Total seminars Flashcards

Question

What is bounds checking?

Answer 1

Any method of detecting whether a variable is within some bounds before it is used.

Answer 2

An information security management system. It defines the controls an organization needs to implement.

Answer 3

The network standard for MAN networks, to include Wimax.

Answer 4

The standard for Personal Area Networks.

Answer 5

Another name for a one-time pad.

Answer 6

Protection level.

Answer 7

CRC can detect errors in data transmission.

Answer 8

Key performance indicators measure how well things are going currently, while key risk indicators measure how badly things could go in the future.

Answer 9

Cohesion reflects how many different types of tasks a module can carry out. If a module carries out only one task (e.g., subtraction) or tasks that are very similar (e.g., subtraction, addition, multiplication), it is described as having high cohesion, which is a good thing. The higher the cohesion, the easier it is to update or modify the module and not affect other modules that interact with it.

Answer 10

An island-hopping attack is one in which the attacker compromises an easier target that is somehow connected to the more desirable ultimate target, which the attacker then goes after. The attacker jumps from computer to computer until they reach the ultimate, more desirable target.

Answer 11

The continuing effectiveness of controls to protect assets is carefully monitored to ensure that they maintain their protection in the face of a changing threat environment.

Answer 12

A fault tree analysis usually proves to be a useful approach to identifying failures that can take place within more complex environments and systems. Fault tree analysis follows this general process. First, an undesired effect is taken as the root or top event of a tree of logic. Then, each situation that has the potential to cause that effect is added to the tree as a series of logic expressions. Fault trees are then labeled with actual numbers pertaining to failure probabilities. This is typically done by using computer programs that can calculate the failure probabilities from a fault tree.

Answer 13

The security assessment strategy guides the development of standard testing and assessment procedures. This standardization is important because it ensures these activities are done in a consistent, repeatable, and cost-effective manner.

Answer 14

A compliance check is a test or assessment designed to determine if a control or security process complies with governance requirements. It might involve any other type of test, but its purpose is to determine compliance with standards.

Answer 15

The organization should start its assessment process by conducting a vulnerability assessment, to determine any obvious weaknesses in the security control infrastructure. Then the organization should conduct a penetration test to see which of these vulnerabilities could be exploited. After mitigating the security control vulnerabilities, the organization should undergo a compliance audit to make sure that it meets the requirements of the governing body regulating protected healthcare information.

Answer 16

Kanban is an Agile development methodology that stresses visual tracking of all tasks so that the team knows what to prioritize at what point in time in order to deliver the right features right on time. Kanban projects used to be very noticeable because entire walls in conference rooms would be covered in sticky notes representing the various tasks that the team was tracking. Nowadays, many Kanban teams opt for virtual walls on online systems.

Answer 17

Extreme Programming (XP) is an Agile development methodology that takes code reviews to the extreme (hence the name) by having them take place continuously. Extreme Programming (XP) is an Agile development methodology that relies on test-driven development, in which the unit tests are written before the code. The programmer first writes a new unit test case, which fails because there is no code to satisfy it. The next step is to add just enough code to get the test to pass.

Answer 18

Scrum is an Agile methodology that acknowledges the fact that customer needs cannot be completely understood and will change over time. It focuses on team collaboration, customer involvement, and continuous delivery.

Answer 19

A covert channel is the act of using an unintended communication path to send and receive messages. It is a way for an entity to receive information in an unauthorized manner. In a covert timing channel, one process relays information to another by modulating its use of system resources.

Answer 20

Inventory control, secure object permissions assigned to media, and authorized access to physical media are all important elements that should be included in a media management and protection policy.

Answer 21

An informative policy is meant to educate employees about events, new developments, or changes within the organization. The message is purely one-way, meaning employees are not responsible for doing anything after reading the document. An example would be a document that explains how a company interacts with partners, the company’s goals and mission, or a general reporting structure in different situations.

Answer 22

Fitness for purpose.

Answer 23

Cost approach, income approach, or market approach.

Answer 24

Awareness answers the question “what” and gives employees initial knowledge about a topic. Training presents the detailed “how” of a topic, and education answers the “why” questions of a topic.

Answer 25

Rule-based access control is commonly used in conjunction with other models and is typically found on resources or devices, such as files, shares, printers, firewalls, routers, and so on, and prescribes rules for traffic entering and leaving those devices.

Answer 26

A control zone is an area that has been split up based on its respective level of sensitivity. Access controls should be chosen for each zone based on the criticality of devices and the sensitivity of data being processed.

Answer 27

The main difference between memory cards and smart cards is their capacity to process information. Memory cards hold information but cannot process information. Smart cards hold information and have the necessary hardware and software to actually process that information.

Answer 28

In the United States, a company must file paperwork with the USPTO between the fifth and sixth years showing that it is actually using the trademark. This means that you can’t just create a trademark you don’t ever use and keep others from using it. Another “Declaration of Use” must be filed between the ninth and tenth year, and then every nine to ten years thereafter.

Answer 29

Simple Object Access Protocol (SOAP) is a specification that outlines how information pertaining to web services is exchanged in a structured manner. It provides the basic messaging framework, which allows users to request a service and, in exchange, the service is made available to that user. SOAP can work with many other application layer protocols beyond just Hypertext Transfer Protocol (HTTP).

Answer 30

Most systems do not use the actual passphrase or password the user enters. Instead, they put this value through some type of encryption or hashing function to come up with another format of that value, referred to as a virtual password.

Answer 31

The international standard on digital evidence handling is ISO/IEC 27037, Guidelines for Identification, Collection, Acquisition, and Preservation of Digital Evidence. This document identifies four phases of evidence handling: identification, collection, acquisition, and preservation.

Answer 32

A community string is basically a password a manager uses to request data from the agent, and there are two main community strings with different levels of access: read-only and read-write. As the names imply, the read-only community string allows a manager to read data held within a device’s Management Information Base (MIB), and the read-write string allows a manager to read the data and modify it.

Answer 33

The most common implementation of discretionary access control (DAC) is through access control lists (ACLs), which are dictated and set by the owners and enforced by the operating system. When you look at the properties of a file or directory and see the choices that allow you to control which users can have access to this resource and to what degree, you are witnessing an instance of ACLs enforcing a DAC model.

Answer 34

Dual-homed refers to a device that has two interfaces: one connected to one network and the other connected to a different network. Dual-homed (as well as multihomed, which have several network interface cards spanning multiple networks) devices can filter traffic between the two networks. A single-homed device only has one network interface card and is attached to only one network.

Answer 35

When considering KRIs, it is useful to relate them to single loss expectancy (SLE) equations. The SLE is the organization’s potential monetary loss if a specific threat were to be realized. It is the product of the loss and the likelihood that the threat will occur. A change in a KRI equates to a change in the likelihood that a specific threat will be realized, increasing the risk of a loss.

Answer 36

Wi-Fi Protected Access 3 (WPA3) is an improved protocol from the WPA2 standard. WPA3 Enterprise is similar to its predecessor but makes use of stronger cryptography by restricting the allowed algorithms to a handful of strong ones that use 192-bit keys. WPA3 Personal employs Simultaneous Authentication of Equals (SAE), which uses the Diffie-Hellman key exchange method but adds an authentication element based on the (potentially weak) password.

Answer 37

Substitution boxes, or S-boxes, are used within block ciphers. S-boxes contain lookup tables to determine how a block of data is encrypted or decrypted. The key is used to decide which S-box to utilize with each block. Stream ciphers use keystream generators, which produce a stream of bits that is XORed with the plaintext bits to produce ciphertext.

Answer 38

Important considerations for developing a strategy to test data backups are as follows: develop threat scenarios, develop a plan to test backups, leverage automation, minimize impact on business processes, ensure coverage so that every system is tested, document results, and fix or improve any issues.

Answer 39

A security plan is developed at the beginning of a development project and integrated into the functional plan to ensure that security is not overlooked. The security plan often includes computer standards, documents developed in previous projects, security policies, accreditation statements, incident-handling plans, and national or international guidelines.

Answer 40

Each directory service has a way of identifying and naming the objects it will manage. In databases based on the X.500 standard that are accessed by the Lightweight Directory Access Protocol (LDAP), the directory service assigns distinguished names (DNs) to each object.

Answer 41

The first generation of programming languages introduced machine language, which is a format that the computer’s processor can understand and work with directly. Second-generation languages included hardware-specific symbolic representation of machine language instruction. Assembly language. Third generation was more programmer friendly. C++, Java, etc. Fourth-generation languages include very high-level languages and domain-specific languages such as database management, web development, etc. Examples include SQL and HTML. Fifth-generation programming languages include knowledge-based programming, artificial intelligence, and natural language constructs.

Answer 42

A database management system (DBMS) is a software system that allows you to efficiently create, read, update, and delete (CRUD) any given set of data. It is optimized for efficient storage of data, which means that, unlike flat files, it gives you ways to optimize the storage of all your information.

Answer 43

IPv4 limits packets to 65,535 bytes of payload, and IPv6 extends this size to 4,294,967,295 bytes. These larger packets are referred to as jumbograms and improve performance over high-MTU (maximum transmission unit) links, which have increased as newer technologies have evolved. An IPv6 jumbogram is an IPv6 packet carrying a payload larger than 65,535 bytes.

Answer 44

Direct sequence spread spectrum (DSSS) is a frequency management technology primarily used in IEEE 802.11 wireless networks.

Answer 45

Frequency hoping spread spectrum, used in wireless networks.

Answer 46

Pin tumbler locks (the most commonly used tumbler lock) require the key to have just the right grooves to put all the spring-loaded pins in the right position so the lock can be locked or unlocked.

Answer 47

Cipher locks, also known as programmable locks, are keyless and use keypads to control access into an area or facility. The lock requires a specific combination to be entered into the keypad and possibly a swipe card. Cipher locks cost more than traditional locks, but their combinations can be changed, specific combination sequence values can be locked out, and personnel who are in trouble or under duress can enter a specific code that will open the door and initiate a remote alarm at the same time.

Answer 48

Wafer tumbler locks (also called disc tumbler locks) are the small, round locks you usually see on file cabinets. They use flat discs (wafers) instead of pins inside the locks. They often are used as car and desk locks. This type of lock does not provide much protection because it can be easily circumvented.

Answer 49

Combination locks require the correct combination of numbers to unlock them, not a key. These locks have internal wheels that have to line up properly before being unlocked. A user spins the lock interface left and right by so many clicks, which lines up the internal wheels. Once the correct turns have taken place, all the wheels are in the right position for the lock to release and open the door.

Answer 50

Basic Rate Interface (BRI) Integrated Services Digital Network (ISDN) service provides two data (also called bearer, or B) channels (at 64 Kbps each), and one D, or control, channel (at 16 Kbps). Data is transferred over B channels and the call setup, maintenance, and teardown takes place over the D channel. Primary Rate Interface (PRI) ISDN service provides 23 B channels and one D channel. BRI ISDN is generally used for home and small office subscribers. Note that ISDN is an obsolescent pure digital technology that uses legacy phone lines for both voice and data.

Answer 51

Cognitive passwords are fact- or opinion-based information used to verify an individual’s identity. A user is enrolled by answering several questions based on her life experiences.

Answer 52

Third-party software development security can be achieved through trust in the third-party developer’s processes, as well as contractual agreements between the organization and the third party.

Answer 53

In SPML (Services Provisioning Markup Language), Provisioning Service Provider (PSP) is the software that responds to the account requests. The Requesting Authority (RA) is the entity that is making the request to set up a new account or make changes to an existing account. The Provisioning Service Target (PST) is the entity that carries out the provisioning activities on the requested system.

Answer 54

The Spiral methodology uses an iterative approach to software development and places emphasis on risk analysis. The methodology is made up of four main phases: determine objectives, risk analysis, development and test, and plan the next iteration.

Answer 55

The Waterfall methodology uses a linear-sequential life-cycle approach where all requirements are gathered in the initial phase and there is no formal way to integrate changes as more information becomes available or requirements change. This methodology doesn’t use prototyping.

Answer 56

When using the Incremental methodology, each incremental phase results in a deliverable that is an operational product. The Incremental methodology is not based upon risk analysis processes.

Answer 57

Breach and attack simulations (BAS) are automated systems that launch simulated attacks against a target environment and then generate reports on their findings. They are meant to be realistic but not cause any adverse effect to the target systems. For example, a ransomware simulation might use “defanged” malware that looks and propagates just like the real thing but, when successful, will only encrypt a sample file on a target host as a proof of concept.

Answer 58

A synthetic transaction is a script that runs to emulate the actions of a real person performing transactions on the system. The usefulness of synthetic transactions is that they allow security professionals to systematically test the behavior and performance of critical services.

Answer 59

The Center for Internet Security (CIS) Controls categorizes controls into basic, foundational, and organizational controls based on the criticality of implementation. The CIS Controls can also be scaled using three implementation groups, geared toward small, medium, and large organizations.

Answer 60

Message authentication code (MAC) uses a symmetric key and a hashing algorithm and provides system authentication and integrity. It is a cryptographic checksum.

Answer 61

Within the Initial level (maturity level 1), the development process is unpredictable and reactive. Work gets completed but is often delayed and over budget. (Source: CMMI Institute, https://cmmiinstitute.com/learning/appraisals/levels). Within the Managed level (maturity level 2), work is managed on the project level. Projects are planned, performed, measured, and controlled. (Source: CMMI Institute, https://cmmiinstitute.com/learning/appraisals/levels) Within the Defined level (maturity level 3), projects are proactive rather than reactive. Organization-wide standards provide guidance across projects, programs, and portfolios. (Source: CMMI Institute, https://cmmiinstitute.com/learning/appraisals/levels). Level 4: Quantitatively Managed Measured and controlled. Organization is data-driven with quantitative performance improvement objectives that are predictable and align to meet the needs of internal and external stakeholders. Within the Optimizing level (maturity level 5), projects are stable and flexible. The organization is focused on continuous improvement and is built to pivot and respond to opportunity and change. The organization’s stability provides a platform for agility and innovation. (Source: CMMI Institute, https://cmmiinstitute.com/learning/appraisals/levels)

Answer 62

The reference monitor is an abstract machine that mediates all access subjects have to objects, both to ensure that the subjects have the necessary access rights and to protect the objects from unauthorized access and destructive modification. It is an access control concept, not an actual physical component, which is why it is normally referred to as the “reference monitor concept” or an “abstract machine.”

Answer 63

An authoritative system of record (ASOR) is a hierarchical tree-like structure system that tracks subjects and their authorization chains. The ASOR should contain the subject’s name, associated accounts, authorization history per account, and provision details.

Answer 64

An indicator is a particularly important metric that describes a key element of the effectiveness of a system, such as an information security management system (ISMS). In other words, indicators are meaningful to business leaders. If one of management’s goals is to minimize the number of high-severity incidents, then an indicator could be the ratio of such incidents declared during a reporting period compared to an established baseline. A metric is a derived value that is generated by comparing multiple measurements against each other or against a baseline. Metrics are, by their very nature, comparative. An effective metric could be the ratio of verified incidents to intrusion detection system (IDS) alerts during a 30-day period. A measurement is a quantitative observation of a factor at a particular point in time. In other words, this is raw data. Two examples of measurements would be 356 intrusion detection system (IDS) alerts in the last 24 hours and 42 verified events investigated by the incident response team in the month of January. A factor is an attribute of a system, such as an information security management system (ISMS), that has a value that can change over time. Examples of factors are the number of alerts generated by an intrusion detection system (IDS) or the number of events investigated by the incident response team.

Answer 65

Sealing is the process of encrypting the data for a system’s specific hardware and software configuration and storing it on the Trusted Platform Module (TPM). This method is used to prevent tampering with hardware and software components to circumvent security mechanisms. If the drive or system is tampered with, the drive cannot be accessed.

Answer 66

Regression testing retests after a change to software or a system to ensure functionality, performance, and protection.

Answer 67

Integration testing verifies that components work together as outlined in design specifications.

Answer 68

Acceptance testing ensures that the code meets customer requirements.

Answer 69

Unit testing tests individual components in a controlled environment where programmers validate data structure, logic, and boundary conditions.

Answer 70

Sherwood Applied Business Security Architecture (SABSA) slices an enterprise into different layers so that security can be more focused and precise. The model is made up of six layers. Each layer represents a different view of the organization and the types of security controls that need to be put into place.

Answer 71

Deferred commitment refers to the benefit of OOP of being able to redefine internal components of an object without changing other parts of the system, which is an advantage over procedural programming.

Answer 72

Modularity refers to the benefit of OOP of having building blocks of software that are autonomous objects, cooperating through the exchange of messages.

Answer 73

Reusability refers to the benefit of OOP of having classes that are reused by other programs, though they may be refined through inheritance.

Answer 74

Naturalness refers to the benefit of OOP of being able to map object-oriented analysis, design, and modeling to business needs and solutions.

Answer 75

The change control analyst is responsible for approving or rejecting requests to make changes to the network, systems, or software. This role must make certain that the change will not introduce any vulnerabilities, that it has been rigorously tested, and that it is properly rolled out. While not necessarily a security role, the change control analyst needs to understand how various changes can affect security, interoperability, performance, and productivity.

Answer 76

The four essential characteristics of good threat intelligence, known by the acronym CART, are complete, accurate, relevant, and timely. Historical is not one of those essential characteristics, since that could circumvent the timely characteristics of good intelligence.

Answer 77

802.11a works in the 5-GHz range and provides a faster data transfer speed than 802.11b.

Answer 78

Attenuation is the loss of signal strength as it travels. Regardless of which type of cabling is used, attenuation is inevitable given a long enough distance, which is why repeaters were invented.

Answer 79

Parameter validation is the primary security issue with APIs

Answer 80

The keyspace equals 2 to the nth power, n being the size of the key

Answer 81

the Telephone Records and Privacy Protection Act of 2006 imposes stiff criminal penalties on anyone who uses pretexting to obtain confidential information.

Answer 82

Computer-aided software engineering (CASE) refers to any type of software tool that supports automated development of software, which can come in the form of program editors, debuggers, code analyzers, version-control mechanisms, and more.

Answer 83

IPSec Transport mode is used on a local area network. VPN implementations use tunnel mode.

Answer 84

End-to-end encryption (E2EE) works at the application layer of the OSI model. Because it works with higher layer protocols, it cannot protect IP headers or data.

Answer 85

Point-to-point Tunneling Protocol (PPTP) works at the data link layer of the OSI model. PPTP provides no protection for IP headers or data payloads and does not work with IPSec. It uses the Microsoft Point-To-Point Encryption (MPPE) protocol for encryption services.

Answer 86

Transport Layer Security (TLS) works at the session layer of the OSI model. It does not protect IP headers and payloads.

Answer 87

Transport Layer Security (TLS) uses digital certificates to verify the identity of one or both endpoints in a transmission.

Answer 88

Software-defined security refers to applications that perform security functions and make quick, dynamic security decisions in areas such as advanced traffic filtering, intrusion detection and response, and malware analysis and containment.

