Matching And Brain Dump Flashcards
Approves audit budget and resource allocation.
Executive mgmt
Provide audit oversight
Audit committee
Ensure the achievement & maintenance of org requirements with applicable certifications
Compliance officer
Develop and maintain knowledge and subject matter expertise relevant to the type of audit
External auditor
What are the correct order of steps in an information security assessment
- Define the perimeter
- Identify the vulnerability
- Assess the risk
- Determine the actions
A physical or electronic token stores a set of secrets between the claimant and the credential service provider.
- Out of band token
- Memorized secret token
- Pre-registered Knowledge Token
- Look up Secret Token
Pre-registered Knowledge Token
A physical token that is uniquely addressable and can receive a verifier selected secret of one time use
- Out of band token
- Memorized secret token
- Pre-registered Knowledge Token
- Look up Secret Token
Out of band token
A series of responses to a set of prompts or challenges established by the subscriber and credential service provider during the registration process.
- Out of band token
- Memorized secret token
- Pre-registered Knowledge Token
- Look up Secret Token
Look up secret token
A secret shared between the subscriber and credential service provider that is typically character strings
- Out of band token
- Memorized secret token
- Pre-registered Knowledge Token
- Look up Secret Token
Memorized secret token
Name the type of control: labeling of sensitive data
1. Logical
2. Technical
3. Physical
4. Administrative
Administrative
Name the type of control: Biometrics for authentication
1. Logical
2. Technical
3. Physical
4. Administrative
Technical
Name the type of control: Constrained user interface
1. Logical
2. Technical
3. Physical
4. Administrative
Logical
Name the type of control: Radio frequency identification (RFID) badge
1. Logical
2. Technical
3. Physical
4. Administrative
Physical
Match the name of access control model with the restriction: End user cannot set controls
1. Role based
2. Discretionary
3. Mandatory
4. Rule based
Mandatory
Match the name of access control model with the restriction: Subject has total control over objects
1. Role based
2. Discretionary
3. Mandatory
4. Rule based
Discretionary
Match the name of access control model with the restriction: Dynamically assigns permissions to particular duties on job function
1. Role based
2. Discretionary
3. Mandatory
4. Rule based
Role based
Match the name of access control model with the restriction: dynamically assigns roles to subjects based on criteria assigned by a custodian
1. Role based
2. Discretionary
3. Mandatory
4. Rule based
Rule based
A software security engineer is developing a black box-based plan that will measure the system’s reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match Input parameter with the functional testing technique:
Select one input that doesn’t belong to any of the identified partitions.
- Equivalence class
- State-based
- Boundary value
- Decision table
State-based
A software security engineer is developing a black box-based plan that will measure the system’s reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match Input parameter with the functional testing technique:
Select inputs that are at the external limits of the domain of valid values
- Equivalence class
- State-based
- Boundary value
- Decision table
Equivalence class
A software security engineer is developing a black box-based plan that will measure the system’s reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match Input parameter with the functional testing technique:
Select invalid combinations of input values.
- Equivalence class
- State-based
- Boundary value
- Decision table
Decision table
A software security engineer is developing a black box-based plan that will measure the system’s reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match Input parameter with the functional testing technique:
Select unexpected inputs corresponding to each known condition.
- Equivalence class
- State-based
- Boundary value
- Decision table
boundary value
Below are the common phases to creating a Business Continuity/Disaster Recovery (BC/DR) plan starting with the Risk assessment. Put the remaining BC\DR phases to the appropriate corresponding order.
BC/DR Plan Development
Plan Maintenance
Business Impact Analysis
Training, Testing, & Auditing
Mitigation Strategy Development
Risk Assessment
BIA
Mitigation Strategy Development
BC/DR Plan Development
TTA
Maintenance
Match the objectives to the assessment question in the governance domain of Software Assurance Maturity Model (SAMM).
Do you advertise shared security services with guidance for project teams?
- Eduction & Guidance
- Secure Architecture
- Strategy & Metrics
- Vulnerability Management
Secure Architecture
Match the objectives to the assessment question in the governance domain of Software Assurance Maturity Model (SAMM).
Are most people tested to ensure a baseline skill set for secure development practices?
- Eduction & Guidance
- Secure Architecture
- Strategy & Metrics
- Vulnerability Management
Education & guidance
Match the objectives to the assessment question in the governance domain of Software Assurance Maturity Model (SAMM).
Does most of the org know about what’s required based on risk ratings?
1. Eduction & Guidance
2. Secure Architecture
3. Strategy & Metrics
4. Vulnerability Management
Strategy & metrics
Match the objectives to the assessment question in the governance domain of Software Assurance Maturity Model (SAMM).
Are most project teams aware of their security point(s) of contact and response team(s)?
- Eduction & Guidance
- Secure Architecture
- Strategy & Metrics
- Vulnerability Management
Vulnerability mgmt
In the network design below, where is the MOST secure Local Area Network (LAN) segment to deploy a Wireless Access Point (WAP) that provides contractors access to the Internet and authorized enterprise services?
LAN 4
Identity the component that MOST likely lacks digital accountability related to information access.
Backup Media
In the given components of an IT infrastructure – Backup Media, Backup Server, Database Server, Web Server, and Storage Area Network (SAN) – the one that most likely lacks digital accountability is typically Backup Media. This is because backup media (like tapes, disks, or other physical media) often do not have the capability to independently log who accessed them or what was done, especially when they are removed from the backup server or storage area network.
Which Web Services Security (WS-Security) specification maintains a single authenticated identity across multiple dissimilar environments?
