Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP 2023 Prep > Stuff from Exams I don't know #5 > Flashcards

Stuff from Exams I don't know #5 Flashcards

1
Q

SDN

A

Software Defined Network

SofG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

GEO/LEO networks?

A

Geo-stationary, Low-earth Orbit.

Both are satellite internet options, but LEO is faster with lower latency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

GDPR Privacy Shield, and relationship to Safe Harbor

A

NONE - Safe Harbor is deprecated, used prior to GDPR.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Decentralized vs centralized access controls - benefits and drawbacks

A

A decentralized access-control system keeps user IDs, rights, and permissions in different locations on the network. These locations are often spread out across different subnets by placing them on servers connected to networks contiguous to the user requesting access and utilizing linked or associated databases.
- More redundancy
- harder to scale
- harder to administer

A Centralized Access Control system keeps user IDs, rights, and permissions in a database on a central server.
-single point of failure
- easier to scale
- easier to administer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Major driver of Zero Trust

A

Proliferation of endpoint devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

PIDAS

A

PIDAS stands for perimeter intrusion detection and assessment system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In DRP - is “Cloud Site” a term?

A

YES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Technology Convergence

A

Technological convergence is the tendency for technologies that were originally unrelated to become more closely integrated and even unified as they develop and advance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

RADIUS - TCP or UDP?

A

UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SMP, MPP Related to distributed computing?

A

SMP: Symmetric parallel processing

Mpp: Technology used to create systems that house hundreds or even thousands of processors, each of which has its own operating system and memory/bus resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SCA - security controls assessment?

A

NIST 800-53

The testing and/or evaluation of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DoD Model?

A

4 layers, analogous to TCP/IP system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Characteristics of Microservices

A

Derived from service-oriented-architecture:

A singular element, feature, capability, or funcion of a web app that can be called upon by other web apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

NIST 800-53

A

Sec and Privacy controls for Federal Info Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Supervised learning vs unsupervised learning - machine learning

A

Supervised learning uses labeled training data, and unsupervised learning does not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Slack Space

A

The unused space in a group of disk sectors. Or, the difference in empty bytes of the space that is allocated in clusters minus the actual size of the data files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Expert Systems

A

A system that seeks to embody the accumulated knowledge of humankind on a particular subject and apply it in a consistent fashion to future decisions. The application of computer based artificial intelligence in areas of specialized knowledge.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Coverage Analysis

A

Test coverage analysis, or simply “coverage analysis,” refers to the relationship between the amount of source code in a given application and the percentage of code that has been covered by the completed tests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Remember - RADIUS is not encrypted

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SOAP - WS-Security

A

Web Services Security (WS-Security, WSS) is an extension to SOAP to apply security to Web services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

PCoIP

A

Type of remote access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

bit-level image vs whole-disk copy

A

I don’t think whole-disk copy is technically a term.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

TPI - Two person integrity?

A

form of M of N Control??

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Can iSCSI run on ethernet?

A

YES - doesn’t typically use fiber

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

VPN - what is the Trailer used for?

A

Integrity check, trailer contains the hash of the payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A Remote Authentication Dial-In User Service (RADIUS) server uses ______ for authentication.

A

Symmetric Keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

IPSec - which mode provides true end to end encryption?

A

IPSec tunnel mode offers true end to end encryption. IPSec in transport mode offers point to point encryption. Neither HTML nor HTTP offers encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Is XML Gateway a thing?

A

Yes

27
Q

Credential Management API WC3 January 2019

A

The Credential Management API lets a website store and retrieve password, public key, and federated credentials

28
Q

HPC - High Performance Computing

A

Used when Real-time or near real-time processing of massive data is needed for a particular task or application.

Three main components:

Compute Resources, Network capabilities, storage capacity

29
Q

MAC Environments - Hierarchical, Compartmentalized, Hybrid

A

Hierarchicacl - can only access at own level.

Compartment - can only access in your compartment, but at all levels.

Hybrid - both are in place.

30
Q

Client based CDN

A

AKA P2P, example, Bittorrent

31
Q

Machine learning

A

Uses mathematical approaches to analyze data, searching for patterns that predict future activity.

32
Q

SRAM vs DRAM

A

SRAM - uses inexpensive memory with latches called flip-flops

DRAM - Stores bits in small capacitors

33
Q

Most Secure form of EAP

A

EAP-TLS because it requires mutual authentication

34
Q

Combinatorial software testing

A

Combinatorial software testing is a black-box testing method that seeks to identify and test all unique combinations of software inputs.

35
Q

MTD = RTO + WRT

A

RTO = time to bring system back online

WRT = time to configure system after back online

36
Q

Acceptance Testing

A

Determines whether software meets end user/customer expectations.

37
Q

photoelectric sensor

A

Photoelectric smoke detectors help detect smoke from smoldering fires.

38
Q

Serverless Architecture AKA FAAS (function as a service)

A

Serverless architecture refers to a cloud computing model where the cloud provider manages the infrastructure and servers dynamically, allocating resources as needed. In a serverless architecture, developers can focus on writing code and deploying applications without worrying about managing the underlying infrastructure such as servers, operating systems, or scaling resources.

39
Q

Cloud based federation

A

Cloud-based federation typically uses the third party service to share federated identities.

A common method is to match the users internal login ID with a federated identity externally.

40
Q

On premise federation

A

This is a federation hosted on premises. One example is if two companies merge and have separate SSO systems, but both organizations need to be able to authenticate with each other.

41
Q

Hybrid federation

A

Combination of cloud-based and on-premise solution. For example, acme has a cloud-based federation providing employees with online training, but after a merger with EMCA, they implement an on-premises solution to share identities with the two companies.

42
Q

Compliance checks

A

Compliance checks are a part of security testing and assessment programs for regulated firms. These checks verify that all controls listed are in compliance and functioning properly and effectively meeting regulatory requirements.

43
Q

DAD triad

A

Opposite of CIA

disclosure, alteration, destruction

44
Q

URL rewriting

A

With URL rewriting, all links that are returned to the browser or that get redirected have the session ID appended to them

45
Q

Avalanche Effect

A

Hashing - when one input character changes, the entire hash changes as well.

46
Q

Is a Signed Check an example of MFA??

A

Yes! the Signature is “Something you are” the Check is “Something you have”

47
Q

Session keys use what kind of key?

A

Symmetric

48
Q

What secure sanitization method is available to Cloud Users?

A

Cryptoshredding.

49
Q

Aggregation vs Inference Attack

A

Aggregation attack as an individual used his access to specific pieces of information to piece together a larger picture than he/she is authorized to access. An inference as the attacker used several pieces of generic nonsensitive information to determine or learn specific sensitive value.

50
Q

ECDSA

A

Elliptic curve digital signature algorithm - hashing algorithm that provides integrity and nonrepudiation

51
Q

System High Mode

A

Information systems security mode of operation wherein each user, with direct or indirect access to the information system, its peripherals, remote terminals, or remote hosts, has all of the following:

valid security clearance for all information within an information system;

formal access approval and signed nondisclosure agreements for all the information stored and/or processed (including all compartments, sub compartments and/or special access programs);

and
valid need-to- know for some of the information contained within the information system.

52
Q

Isolation Breach??

A

IN a distributed compute environment - an isolation breach is where one distributed computing client gains access to all other devices in the distributed environment.

53
Q

Types of ATOs (authorization to operate)

A

Authroization to operate, common control authorization, authorization to use.

54
Q

Distributed compute environment, AKA Distributed System

A

Primary concern is interconnectedness of the components.

Examples, DNS, MMORPGs, mobile networks, and most websites.

55
Q

Common Control Security Target

A

Specify the claims of security from the vendor that are built into the Target of Evaluation.

Lists out what the vendor will provide

56
Q

Who adds a certificate to the CRL?

A

The CA that issued the certificate.

57
Q

New 5G enhancements over 4G

A

Enhanced subscriber identity protection

Mutual auth capabilities

58
Q

Prudent Man Rule

A

Requires that Senior Management take personal responsibility for ensuring due care.

59
Q

Multitasking vs MultiThreading

A
60
Q

CCMP WPA2

A

AES based encryption method for WPA2

61
Q

Lost update - SQL

A

When one transaction writes a value to the DB that was needed by a transaction with earlier precedence.

62
Q

ECPA

A

Electronic communications privacy act. Makes it a crime to have had the privacy of others electronically

63
Q

Brewer Nash model

A

Explanation

The Brewer-Nash model allows access controls to change dynamically based upon a user’s actions. It is often used in environments like Matthew’s to implement a “Chinese wall” between data belonging to different clients.

64
Q

Minimum effective time for mandatory vacation

A

One week

65
Q

Does roll-based access control allow users to be part of multiple groups?

A

Yes

66
Q

SLR

A

Service level requirement

CISSP 2023 Prep (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions