Test Study 3 Flashcards by Robby Bayless

What is the difference in a patent and a trade secret.

A patent is legal protection, however what you are protecting is now made public. A trade secret is kept hidden and the only legal protection is from theft.

How well did you know this?

Not at all

Perfectly

Which application tier involves how an application functions?

Tier 2, application logic

How well did you know this?

Not at all

Perfectly

What identity method is commonly used by large providers, such as Facebook?

OAuth

How well did you know this?

Not at all

Perfectly

Which step of the DREAD model talks about how bad an attack may be?

Damage

How well did you know this?

Not at all

Perfectly

What is a trade secret?

A formula, process, or design that is generally not known by others and has viable commercial use.

How well did you know this?

Not at all

Perfectly

What are 3 types of backups?

Full backup
Differential
Incremental

How well did you know this?

Not at all

Perfectly

What part of the RMF involves ongoing review and updating of controls?

Monitor and Update

How well did you know this?

Not at all

Perfectly

Which step of the DREAD model talks about how easy it is to identify the threat?

Discoverability

How well did you know this?

Not at all

Perfectly

What two phases of the penetration test loop until the test is completed?

Discovery and Attack

How well did you know this?

Not at all

Perfectly

What is the term for hiring a person to perform activities normally performed by a computer?

HumBot

How well did you know this?

Not at all

Perfectly

Which ‘due’ deals with research and planning?

Due diligence

How well did you know this?

Not at all

Perfectly

A computer is given an IP of 172.17.5.20, what caused this?

RFC1918

How well did you know this?

Not at all

Perfectly

What is a differential backup?

Backup the changes since the last full backup.

How well did you know this?

Not at all

Perfectly

Which application tier involves HTML?

Tier 1, presentation tier

How well did you know this?

Not at all

Perfectly

What US agency upholds the GDPR?

US Department of Commerce

How well did you know this?

Not at all

Perfectly

What is 802.5

Token Ring

How well did you know this?

Not at all

Perfectly

What happens during the assess step of the RMF?

Having an independent assessor test the controls.

How well did you know this?

Not at all

Perfectly

What is a generational fuzzer?

An intelligent fuzzer that has an understanding of the file format or protocol.

How well did you know this?

Not at all

Perfectly

What is the DREAD model?

Damage
Reproducibility
Exploitability
Affected Users
Discoverability

How well did you know this?

Not at all

Perfectly

What are the three application tiers?

Tier 1 - Presentation and organization, HTML and Javascript
Tier 2 - Application logic, functions, programming, C#, C++, Java
Tier 3 - Data tier, databases

How well did you know this?

Not at all

Perfectly

What can obfuscate a message that works on words or entire blocks of words?

Code

How well did you know this?

Not at all

Perfectly

What is something that XACML does NOT provide?

Authentication

How well did you know this?

Not at all

Perfectly

What is OVAL?

Open Vulnerability Assessment Language

Open standard for identifying vulnerabilities and not tied to any proprietary architecture.

How well did you know this?

Not at all

Perfectly

Which fuzzer is only ‘smart’

Generational

How well did you know this?

Not at all

Perfectly

What business model has four levels?

TOGAF

What is an incremental backup?

Backup the changes since the last backup, full or incremental.

What permissions are around Open Source?

Permission to use the original source code design and content in any way.

What is NoSQL?

A database type created to address the limitations and vulnerabilities associated with relational databases.

What part of the RMF involves making risk determinations based on risk assessments?

Authorize

What is Graph?

A NoSQL implementation that organizes information as nodes, relationships, and properties.

What can be implemented as a policy enforcement point between users and a cloud provider?

CASB

In cryptology, what is DEA?

Data encryption algoright | Substitution and permutation to 16 rounds.

Which fuzzer is only dumb?

Mutation

What database type was created to address the limitations and vulnerabilities associated with relational databases?

NoSQL

What are the steps of "the" risk management framework?

``` Categorize Select Implement Assess Authorize Monitor ```

What step of the penetration testing phase involves gaining access, escalating privileges, browsing for additional systems, and installing additional tools?

Attack

What protocol provides TCP/IP over serial?

SLIP

What is TOGAF?

``` The Open Group Architecture Framework Defines four model levels: Business Application Data Technology ```

Which NIST rule is related to selecting controls to categorize systems?

NIST 800-60

What is the standard for token ring?

802.5

What provides attribute based access control to provide authorization?

XACML

What is a non-proprietary standard for identifying vulnerabilities?

OVAL

What permission are around Freeware?

Software provided without charge, however there may be limitations on how it is supposed to be used.

Which backup is many small backups that all are required to recover?

Incremental

Which step of the DREAD model talks about how easy it is to launch the attacks?

Exploitability

What is NIST 800-60

Categorization, controls to categorize systems

What happens during the categorize step of the RMF?

Discovering, identifying, and assigning security roles to an IT system,

A computer is given an IP of 169.254.3.20, what caused this?

DHCP failure, APIPA

What is APIPA?

Automatic Private IP Addressing Self assigning an IP address in case of DHCP failure. 169.254.x.x range

What is a HumBot?

A human robot, a person who will manually perform activities in place of a computer.

What happens during the select step of the RMF?

Identify and choose the appropriate controls needed to reduce risk.

What does Fibre Channel over Ethernet do?

Replaces FC0 and FC1 layers with Ethernet Allows Fibre Channel to use 10 Gigabit ethernet networks while maintaining the fibre channel protocol Encapsulates Fibre Channel frames over ethernet networks

Freebie

Blank

What database organizes information as nodes, relationships, and properties?

Graph

What is a mutation fuzzer?

A dumb fuzzer that blindly fuzzes the input and doesn't understand the structure.

What are the steps in the penetration testing methodology?

Planning Discovery Attack Reporting

What part of the RMF involves discovering, identifying, and assigning security roles to an IT system?

Categorize

Which 'due' deals with activities and decisions?

Due Care

What happens during the montior step of the RMF?

Ongoing review and updating of controls and security status.

What is the difference in OAuth and OpenID?

OpenID is based on OAuth, however OpenID provides an ID token.

What business model has five guides?

ITIL

What part of the RMF involves having an independent party test the security controls?

Assess

What is RFC1918?

A group of internal IP ranges. 10. x.x.x 172. 16-31.x.x 192. 168.x.x

What happens during the authorize step of the RMF?

Management reviews a risk assessment and makes a risk determination on whether the risk is acceptable.

What does XACML provide?

Authorization

Which step of the DREAD model talks about the scope of the damage?

Affected Users

What is SLIP?

Serial line interface protocol | Provides TCP/IP over serial connection.

In what pen test phase are the scope and objectives defined?

Planning

What part of the RMF involves putting selected controls into place?

Implement

What is a CASB?

Cloud access security broker | A security enforcement point between the consumer and the cloud provider.

What is the name of the IP range assigned when DHCP fails?

APIPA

What are some tenets of ITIL?

It is best practicies on how to use IT as a tool to facilitate business change. Advocates that services must be aligned to the needs of the business. Has five core guides.

Which non-full backup type has the largest footprint?

Differential

Which application tier stores data?

Tier 3, data tier

What happens during the implement step of the RMF?

Put into place the selected security controls.

What part of the RMF involves choosing the appropriate controls needed to reduce risk?

Select

How many rounds does DEA perform on its data?

Which pen test phase occurs alongside the others?

Reporting

What is XACML

Extensible Access Control Markup Language Implements attribute based access control to determine whether a principal should be granted access to a system. Only provides authorization.