“WS-Federation”
The Web Services Security (WS-Security) specification that maintains a single authenticated identity across multiple dissimilar environments is “WS-Federation”. WS-Federation is a part of the larger WS-Security framework and is specifically designed to allow different security realms to federate, enabling users to authenticate across different systems or organizations using a common set of credentials.
WS-Federation works in conjunction with WS-Trust, which provides the mechanisms to issue, renew, and validate security tokens, and enables the implementation of various identity models including federation. However, WS-Federation extends this to provide the way those security tokens can be used to allow systems to interoperate and share the identity of the authenticated user in a secure manner across different security domains.
Which Web Services Security (WS-Security) specification negotiates how security tokens will be issued, renewed and validated?
“WS-Trust”
The WS-Security specification that negotiates how security tokens will be issued, renewed, and validated is “WS-Trust”. WS-Trust is an extension of the WS-Security specification which provides extensions for issuing, renewing, and validating security tokens. It defines the protocols for request and issuance of security tokens and also outlines how clients can obtain access to secure resources using those tokens.**
The Web Services Security (WS-Security) specification that handles the management of security tokens and the underlying policies for granting access is “WS-Trust”. WS-Trust provides extensions to WS-Security for issuing, renewing, and validating security tokens, and establishes the relationship between a security token service and the requester. It also defines how policies for access to resources are applied and enforced using these tokens.
In conjunction with WS-Policy, which outlines the capabilities and constraints of the security policies, WS-Trust plays a crucial role in managing the lifecycle of security tokens and controlling access to resources based on those policies.
Rank the Hypertext Transfer protocol (HTTP) authentication types shows below in order of relative strength. Drag the authentication type on the correct positions on the right according to strength from weakest to strongest
“Basic” as the weakest
“Digest” as weak
“Integrated Windows Authentication” as strong
“Client Certificate” as the strongest
image seems to depict various HTTP authentication methods ranked by their relative strength. Based on standard security practices, the correct order from weakest to strongest should be:
Basic: This is considered weak because it sends credentials in clear text (base64 encoded, which can be easily decoded), and is only secure over HTTPS.
Digest: Stronger than Basic as it uses a challenge-response mechanism for password transmission, which does not send the password in clear text.
Integrated Windows Authentication (IWA): This can be stronger than Digest as it can use more secure methods like NTLM or Kerberos, which don’t send passwords over the network and can provide mutual authentication.
Client Certificate: This is the strongest as it uses certificates rather than passwords. It establishes a mutual authentication where both the server and the client authenticate each other, and it relies on public key infrastructure (PKI) which is significantly more secure against various attack vectors.
Match the level of evaluation to the correct common criteria (CC) assurance level.
FT, ST, MT, MD, SD, SV, FV
Fun time, sometime, mountain time, my day, shannon day, shannon vag, finger vag
EAL1 – Functionally Tested: This level is the most basic form of testing and is used for assurance that the product functions in a manner consistent with its documentation, but without any in-depth testing or independent verification.
EAL2 – Structurally Tested: Provides assurance that security features have been implemented correctly and includes a combination of security-enforcing functional tests and structural tests.
EAL3 – Methodically Tested and Checked: Adds more in-depth testing and checking to EAL2, including a review of the security-related documentation and an analysis of the product structure and its security features.
EAL4 – Methodically Designed, Tested, and Reviewed: At this level, the product undergoes a thorough and methodical review and testing process. This includes both functional and penetration tests and is considered to be the highest level that is normally achievable for commercially developed products.
EAL5 – Semiformally Designed and Tested: Involves a semi-formal design process with testing that goes beyond EAL4. This level applies to products that require a high level of independently assured security in a planned and systematic manner.
EAL6 – Semiformally Verified Design and Tested: Provides a higher and more comprehensive level of assurance than EAL5 by using a semiformal verification process. It is generally applicable to security-critical components and can be used in situations where the risk of attack is high.
EAL7 – Formally Verified Design and Tested: Represents the highest level of assurance, which is achievable with rigorous testing and formal verification methods. This level is appropriate for the most secure, safety-critical, and high-risk environments where the cost of failure is considered extremely high.
RAID ____ is known for mirroring without striping. It would duplicate the data exactly on another disk, so “123456789” would be on two separate disks in its entirety.
1
Known for mirroring data across two or more disks. While it provides redundancy, it does not offer the same level of performance enhancement as RAID 0
RAID ___ is known for striping without parity or mirroring. It would split “123456789” across two or more disks without any redundancy. For instance, “12345” on one disk and “6789” on another.
0
RAID-0 is primarily configured for high-performance data reads and writes. In RAID-0, data is split across multiple disks in a process known as striping. This configuration allows multiple disks to read and write data simultaneously, significantly increasing performance. However, it’s important to note that RAID-0 does not provide redundancy, which means if one disk fails, all data in the array is lost. Despite this drawback, RAID-0 is preferred when performance is the primary concern over data redundancy.
RAID ___ uses both striping and parity. The file “123456789” would be distributed across three or more disks with parity data such that any single drive’s data can be recovered in the event of a disk failure. For example, “123” on one disk, “456” on the next, and “789” on another, with parity data distributed across them.
5
Uses both striping and parity for data storage, providing a balance of improved performance and data redundancy, but not as performant as RAID-0 for pure read/write speed.
RAID ___ uses an additional parity block. It provides higher redundancy at the cost of write performance, and it’s not primarily configured for high-performance reads and writes
6
RAID ____ equires at least four disks and creates a mirrored set out of two striped sets. So, “123” and “456” might be striped across the first two disks and then mirrored onto two more disks.
10 which is a combination of RAID 1 and RAID 0
Compare the OSI model to the TCP/IP model
Describe the biometric error chart.