Answer 89

ITIL 4 blends all parts of an organization using a four-dimensional model built around the concept of value for the stakeholders. The dimensions in this model are organizations and people, value streams and processes, information and technology, and partners and suppliers. These exist in a broader context that is influenced by factors that can be political, economic, social, technological, legal or environmental. Effective organizations must consider all four dimensions within their broader context when planning, developing, and offering products and/or services if they are to provide value.

Answer 90

Synchronous Optical Networking (SONET) or Fiber Distributed Data Interface (FDDI) rings

Answer 91

A covert timing channel modulates the operating system’s resources, which allows for communication between two processes. This is an example of a covert communication channel.

Answer 92

The Wassenaar Arrangement is an agreement among numerous countries (currently 42 signatories) to control the export of certain types of sensitive items and technologies to agreed-upon “terrorist countries” (countries identified by the signatories as having connections with terrorist groups and activities). The agreed-upon controls do not apply to products that can be downloaded from the Internet.

Answer 93

Orthogonal frequency division multiple access (OFDMA) is derived from a combination of FDMA and TDMA. In OFDMA, each of the channels is subdivided into a set of closely spaced orthogonal frequencies with narrow bandwidths (subchannels). Each of the different subchannels can be transmitted and received simultaneously in a multiple input, multiple output (MIMO) manner.

Answer 94

Sometimes developers include lines of code in a product that will allow them to do a few keystrokes and get right into the application. This allows them to bypass any security and access controls so they can quickly access the application’s core components. This is referred to as a “back door” or “maintenance hook” and must be removed before the code goes into production.

Answer 95

ISO/IEC 27037, the international standard on digital evidence handling, identifies four phases of evidence handling: identification, collection, acquisition, and preservation. —The first step is to identify the digital crime scene. Evidence will exist in a multitude of devices such as routers, network appliances, cloud services, smartphones, and even IoT devices. —Evidence collection is the process of gaining physical control over devices that could potentially have evidentiary value. A chain of custody documents each person that has control of the evidence at every point in time. In large investigations, one person may collect evidence, another transport it, and a third store it. Keeping track of all these individuals is critical to proving in court that the evidence was not tampered with. —Acquisition means creating a forensic image of digital data for examination. Generally there are two types of acquisition: physical and logical. In digital acquisition, the investigator makes a bit-for-bit copy of the contents of a physical storage device, bypassing the operating system. This includes all files, but also free space and previously deleted data. In a logical acquisition, on the other hand, the forensic image is of the files and folders in a file system, which relies on the operating system. —Preservation of evidence in a forensically sound manner requires established procedures based on legally accepted best practices. This includes ensuring that only a small group of qualified individuals have access to the evidence, and then only to perform specific functions. This also includes procedures such as two-person control and secure media storage.

Answer 96

Boundary conditions are test cases that occur between data communication points during interface tests.

Answer 97

The ITU-T H.323 recommendation is a standard that deals with audio and video calls over packet-based networks. H.323 defines four types of components: terminals, gateways, multipoint control units, and gatekeepers. H.323 doesn’t set up and break down call sessions or provide phone-line features.

Answer 98

Spanning Tree Protocol (STP) ensures that frames do not circle networks forever, provides redundant paths in case a bridge goes down, assigns unique identifiers to each bridge, assigns priority values to these bridges, and calculates path costs. STP also enables an administrator to indicate whether traffic should travel certain paths instead of others. Newer bridges implement the Shortest Path Bridging (SPB) protocol, which is defined in IEEE 802.1aq and is more efficient and scalable than STP.

Answer 99

The ratio of real power to apparent power is called the work factor, which can never be greater than one (since the denominator is the ideal apparent power).

Answer 100

Volts measures the potential electric force between two points in a circuit. Amps measures the actual electric flow through the circuit, also called current. Watts measures electrical power and is calculated by multiplying voltage by amperage.