Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP (MY CISSP) > Wiley_08092017 > Flashcards

Wiley_08092017 Flashcards

1
Q

________ designed by Visa and Mastercard used by E-Commerce Security

A

S E T, SET, Secure Electronic Transaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

securely CREATE and DELETE of subjects and objects..

Graham Denning – Create and Delete…

A

GRAHAM-DENNING: Graham Denning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

dfd

A

dfd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The ________model addresses DATA INTEGRITY and is based on the idea of defining a set of system states, initial states, and state transitions. Through the use of and limitations to only these predetermined secure states, integrity is maintained and interference is prohibited…
SUTHERLAND… STATE MACHINE MODEL…. INTEGRITY

A

SUTHERLAND

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The _____model addresses DATA INTEGRITY. This is a MULTILEVEL model is a state machine concept that is based on FLOW.
Uses * STAR and SIMPLE states. STAR – No WRITE UP.. SIMPLE – No READ DOWN….
BIBA..MULTILEVEL..INTEGRITY…

A

BIBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

This model is..Dynamic based on previous activity. ..
This requires the following to operate properly:
1) properly identified subjects,
2) one or more datasets,
3) conflict class definitions for all datasets

(A K A Chinese Wall) is based on dynamic changes of user privileges and access based on users previous activity..

A

Brewer Nash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

BELL-LAPADULA: The Bell-Lapudal model addresses CONFIDENTIALITY only. A subject cannot read an object at a higher level. …. A trusted subject can violate the star property of “no write down” in the act of declassification, which is not an actual violation of security..
Bell-Lapadula ..subject cannot read at a higher level…

A

Bell Lapadula

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

GRAHAM-DENNING: Graham Denning securely CREATE and DELETE of subjects and objects..
Graham Denning – Create and Delete…

A

Denning is Create and Delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A ONE TIME pad is a type of ________ CIPHER. A ONE TIME KEY IS EXTREMELY LONG.
.
PROS OF SYMMETRIC…QUICK … SPEED 1,000 to 10000 times faster…..
CONS OF ASYMMETRIC…SLOW…

A

STREAMING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A ONE TIME pad does not have a ________pattern.

A

repeated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CONS of SYMMETRIC CRYPTO.

A

KEY EXCHANGE “Out of Band”….

DOES NOT SUPPORT NONREPUDIATION….

NOT SCALABLE…..

KEYS NEED TO BE GENERATED OFTEN…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

PROS of SYMMETRIC CRYPTOGROPHY

A

FAST, 1000 to 10000 faster than ASYMMETRIC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CONS OF ASYMMETRIC

A

SLOW

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

PROS of ASYMMETRIC…

A

Provides CONFIDENTIALITY, INTEGRITY, AUTHORIZATION, NON REPUDIATION

KEY EXCHANGE IS SIMPLE…..SCALABLE..C I A N…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

3 COMPOSITION THEORIES: Input and output flow between systems.

A

Cascading, feedback, and hookup are the three composition theories. Cascading, feedback, and hookup are the three composition theories…..

Cascading, feedback, and hookup are the three composition theories..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

3 Composition Theories Explained:

A

Cascading..Input from output from another system..

Feedback…One system provides input to another system which reciprocates..System A to B..then B back to A…

Hookup…One system to another, but also sends to an EXTERNAL system…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

PROTECTION RING: Created 1963 – 1969 by Bell, M I T, G E. For Multics O S. This is an O S protection model.

A

Ring model is PRIORITY, PRIV, MEMORY SEGMENTATION..

Ring 0 ..has direct access to the most resources..ring 0 has FULL Rights…O S Kernel/Memory.

Ring 1.. other O S components..

Ring 2..Drivers and Protocols…

Ring 3 is user mode…Programs and Applications..

Inside ring has highest privilege.
0 to 2 is Supervisor / Privileged Mode.. Note: 1 and 2 are used for drivers.

3 is user mode..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

_________ mode is the basic mode used by the CPU when executing user applications. In this mode, the CPU allows the execution of only a portion of its full instruction set. This is designed to protect users from accidentally damaging the system through the execution of poorly designed code or the unintentional misuse of that code

A

User mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

____________ firewalls enable the real-time modification of the filtering rules based on traffic content

A

Dynamic packet-filtering

Dynamic packet-filtering firewalls enable the real-time modification of the filtering rules based on traffic content……. Dynamic packet-filtering firewalls enable the real-time modification of the filtering rules based on traffic content……

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

________ ensures the data is NOT altered without authorization. Integrity controls protect against alteration.
INTEGRITY can be enforced by using

A

INTEGRITY.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Message INTEGRITY is enforced using ENCRYPTED MESSAGE DIGEST such as _____ _______ and ____ _______.

A

DIGITAL SIGNATURES

PUBLIC and SECRET KEY CRYPTOSYSTEMS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

NIST SP 800-18 goes over _______.

A

responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

_________ has ULTIMATE RESPONSIBILITY of the data. This is typically C E O, president, or department head or C I O. This role establishes rules and behavior. Provides information to the system owner on security requirements and security controls. Decides who has access to the data.

A

DATA OWNER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

_______ _______ owns the system that processes the data. This is sometimes the same person as the DATA OWNER. Develops the security plan with information owners, systems administrators and functional end users. Develops acceptable use policy and ensures users get training. Updates security plan. .

A

SYSTEM OWNER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

________ role owns processes and ensures the system provides VALUE to the organization.

A

BUSINESS AND MISSION OWNER

26
Q

________ assign permissions based on LEAST PRIVLEDGED and NEED TO KNOW access. This role will typically use role based model.

A

ADMINISTRATORS

27
Q

______ _______ typically gathers and collects data. …..

A

DATA CONTROLLER

28
Q

____ _____ process data. For example, a payroll company processes data given to them to process payroll.

A

DATA PROCESSOR

29
Q

______ do day to day work. DATA OWNERS delegate to CUSTODIAN. CUSTODIAN ensures data is stored and protected. They are respoinsible for backups. This role will maintain audit logs.

A

CUSTODIAN

30
Q

NIST SECURITY BASELINE – NIST SP 800-53

A

SECURITY BASELINE provides a starting point ensure MINIMUM Security standards. BASELINE IS MINIMUM SECURITY as a starting point.

31
Q

______is the most consideration when classifying data.

A

VALUE

32
Q

CONFIDENTIALITY, INTEGRITY, AUTHENTICATION and NOREPUDIATION are GOALS of .

A

CRYPTOGRAPHY

C I A N are goals of cryptography.

33
Q

CONFIDENTIALITY - Two types of data when dealing with CONFIDENTIALITY…

A

DATA AT REST which can be susceptible to theft of physical devices…DATA IN MOTION which is susceptible to eavesdropping.

34
Q

NONREPUDIATION is only offered by PUBLIC KEY. NONREPUDIATION is only offered by Public Key or ASYMMETRIC key. Public Keys are Asymmetric.

TRue or False

A

True

35
Q

The goal of E U is to prevent …

A

unauthorized disclosure of information.

36
Q

An ECC-RSA 160-bit key is the equivalent of an RSA _____-bit key..An E C C R S A is 160 bit key..

A

1,024

37
Q

Frequency analysis may be used on encrypted messages.. Frequency analysis – uses the statistics of the language to break a ciphertext… Frequency analysis – uses the statistics of the language to break a ciphertext.

True or False

A

True

38
Q

FREQUENCY ANALYSIS attack can be used on decrypting an unencrypted message…Frequency analysis uses the ______ of ______ of the characters to substitute cipher to discover original plaintext.

A

frequency of occurrence

39
Q

This attack uses collisions to reverse engineer HASH values. Digital signatures can be susceptible to birthday attacks if the output of the hash function is not large enough to avoid collisions..

A

Birthday Attack:

40
Q

A potential occurrence that can cause an undesirable or unwanted outcome to an organization or to a specific asset is a _______.

A

THREAT

41
Q

Define Threat

A

A potential occurrence that can cause an undesirable or unwanted outcome to an organization or to a specific asset.

Threat = UNWANTED and UNDESIRABLE

42
Q

This attack is used against cryptographic algorithms that don’t incorporate temporal protections In this attack, the malicious individual intercepts an encrypted message between two parties (often a request for authentication) and then later replays the captured message to open a new session.

A

The replay attack

In a replay attack, the malicious individual intercepts an encrypted message between two parties (often a request for authentication) and then later replays the captured message to open a new session..

43
Q

____ ____ _____ are precompiled lists of common passwords and their permutations and serve as the foundation for a dictionary attack on accounts.

A

Dictionary word lists

Dictionary word lists are precompiled lists of common passwords and their permutations and serve as the foundation for a dictionary attack on accounts.

44
Q

When an intruder is detected by an I D S, they are transferred to a _______ _______. The transfer of the intruder into a padded cell is performed automatically, without informing the intruder that the change has occurred. The padded cell is unknown to the intruder before the attack, so it cannot serve as an enticement or entrapment. Padded cells are used to detain intruders, not to detect vulnerabilities. Padded cells are used to detain intruders, not to detect vulnerabilities.
.. Padded cells are used to detain intruders,

A

padded cell

45
Q

ISAKMP: Internet Security Association and Key Management Protocol (ISAKMP) provides background security support services for ______

A

IPSec

46
Q

_________Switching has 1) Variable Delays, 2) Bursty traffic focused, 3) Sensitive to data loss, 4) Supports any traffic.

__________Switching has FIXED KNOWN delays..

A

Packet

Circuit

47
Q

What replaced SSL?

A 
TLS (Transport Layer Security) was specifically designed as a replacement for SSL..
TLS Replaced SSL..
TLS Replaced SSL…
TLS replaced SSL…
TLS Replaced SSL..
48
Q

__________ Control takes into consideration the processes and people who operate within an organizational security policy..

A

Administrative Control -

Administrative control takes into consideration the processes and people who operate within an organizational security policy…

49
Q

When possible, _______ controls should be TRANSPARENT..

A

operations controls

Operations Controls should be TRANSPARENT…
Next topic..

50
Q

Audit Report Requirements:

A

purpose, scope and results of an audit are the three primary (and necessary) elements…
purpose, scope and results are necessary for an AUDIT REPORT..

51
Q

Full Knowledge - These possess a full body of knowledge of the operation, configuration, and utilization of hardware and software inventory prior to a security assessment or penetration test.

Partial Knowledge - Possess an incomplete account of organizational assets, including hardware and software inventory, prior to a penetration test. Thus, time must be spent in obtaining additional knowledge about the organization before test attacks can begin.

Zero Knowledge - zero knowledge team knows nothing about the site except for basic information, such as domain name and company address.

A

Full Knowledge - These possess a full body of knowledge of the operation, configuration, and utilization of hardware and software inventory prior to a security assessment or penetration test.

Partial Knowledge - Possess an incomplete account of organizational assets, including hardware and software inventory, prior to a penetration test. Thus, time must be spent in obtaining additional knowledge about the organization before test attacks can begin.

Zero Knowledge - zero knowledge team knows nothing about the site except for basic information, such as domain name and company address.

52
Q

________ provides confidentiality and integrity protection security services for authentication traffic using symmetric cryptography…

A

Kerberos

53
Q

Matthew receives a digitally signed message from Christopher. What key should Matthew use to verify the digital signature?

A

Mathew uses Christophers PUBLIC Key.

In Digital Signage – the receiver uses the senders PUBLIC key to verify. Next topic..

54
Q

Christopher would like to send Renee a message using a digital signature. What key should he use to create the digital signature?

A

Renee uses Christopher PRIVATE Key to create the message..

55
Q

ISC Code of Ethics:

A

ISC Code of Ethics:
• Protect society, the commonwealth, and the infrastructure.

  • Act honorably, honestly, justly, responsibly, and legally.
  • Provide diligent and competent service to principals.
  • Advance and protect the profession.
56
Q

Kerberos provides _______ and _______

A

Kerberos provides CONFIDENTIALITY and INTEGRITY..

57
Q

Christopher would like to send Renee a message using asymmetric encryption. What key should he use to encrypt the message?

A

Renee’s public key is used to encrypt the message.

58
Q

A security _______is usually a permanent part of the object to which it is attached, thus providing some protection against tampering.

A

label

59
Q

How long to bring warm sites up?

A

12 hours

60
Q

Third Party Governance definition.

A

Third-party governance is the system of oversight that may be mandated by law, regulation, industry standards, or licensing requirements. The actual method of third-party governance may vary, but it generally involves an outside investigator or auditor. This auditor might be designated by a governing body or might be a consultant hired by the target organization..

61
Q

Remote Journaling:

A

Remote journaling technology transfers copies of the database transaction log to the alternate site on a frequent basis…

62
Q

Attacker modifies Domain-Name-To-IP address

A

DNS Poisoning

CISSP (MY CISSP) (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions