicting the weather.

38
Q

Genetic algorithms and programming

A

instead of being coded by a programmer, they evolve to solve a problem.

It seeks to replicate nature’s evolution, where animals evolve to solve problems

39
Q

What is the purpose of automicity in an online transaction processing (OLTP) environment?

A

It ensures that only complete transactions take place.

40
Q

What should you do to ensure the stability of the test environment?

A

Separate the test and development environments.

41
Q

Which database feature limits user and group access to certain information based on the user privileges and the need to know?

A

database views

42
Q

What are tuples?

A

rows or records in a relational database

43
Q

How is assurance achieved?

A

using verification and validation

44
Q

What is the process of identifying, controlling, and auditing changes that are made to a trusted computing base (TCB)?

A

configuration management

45
Q

What are the Spiral model steps ?

A

1) product design,
2) system requirements,
3) concept of operations,
4) implementation.

Each round included multiple repeated steps, including prototype development and a risk analysis. A risk analysis is performed each round to lower the overall risk of the project. The spiral ended with successful implementation of the project.

CISSP (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions