Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cissp > CISSP Domain 8 > Flashcards

CISSP Domain 8 Flashcards

1
Q

Aggregate Vs Inference

A

Aggregate requires multiple small pieces

Inference requires a single data point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Waterfall method

A

Very linear, each phase leads

Once phase done can’t go back

Sequential steps

Can be improved by adding validation and verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Type of program language

A

Machine language

Assembly language

High level language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Machine language

A

Man had to manually calculate and allot memory address

Complete binary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Assembly language

A

Users mnemonic like ADD, PUSH, POP instead of binary codes

Uses assemblers to convert assembly codes to binary codes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

High level language

A

Uses abstract statements like Excel IF - Then- ELSE function

It’s processor independent

Code written in high level language can be converted to machine language using compiler and interpreters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

4 Gen - Very high level language

A

More abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Natural language

A

Eliminate need of programming expertise like AI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Assemblers Vs Compilers Vs Interpreters

A

No matter what language is used institutions and data have to end up in binary for processor to understand

Interpreter - Convert high level to machine level code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is libraries used for?

A

Software libraries contains reusable code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Integrated development environment

A

Environment where they can write their code, write it, test it, debug it and compile it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What happens in OOP ? And how does it work?

A

Devloper doesn’t develop each and every object

Works with class, subject and objects

Class - Set of attributes associated with it, when an object is generated, it inherits these attributes example: Furniture

From security pov provides a black box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Polymorphism

A

Characteristic of an object that allows is to respond with different behaviours to same message or method because of change in external conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Properties of OOP

A

Encapsulation

Messaging - Communication between objects

Reusability

Abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cohesion

A

How many different types of tasks a module carry out

Should high in nature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Coupling

A

How much interaction one module requires to carry out it’s tasks

Should be low in nature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Steps in OOP ( FYI)

A

Devloper creates a class which outlines specifications

Object is initiated it inherits these attributes

User inputs in a software - Addition

Objects is initiated

Object A interacts with B using API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Input validation - Limit check and Escaping input

A

Remove risky inputs

Always occurs on the server side

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Properties of session management

A

Cookies to be secure

Expire after a certain time and user to authenticate again

Identifiers to be long and randomly generated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Error handling

A

Devloper love long detailed error messages but those might contain sensitive info hence disable it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SDLC steps

A

Conceptual definition

Functional requirements determination

Control specifications devlopment

Design review

Coding

Code Review walk through

System test review

Maintanence and change management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Conceptual definition

A

Project charter - Top level understanding

Designers identity classification of data to be processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Functional requirements determination

A

How parts of system interoperate

Characteristics:

Input

Behaviour

Output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Control specifications determination

A

Analyse system from security perspective

  1. Access control
  2. Confidentiality using data encryption
  3. Audit trail - Accountability
  4. Availability and fault tolerance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Design review
Once functional and control is completed let system designers do their thing
26
Code Review walk through
Devloper starts writing code
27
Testing
System testing Regression testing UAT Then deployed
28
Maintanence and change management
Maintanence tasks
29
Spiral model
**prototype and incremental model** Determine objectives Evaluate alternatives, identify and resolve risks Devlop and verify next level product Plan next phases
30
Agile software development - 12 principle
Satisfying customer Welcome change Devlop working software, couple of weeks Have face to face conversation **Working software** primary measure of progress
31
Agile methodology
Scrum Kanban RAD AUP XP
32
Scrum
Daily team meetings Scrum master Sprint: Organize work into shorter sprints of activity Short term objectives that contribute to broader goals of the project
33
CMMI
Initial - Chaotic Repeatable - Reuse of code Defined- Operate what is documented Managed - Quantitative Process management Optomizing - Continuous improvement
34
Software Assurance Maturity model business functions
Governance - Stratergy and metrics , policy and compliance, education and guidance Design - Threat assessment , security requirements and security architecture Implementation - Secure build, Secure deployment, Defect management Verification - Architecture analysis, Req driven testing, security testing Operations - Incident management, environment management, operational management
35
IDEAL model
Initiation Diagnosis: Current state of org and make general recommendation of change Establishing Acting: Walk the talk Learning
36
Change management process and 3 basic components
Request change Change control: test and analyse Release control: Only approved changes into prod Also include acceptance testing
37
Software configuration management
**Control the version of the software used throughout an organisation and to formally track and control changes to software configuration** Configuration identification Configuration control: Changes to software in accordance with change control and configuration management policies. Updates Configuration status accounting - Formalized procedures to keep track of all authorised Changes they takes place Configuration audit - Periodic audit
38
Devops model Vs CI/CD model
Software development+ QA+ Operations Often deploy code several times per day Code roll out dozens or several times per day: - Security also should move 1.High degree of automation 2. Code repositories 3. SCM process 4. Movement of code between development, testing and prod environments
39
API's and what a devloper needs to consider ?
Bypass traditional web pages and interact directly with underlying service through function calls Secure authentication and Authorization to make specific call
40
Software testing when is best time ? And types of test
Aa models are designed Reasonableness check: Inputs gives desired output Misuse case test: Code will perform under normal activity and when subjected to extreme conditions
41
White box, Grey box and Black box testing
Access to source code, logical structures of program, inner workings of program Have access to source code+ analyse inputs and outputs Do not have access to source code
42
Code repositories
Central storage point for developers Version control Bug tracking Web hosting Release management Used to manage and distribute code libraries
43
Third party software acquisition
COTS - On premise of IaaS Open software (OSS) - freely available for anyone to download and use
44
Type of DBMS
Hierarchical Relational
45
Hierarchical DBMS
Each employee has one manager but one manager has one or more employees DNS Distributed database
46
Relational DBMS
Row ( Turple) and column ( fields/attributes) Cardinality - Number of rows Degree - Number of columns
47
Candidates key in RDBMS
Uniquely identify any record in a table
48
Primary key
Enforces uniqueness is primary key **Each table has only one primary key**
49
Alternate keys
Any key not selected as primary key is alternate key
50
Foreign key
Enforces relationship between two tables, aka referential integrity
51
What is SQL primary security feature?
Granularity of authorisation It's very detailed
52
Db normalisation
Process of bringing a Db table into compliance with normal forms is known as normalisation Developers want well organised and efficient db
53
4 Required characteristics of Relational DB
A- All or nothing Consistency Isolation Durability - Once committed they must be preserved
54
What is multilevel Db and what is challenge?
Data(IC) and security should be separate it leads to data contamination Can be implemented using restricted access with views
55
Concurrency in DB and what if they fail to implement?
**Edit control** **Certain Information** stored in Db is always correct at least has integrity and availability protected Lost updates - Two people update at same time data is lost Dirty Reads - Transaction that did not commit because of crash
56
Aggregation
Multiple low level security data points combine them to produce useful info
57
Inference
Using a single info gain access to confidential info
58
Time stamps, Content dependent access control, context dependent, Db partitioning
Data integrity and availability Contents or payload Cell suppression - Concept of hiding individual db fields Context - Big picture of ACL Db partitioning - Subvert inference and aggregation
59
Polyinstation in DB
When 2 or more rows in same DB have same primary keys but different data for use at different data classification levels
60
Noise and perturbation
Can insert false or misleading data
61
OBDC
To communicate with different db kind of interface
62
No SQL and types
Uses models other than relational to store data Key/ Value Graph db Document
63
Key/ Value pairs
Store info in key value pairs
64
Graph Db
Stores data in graph format
65
Document
Stores data in document like JSON or XML
66
Covert channel
Storage threat Allow transmission of sensitive data between classification levels through direct or indirect manipulation of shared storage media
67
Types of knowledge based systems
AI Expert systems and neural systems
68
Expert systems and 2 components
Accumulation of knowledge of experts Knowledge system and inference engine - Prediction based on historic data
69
ML core approach and 2 categories:
Computer to analyse directly from data Supervised learning - Uses labelled data for training Unsupervised learning - Algorithm devlop model independently
70
Neural network
Extension of ML aka deep learning **Computational decision+ Series of rules stored in KB** Has many layers of summation - Weighting information to reflect - Delta rule
71
Script kiddies
Ready to use scripts from internet use them to launch attack
72
APT malware
Small adversaries they have zero days
73
2 main functions of computer viruses
Propagation and payload execution
74
Virus technologies
Multiparte Stealth Polymorphic Encrypted
75
Multiparte
More than one propagation techniques in order to penetrate systems
76
Stealth virus
Hide themselves by actually tampering with the OS to fool AV package to thinking everything is working fine
77
Polymorphic virus
Modify their own code as they travel
78
Encrypted virus
Uses virus decryption routine
79
Logic bomb
Perform certain action at particular time. - A condition
80
Trojan horses
Appears loving but carries a malicious behind the scene payload
81
Remote access Trojans
Opens backdoor in system to grant attacker remote admin control of infected system
82
Worms
They propagate themselves without human intervention
83
Spyware and adware
They are potentially unwanted programs Monitoring your actions Display advertisement
84
Malicious scripts
Commonly found in fileless malware
85
Zero day vulnerability and reasons
Delay in patches Slowness in applying patches
86
Antimalware Software and 3 things it does
Signature based system or heuristic based S/w can eradicate the virus, restore the machine to safe condition Quarantine until admin can examine Predefined danger threshold- Delete
87
EDR and UEBA
Analysis of end points Isolation possible malicious activity Integration with threat intelligence to get info into malicious behaviour UEBA- build a profile of user
88
Buffer overflow
Devloper doesn't validate user inputs leading to memory segment buffer to overwrite
89
TOC TOU
Process executes access permissions before too far in advance of a resource request
90
Backdoor
Bypass normal access restrictions Used in devlopment and debugging
91
Prevlige escalation - Rootkits
Freely available on internet
92
XSS and persistence XSS
Occur when web apps allow attacker to perform injection into a web page Allows reflected input Malicious scripts are injected into trusted websites Remains even when attacker isn't actively waging an attack
93
SQL injection
Unexpected input to gain unauthorised access to an underlying db
94
Network reconciance techniques
IP probes Port scans Vulnerability scans
95
SDLC Life cycle
Real devlopers ideas take effort Requirement gathering Design Implementation Testing Evolution
96
Insecure direct object reference
If app doesn't perform Authorization checks user may be permitted to view info that exceeds their authority
97
Directory transversal
Web server suffers from misconfiguration that allows attackers to navigate directory structure and access file that should remain secure
98
File inclusion
Simply retrieving a file from local OS and displaying it to attacker, FI actually execute code
99
XSRF - Cross site request forgery
XSS attack exploit the trust the user has in website to execute code in users system
100
SSRF
Instead of tricking users browser into visiting URL, trick server into visiting a URL based on user imput
101
Session hijacking
Malicious person intercepts between authorised user and resource 1. Capture details of client identity 2. Tricking client into thinking attacker system is server 3. Accessing web app using a cookie data of user who didn't close connection
102
Most effective input validation
Input whitelisting inputs which is defined by devloper for user to input Input blacklist - To control user imput
103
Db security - parameterised queries and stored procedure
Techniques to protect against injection attacks doesn't allow insertion of codes
104
Db admins to reduce data exposure
Obsfuscation and camaflogue Data minimisation Tokenization : Random token replacement of actual data
105
Application resilience
Scalability - Scale up Elasticity - scale up and down
106
Resource exhaustion in memory management
Memory leaks memory needs to released if not in use

Cissp (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions