Architecture and Design Flashcards

Question

What is Elasticity?

Answer 1

Elasticity is the ability to resize an environment based on the load. Elasticity is a part of virtualization and can reduce costs. A user can increase or decrease resources as necessary. It is commonly used with cloud technologies.

Answer 2

Integrity measurements are done to identify baseline deviations. Automated tools continuously monitor the system for any baseline changes. If changes are found, Group Policy will force the system back to its original state.

Answer 3

Continuous deployment is the process of delivery of software to a production environment using automation, which reduces the software development lifecycle.

Answer 4

Continuous delivery is an agile software engineering approach that allows for the building, testing, and releasing of software with greater speed and frequency. This provides the customer a continuous product.

Answer 5

Continuous integration is the process of merging code changes into a central repository where the software is then built and tested on a continuous basis in development.

Answer 6

DevSecOps is an agile-like process that continually focuses on security. It also demands continuous interaction between stakeholders but keeps security as a focus throughout the development.

Answer 7

Normalization is used to optimize database performance by removing duplicates, use of primary keys, and related data contained in separate tables.

Answer 8

Server-side validations occur on the web server or back-end and take more time to complete. Validation on the server side is more secure than client-side validation.

Answer 9

Version control tracks the versions of software in real-time. It will record who has accessed the code, and what was changed. Version Control also allows for rollback if necessary.

Answer 10

Change management is a process that follows a change to a system from identification to implementation. It is used for controlled identification and implementation of required changes within a computer system.

Answer 11

Provisioning is the process of procuring, configuring and making available, an application or system on certain services. Provisioning an application allows it to run on its intended platform.

Answer 12

As new code is introduced to an application, security testing is important to check for bugs and vulnerabilities. Automating security testing ensures defects are not introduced in systems.

Answer 13

The software development lifecycle (SDLC) of a project consists of the following attributes: defining requirements, design, implementation, verification, and maintenance.

Answer 14

Model verification is testing to ensure the software meets the customers functional and physical requirements.

Answer 15

A stored procedure is a set of Structured Query Language (SQL) statements stored in a database as a group, so it can be reused and shared by multiple programs. Stored procedures can validate input.

Answer 16

A state table contains information about sessions between network hosts. This type of data is gathered by a stateful firewall.

Answer 17

Scalability is the capacity to increase the workload on current resources.

Answer 18

Iris scanning can be implemented in higher-traffic areas, where throughput is a concern. At the same time, accuracy is high, while ease of spoofing is fairly low. The enrollment process for employees is less intrusive than retinal scans.

Answer 19

Retinal scanners are intrusive, complex and expensive. They are not the best option for high-traffic areas, such as airports.

Answer 20

Voice recognition would be too difficult to implement in a situation with high levels of ambient noise in a busy place like an airport.

Answer 21

Fingerprint scanners offer ease of enrollment, but in this high traffic area, it would be difficult to ensure the scanner remains clean and dry for hundreds of employees. relatively easy to forge and has stigma to criminal activity.

Answer 22

Time synchronization adds an additional layer of safety, with time-based one-time password algorithm (TOTP). Devices must be synchronized to the server so the timestamp is accurate and timing algorithm on the OTP is activated at the appropriate time, when the OTP is issued.

Answer 23

Signature recognition technologies match how the user applies their signature, analyzing aspects such as stroke, speed, and pressure, making it more difficult to spoof than a simple forgery.

Answer 24

Point-by-point signature matching only measures how consistent a signature is with a template signature, and as a result, could be easily forged.

Answer 25

Pattern matching technology is associated with typing as a behavioral technology, matching the speed and pattern of user input.

Answer 26

The crossover error rate is where false rejection rate and false acceptance rate meet. This figure is important for optimizing and fine-tuning the biometric system.

Answer 27

Throughput is an important consideration in the location a biometric scanner is installed, as chokepoints could become an issue in areas of high traffic, causing other security issues.

Answer 28

False acceptance rate is the rate at which a system lets unauthorized users in, which constitutes a security breach.

Answer 29

A type II error is also known as a false positive, measured by the False Acceptance Rate (FAR). This is the rate at which unauthorized personnel gain access to the secure facility. This number must be minimized.

Answer 30

Revocability is an issue with all biometric factors, but because fingerprint scanning technology is cheaper in comparison to other technologies, accessing and revoking certificates is also easier to do.

Answer 31

Directory Services provide privilege management and authorization to a network by storing user information such as groups, roles, and services allowed into a Distinguished Name (DN). Directory services are used to structure user management and implement access security

Answer 32

Rule-based access control (RBAC) is an access control model that is based upon a predefined set of rules and instructions, such as Access Control Lists (ACL) to grant access to a system.

Answer 33

Credential management is the use of a collection of user information that provides the identity of a user combined with a password.

Answer 34

is considered the net gain or loss of an investment over a specified period of time and generally expressed as a percentage of the initial cost.

Answer 35

Clustering provides for high availability for servers and can remove the single point of failure. Clustering is similar to load balancing but is more costly than RAID implementations.

Answer 36

Combines mirroring and striping in a single system. It delivers better write performance than any other RAID level providing data protection. RAID 10 requires a minimum of four disks.

Answer 37

RAID-6 requires four disks and can survive a failure on two.

Answer 38

Provides data that is written to two disks simultaneously, providing redundancy in the event one disk fails.

Answer 39

Control diversity includes the use of multiple control types such administrative, technical and physical. This can include security guards (physical), IDS or Intrusion Detection System (technical), and penetration testing (administrative).

Answer 40

is a failover solution and not a security control.

Answer 41

Single-layer security is the use of a single control to protect assets. Using two separate vendors for the firewalls makes this scenario diverse.

Answer 42

Implied Trust, Crypto (Cryptographic identification) and Authentication ( or lack thereof)

Answer 43

Zigbee is a wireless communications protocol used primarily for home automation. Zigbee is an open source solution that uses 2.4 GHz frequency band. It has no communication hop limitation with multiple devices in a singular network

Answer 44

Narrowband-IoT (NB-IoT) is a type of baseband radio that has limited data rates between 20 to 100 Kilobits per second (Kbps). This is more suitable for inaccessible locations that require signal penetrating power.

Answer 45

is a type of baseband radio that supports cellular network bandwidth of up to 1 Megabit per second (Mbps).

Answer 46

They are examples of a SoC board that was initially devised as an educational tool. It is now widely used for industrial application and hacking.

Answer 47

Real time operating system (RTOS) is a type of embedded system that operate devices that perform acutely time-sensitive tasks. These are not made for educational purposes.

Answer 48

A Faraday Cage is used to block electromagnetic, radio frequencies and electrostatic signals. The enclosure can keep signals out and block them from going into the secure area providing a physical security layer.

Answer 49

Hot and cold aisles are arranged with all the hardware expelling heat toward one aisle where the exhaust vents are placed. The other side of the aisle is designated for cool air. Avoiding the mixture of warm and cold air helps to improve the efficiency of the entire operation and reduce costs.

Answer 50

An Ad Hoc zone is created when two or more wireless devices connect to one another creating an on-demand network.

Answer 51

Degaussing involves exposing magnetic media, such as hard disks or tapes, to a powerful electromagnet which disrupts the magnetic pattern that stores the data on the disk surface. This effectively "erases" the media.

Answer 52

Embedding a watermark using the design and color of bank notes is an example of steganography. This method is employed by the Counterfeit Deterrence System (CDS) and can be used for anti-counterfeiting efforts. Encoding messages within TCP packet data fields to create a covert message channel is an example of steganography. Changing the least significant bit of pixels in an image file (the cover file) is another example. This can code a useful amount of information, without distorting the original image noticeably.

Answer 53

A system is resilient if it prevents a compromise of a small part of the system compromising the whole system. Cryptography assists this goal by ensuring the authentication and integrity of messages delivered over the control system.

Answer 54

The art of obfuscation is making messages difficult to understand. This can be implemented with computer code, however, sometimes even the computer may not be able to read it.

Answer 55

Launching a side channel attack means monitoring things like timing, power consumption, and electromagnetic emanation. These have a physical relation.

Answer 56

Operating system (OS) fingerprinting is a method used by Nmap to probe hosts for running OS type and version, and even application names and device type (e.g., laptop or virtual machine).

Answer 57

Elliptic Curve Cryptography (ECC) is a trapdoor function used to generate public/private key pairs. Even at smaller key lengths, it is comparable to other asymmetric encryptions using larger key bits such as RSA using 2048-bit keys. A large key size will work with elliptical curve, but it will become slower. In this case, the application worked faster due to the smaller key size that can be used.

Answer 58

A secure hash, for example, like Secure Hash Algorithm (SHA) are used to create a message digest. It is a one-way cipher. It is mostly used for integrity and passwords.

Answer 59

A session key is a secret key that is either shared or known by some secure means that is used in Secure Sockets Layer/Transport Layer Security (SSL/TLS) with RSA.

Answer 60

Ephemeral key is the main component of ECDHE that gives it perfect forward secrecy. There is a different secret key for each session during transport.

Answer 61

ECDHE (ECC with D-H ephemeral mode) uses ephemeral keys for each session which provide perfect forward secrecy. It is a step above security for regular ECC, and better than RSA's algorithm.

Answer 62

Elliptic curve cryptography (ECC), although better than RSA's algorithm, has the problem that a compromise of its encryption keys will affect all communications.

Answer 63

RSA is an asymmetric algorithm used to create digital signatures. It can be used to encrypt short messages. Rivest, Shamir, Adleman (RSA) is widely deployed as a solution for creating digital signatures and key exchange. Client browsers support RSA.

Answer 64

ECDHE will only work if both client and server support the same PFS-compatible suite or ephemeral keys. Otherwise, Elliptic Curve Diffie-Hellman (ECDH) without Ephemeral should be used.

Answer 65

Key stretching is creating a key using thousands of rounds of hashing. Adding a salt in the hashing process makes the hash or key much stronger. Uses Secure Hash Algorithm (SHA) its the second part of key stretching.

Answer 66

Symmetric encryption is a two-way encryption algorithm in which encryption and decryption are both performed by a single secret key.

Answer 67

RC4 is a stream cipher meaning each byte or bit of data in the plaintext is encrypted one at a time. is not block cypher.

Answer 68

3DES is a block cipher. n a block cipher, the plaintext is divided into equal-size blocks (usually 64- or 128-bit). Each block is then subjected to complex transposition and substitution operations, based on the value of the key used. It uses 64-bit blocks and a 56-bit key, but the plaintext is encrypted three times using different subkeys.

Answer 69

The Advanced Encryption Standard (AES) is a 128 bit symmetric block cipher and key sizes of 128, 192, or 256 bits. It is faster and more secure than 3DES.It's more secure than than RC4 and compatible with TLS

Answer 70

Electronic Code Book (ECB) is a mode operation that will process the encryption in blocks using the same key and . This is the simplest mod, and operates faster than CBC.

Answer 71

Cipher Block Chaining (CBC) is a mode of operation utilizing an Initialization Vector (IV). The output of the first ciphertext block is combined with the next plaintext block, and repeats. This is processing intensive and must run serially, hindering performance.

Answer 72

Digital Signature Algorithm (DSA) is an asymmetric algorithm used by NIST that adopts ElGamal's algorithm. It uses the private and public keys from Diffie-Hellman in a similar way to RSA key pairs.

Answer 73

is a symmetric block cipher using 64-bit blocks and a 56-bit key. 3DES (Triple DES) is where the plaintext is encrypted three times using different subkeys.

Architecture and Design Flashcards

(97 cards)