Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Test Study 4 > Flashcards

Test Study 4 Flashcards

1
Q

What is Type 2 XSS?

A

Persistent

Malicious scripts that are submitted and stored on the server to be presented to other users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What works on port 25?

A

SMTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What has an IP header of 51?

A

AH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the key concepts of Common Criteria?

A 
Target of Evaluation
Protection Profile
Security Functionality Requirements
Security Assurance Requirements
Evaluation Assurance Level
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What operates on port 515?

A

CUP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the trusted path?

A

A secure channel for system management activities to prevent imitation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is PRI in networking?

A

Primary Rate Interface ISDN, consists of 24 x 64 kb/s channels for a total of 1.544 Mb/s
Also known as T1 or E1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which standard certificate format is used most often by CAs?

A

PEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What port does SNMP work on?

A

161

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What packet has an IP header of 1?

A

ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What ISDN can provide speeds of at least 30 Mb/s?

A

E-3, T-3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What part of the TCB is responsible for handling user access requests?

A

Security kernel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What happens in the analyze step of continuous monitoring?

A

Analyze the data collected and report the findings and determine the appropriate response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the IP header for ESP?

A

50

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What RMF step includes reporting findings and determining the appropriate response?

A

Analyze and Report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What framework will provide an indication of maturity of security controls?

A

COBIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What operates on port 67/68

A

BootP / DHCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What happens in the review and update step of continuous monitoring?

A

Review and update the monitoring program, adjusting the strategy and maturing measurement capabilities to increase visibility into assets and awareness of vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the IP header for ICMP?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What port does SMTP work on?

A

25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What happens in the establish step of continuous monitoring?

A

Determine metrics, status monitoring frequencies, control assessment frequencies, and technical architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What provides digital network over voice cabling?

A

ISDN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What encryption method replaces characters based on a fixed number of positions away?

A

Shift cipher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What RMF step includes collecting security related information required for metrics?

A

Implement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the wireless standards that can operate at 5 ghz?

A
  1. 11a
  2. 11ac
  3. 11n
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the speeds of T-1, T-3, E-1, and E-3?

A

T-1 is 1.544 Mb/s
T-3 is 45 Mb/s
E-1 is 2.048 Mb/s
E-3 is 34.368 Mb/s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What works on port 143?

A

IMAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a capability table?

A

A list of subjects that are authorized to access a specific object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is PASTA?

A

Process for attack simulation and threat analysis

It’s a seven step risk oriented threat assessment methodology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the difference in S/MIME and PGP?

A

PGP relies on web of trust, S/MIME requires PKI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What protocol can apply encryption and digital signatures to email, and is compatible with a wide range of key management approaches?

A

MOSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What happens in the respond step of continuous monitoring?

A

Respond to findings with technical, management, and operational mitigating activities or acceptance, transference, or avoidance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the wireless standards and their ranges?

A 
5ghz
802.11a
802.11ac
2.5ghz
802.11b
802.11g
Both
802.11n
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is an ephemeral key?

A

a key generated based on all new parameters and randomized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a secure channel for system management?

A

Trusted Path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the reference monitor?

A

An abstract machine that is used to validate access to objects by authorized subjects. It operates at the boundary between the trusted and untrusted realm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is BR in networking?

A

Basic Rate ISDN, it consists of 2 x 64kb/s channels for a total of 128 kb/s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are the key principals of GDPR?

A 
Lawfulness, fairness and transparency.
    Purpose limitation.
    Data minimization.
    Accuracy.
    Storage limitation.
    Integrity and confidentiality (security)
    Accountability.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is a statement of importance?

A

A document derived from the BIA which is relevant to continuity plans.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is OCSP stapling?

A

The presenter of a certificate bears the resource cost involved in providing OCSP responses by appending a time-stamped OCSP response signed by the CA to the initial TLS handshake.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What works on port 110?

A

POP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is a tunneling protocol that works at the network layer that cannot handle its own encryption?

A

GRE

Generic Routing Encapsulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is material evidence?

A

Evidence that bears a significant relationship to the facts of the case.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is S/MIME?

A

Secure Multi Purpose Internet Mail Extentions

A protocol for sending digitally signed or encrypted email.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What operates on port 2049?

A

NFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are AH, UDP, ESP in long form?

A

Authentication Header
User Datagram Protocol
Encapsulation Security Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What port does LDAPS work on?

A

636

48
Q

What is the name of the process where the presenter of a certificate also provides a time-stamped and signed OCSP response to prove validity of a certificate?

A

Stapling

49
Q

What is a tunneling protocol that works at the data link layer that cannot handle its own encryption?

A

L2TP

50
Q

What operates on port 389?

A

LDAP

51
Q

What port does TFTP operate on?

A

69

52
Q

What port does POP work on?

A

110

53
Q

What is Common Criteria?

A

A standard/framework for security certification.

54
Q

What kind of key is generated based on all new parameters?

A

Ephemeral key

55
Q

What are the types and names of XSS?

A

Type 1 - Reflected

Type 2 - Persistent

56
Q

What operates on port 20?

A

FTP

57
Q

What is the ports for BootP?

A

67/68

58
Q

What is GRE?

A

Generic Routing Encapsulation

An old, layer 3 tunneling protocol that cannot do its own encryption.

59
Q

What port does NFS work on?

A

2049

60
Q

What are the wireless standards that can operate at 2.5ghz?

A
  1. 11b
  2. 11g
  3. 11n
61
Q

What is PEM?

A

A commonly used standard by CAs.

62
Q

Which XSS involves a user clicking on a bad hyperlink?

A

Type 1, Reflected

63
Q

What is the security kernel?

A

Handles all user/application requests for access to system resources. It enforces controls

64
Q

What is a shift cipher?

A

ROT-13, converts paintext by replacing it with another character a fixed number of positions away.

65
Q

What RMF step includes adjusting the strategy and maturing measurement capabilities?

A

Review and Update

66
Q

What is Type 1 XSS?

A

Reflected

Associated with a gullible user clicking a hyperlink with parameters in it

67
Q

What describes the rights a subject has to every object in the system?

A

Access control matrix

Rights management matrix

68
Q

What protocol can handle either point to point or tunneled communication by itself?

A

IPSEC

69
Q

What encryption method changes clear text into ciphertext on a letter by letter basis?

A

Cipher

70
Q

Which XSS involves malicious scripts being served up to the user?

A

Type 2, Persistent

71
Q

What describes the rights that subjects have to a specific object?

A

Capability Table

72
Q

Which is faster, T-1 or E-1?

A

E-1

73
Q

What is an ISDN?

A

Integrated services digital network, a digital network over voice cabling.

74
Q

What type of evidence bears a relationship to the facts of the case?

A

Material

75
Q

What type of evidence is reliable?

A

Competent

76
Q

What are the steps of the SDLC?

A 
Planning
Defining
Designing
Building / Developing
Testing
Deployment
77
Q

Which ISDN would be the minimum to support 30 Mb/s?

A

E-3

78
Q

What is PPTP?

A

Point to point tunneling

a vpn protocol that operates at the data link layer, largely in disuse, but can provide authentication and encryption.

79
Q

What ISDN format provides 128 kb/s?

A

BR

Basic Rate

80
Q

What port does LDAP work on?

A

389

81
Q

What is IPSEC?

A

A protocol to provide either point to point or tunneled communication and provide non-repudiation and confidentiality.

82
Q

What is COBIT?

A

A framework that will provide an indication of the maturity of security controls.

83
Q

What is the IP header for the AH?

A

51

84
Q

How does a cipher work?

A

Letter by letter basis

85
Q

What is the TCB and what are some of its properties?

A

Trusted Computing Base
The sum of all the protection mechanisms within a computer and is responsible for enforcing security policy.
Defined in the orange book
Includes hardware, software, and firmware
Higher TCB ratings require detailed testing procedures and documentation
TCB enforcement depends on parameters supplied by system admins

86
Q

What port does DHCP work on?

A

67

87
Q

What is a protocol for sending encrypted email?

A

S/MIME

88
Q

What operates on port 69?

A

TFTP

89
Q

What is a method that can be used to authenticate email to reduce phishing or spam?

A

DKIM

90
Q

What happens in the implement step of continuous monitoring?

A

Implement a continuous monitoring program and collect the security related information required for metrics, assessments and reporting. Automate where possible

91
Q

What RMF step includes determining metrics and control assessment frequencies?

A

Establish

92
Q

What ISDN format provides up to 1.544 Mb/s

A

PRI or T1

93
Q

What is DKIM?

A

Domain Keys Identified Mail

A method used to authenticate email so as to minimize phishing and spam

94
Q

What is L2TP

A

Layer 2 Tunneling Protocol
An extension of PPTP, it is designed to encapsulate messages for constructing a tunnel but relies on other protocols for encryption

95
Q

What is the IP header for UDP?

A

17

96
Q

What RMF continuous monitoring step includes a formulating a strategy based on risk tolerance?

A

Define

97
Q

What is PPP

A

Point to point protocol

Deprecated protocol for encapsulation of data between permiters.

98
Q

What is an access control matrix and what is it also known as?

A

Rights management matrix

A model that describes the rights of each subject with respect to every object in the system.

99
Q

What is the port for FTP?

A

20

100
Q

What is relevant evidence?

A

Evidence that is of consequence to the determination of the outcome of the case.

101
Q

What operates on port 636

A

LDAPS

102
Q

What are the steps in continuous monitoring?

A 
Define
Establish
Implement
Analyze and Report
Respond
Review and Update
103
Q

What continuous monitoring step includes handling findings via mitigation, acceptance, transference, or avoidance?

A

Respond

104
Q

What port does CUP operate on? And what is CUP?

A

515, common unix printer

105
Q

What port does IMAP work on?

A

143

106
Q

What packet has an IP header of 17?

A

UDP

107
Q

What is a seven step process for threat analysis and attack simulation?

A

PASTA

108
Q

What has an IP header of 50?

A

ESP

109
Q

What part of the TCB is responsible for validating access?

A

Reference monitor

110
Q

What is a protocol that works at the data link layer that can provide encryption?

A

PPTP

111
Q

What is Competent evidence?

A

Evidence that is reliable.

112
Q

What works on port 161?

A

SNMP

113
Q

What happens in the define step of continuous monitoring?

A

Define a strategy based on risk tolerance that maintains clear visibility into assets, awareness of vulnerabilities, up to date threat information, and mission/business impacts.

114
Q

What is a deprecated protocol intended to operate between perimeters?

A

PPP or point to point

115
Q

What type of evidence is consequential to the outcome of the case?

A

Relevant

116
Q

What is MOSS?

A

MIME Object Security Services
A protocol that can apply encryption and digital signatures to MIME objects. It is also intended to be compatible with a wide range of public key management approaches

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions