Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Weaknesses 3-22 > Flashcards

Weaknesses 3-22 Flashcards

1
Q

What type of security mechanism is used in ActiveX?

A

Digital Signature?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What type of attack redirects victim from legitimate websites to fake websites using DNS poisoning?

A

Pharming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which security model incorporates “no write up” and “no read down” rules?

A

Biba

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The Biba model is focused on protecting Confidentiality or Integrity?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Downstream liabilities are the result of what?

A

Shared networks with external entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ITSEC criteria uses what two letters for ratings?

A

E-F

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Orange book uses what letter range for ratings?

A

A-D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

TRUE/FALSE - Budget expenses by individuals are considered personal data

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Phase Alternative Line is a standard that provides requirements for monitors used with what?

A

CCTVs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

TRUE/FALSE - Fire extinguishers should be inspected yearly

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How many address bits does IPv6 have?

A

128

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When are computer files no longer considered hearsay evidence?

A

When the computer output is done during regular business hours

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Halon fire extinguishers are restricted and need to be replaced with what?

A

FM-200

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The purpose of plenum cabling is to protect what?

A

Human safety

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do plenum cables protect human safety

A

By releasing nontoxic chemicals when burned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Trued system design in components is essential for what CIA purpose?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Multi-threading means a computer can do what?

A

Run and process multiple requests at one time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a common omission and mistake companies make with their security policies?

A

Penalties for noncompliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Fire extinguishers should be within how many feet of electrical equipment?

A

50

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A systematic approach to determine how different threats could be successful is what?

A

Threat modeling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

VLAN hopping by means of modifying frame-tag values is possible with what type of rogue device?

A

A switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the first step in disaster recover and contingency planning?

A

Perform a business impact analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

TRUE/FALSE - It is the responsibility of the business continuity committee to ensure budgets are on track

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A KRI is a metric that indications when what?

A

A risk exceeds a threshhold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What type of architecture provides web-based distributed computing technology in distinct units?

A

Service-Oriented Architecture (SOA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Allowing one object to have two security classifications requires what?

A

Polyinstantiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

EJC provides interfaces and methods to allow different applications to communicate across what kind of environment?

A

Networked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

False Rejection Rate is a Type I or Type II error?

A

Type 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A Type II error is also known as what?

A

False Acceptance Rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Use and misuse cases are commonly depicted using what language?

A

Unified Modeling Language (UML)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the different between a fraggle attack and smurf attack?

A

Fraggle attack uses UDP instead of ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

BGP protocol lives within what TCP/IP model layer?

A

Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What type of policies are usually directives devised by management to protect individual systems?

A

System-specific

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

185 meters is the limit of what kind of cable?

A

10Base2 or Thin Net

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The exchange point between systems and users is called what?

A

User interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The process of producing for a court all electronically stored information relevant to legal cases is called what?

A

e-Discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What type of token device is driven by time or events?

A

Synchronous token device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

TRUE/FALSE - Synchronous token devices are challenge-based

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

In terms of Stratum’s, what level is the most authoritative?

A

Stratum 0

40
Q

The Red book addresses what?

A

Network components and products

41
Q

The qualitative identification of susceptibility that can increase the business or productivity impact of threat events is also referred to as what?

A

Vulnerability assessment

42
Q

COBIT is commonly used to meet the objectives of what framework?

A

COSO

43
Q

Government agencies commonly use what encryption device based on IPSec?

A

High Assurance Internet Protocol Encrypter (HAIPE)

44
Q

Remote Journaling is an automatic function that does what?

A

Sends transaction logs of backed up files to offsite location

45
Q

The security kernel consists of what?

A

Software, hardware, and firmware

46
Q

Continuity of Operations (COOP) focuses on what?

A

Restoring an organizations essential functions at an alternate site and performing those functions for up to 30 days

47
Q

In an ISDN connection, which wire sends data and which receives?

A

B channels send data, D channels send control information

48
Q

TRUE/FALSE - As long as employees are notified, a company can implement keyboard monitoring without consent?

A

TRUE

49
Q

What port does Network Time Protocol (NTP) use?

A

UDP 123

50
Q

A university might use what type of network architecture to connect different buildings?

A

MAN

51
Q

Where does the SPX protocol reside in the TCP/IP model?

A

Host-to-host

52
Q

In software development, the more a module can do on it’s on is better and is referred to as higher what?

A

Cohesion

53
Q

Modules should aim for what level of cohesiveness and coupling?

A

Highly cohesive, low coupling

54
Q

Interference can be prevented with what technique in a database?

A

Polyinstantiation

55
Q

Polymorphism is the act of what?

A

Two objects responding differently to the same command

56
Q

Unit testing occurs in what software development phase?

A

Development

57
Q

Air Gapping is commonly used to protect what?

A

Code repositories

58
Q

What type of virutal firewall monitors individual traffic links?

A

Bridge-mode

59
Q

In SNMP a community string is similar to what protection mechanism?

A

Password generator

60
Q

What range is the list of well known ports?

A

0-123

61
Q

What is a physical layer standard for fiber-optic lines?

A

SONET

62
Q

Modern bridges are more advanced and can work at what two OSI model layers?

A

Data link and Network

63
Q

IBM Mainframes used what polling protocol?

A

Synchronous Data Link Control (SDLC)

64
Q

IPng is another term for what new IP protocol?

A

IPv6

65
Q

TRUE/FALSE - IPv6 requires NAT

A

FALSE

66
Q

What 802.11 standard provides QoS?

A

802.11e

67
Q

High Level Data Link Control (HDLC) is based upon SDLC and improves it how?

A

Full duplex and higher throughput

68
Q

What two OSI layers correspond to the Network Access layer in the TCP/IP model?

A

Data Link and Physical

69
Q

The OSI Transport directly maps to which TCP/IP layer?

A

Host-to-host

70
Q

TCP and UDP work at what layer in the OSI / TCIP/IP models?

A

Transport or Host-to-Host

71
Q

TRUE/FALSE - Protocols at the Network Layer do not ensure the delivery of packets

A

TRUE

72
Q

ICMP, RIP, OSFP, BGP, and IGMP all live at what layer of the OSI and TCP/IP model?

A

Network and Internet

73
Q

The 802.X standards live at what OSI layer?

A

Data Link

74
Q

Carrier Sense Multiple Action / Collision Detection (CSMA/CD) determines what?

A

When the best time to send and transmit data is

75
Q

CMSA/CA differs from CSMA/CD how?

A

Computers will signal intent to send data

76
Q

What temperature does most electronic equipment suffer major damage?

A

175 F

77
Q

What type of IDS can detect new attacks not previously identified?

A

Behavior based

78
Q

TRUE/FALSE - Compliance testing occurs during disaster recovery and BCP testing plans

A

FALSE

79
Q

A formal meeting of senior organizational leaders to determine whether management systems are performing effectively is known as what?

A

Management Review

80
Q

What type of data mining identifies relationships between data elements and uses rule discovery?

A

Statistical

81
Q

What is the first step in preventing data loss / leakage?

A

Perform data inventory

82
Q

How often should disaster recovery and BCP plans be tested?

A

At least annually, or as changes occur

83
Q

What is a common illumination metric used for lighting?

A

Two foot candles

84
Q

What kind of loss can a company experience after a disgruntled worker deletes files or information regarding customer accounts?

A

Delayed loss

85
Q

MD2 produces a hash of what size?

A

128-bit

86
Q

What security technology uses and measures magnetic fields for variations?

A

Proximity

87
Q

When a computer cannot carry out its task either intentional or accidentally it is referred to as what?

A

Compromise

88
Q

Priveleged Attribute Certificates (PACs) are used in what environment?

A

SESAME

89
Q

A security mechanism used to take a copy of an object and repopulate it with different data, used often for multiple classifications is referred to as what?

A

Polyinstiantiation

90
Q

A race condition exists when what happens in a program?

A

The program goes into a vulnerable state before ensuring the vulnerable conditions are mitigated

91
Q

What is derived from a passphrase?

A

Virtual password

92
Q

Identifying feasible adverse effects on our assets is also referred to as what?

A

Threat modeling

93
Q

In regards to virtual machines and firewalls, a hypervisor allows for monitoring of what?

A

All activities on a host machine

94
Q

TRUE/FALSE - AES is symmetric

A

TRUE

95
Q

What term is commonly interchanged with hacker, but more specifically refers to a person?

A

Cracker

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions