Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

My CISSP Cards > cissp massive deck > Flashcards

cissp massive deck Flashcards

(75 cards)

Start Studying
1
Q

What is the opposite of the CIA triad?

A

Disclosure, Alteration, and Destruction (DAD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What protects publicly traded data in the US?

A

Sarbanes-Oxley Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What protects financial information in the US?

A

Gramm-Leach-Bliely Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

To maintain ______, you should always encrypt data.

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What would you use to encrypt data in motion?

A

TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What would you use to encrypt data at rest?

A

AES-256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Passwords are an example of what type of authentication?

A

Type 1 (Something You Know)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

List the types of authentication:

A 
Type 1 - Something you know
Type 2 - Something you have 
Type 3 - Something you are
Type 4 - Somewhere you are
Type 5 - Something you do

(K H A A D)

  • Kick
  • Him
  • Ahole
  • Ahole
  • Dck
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What type of evidence includes tangible objects such as hard drives?

A

Real Evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What type of evidence includes witness who can use one of their 5 senses?

A

Direct evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What type of evidence includes facts that can prove something?

A

Circumstantial Evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Any company that handles financial information must adhere to what act?

A

Gramm Leech Bliely Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

List the steps in NIST 800-34.

A

1) Policy Statement
2) BIA
3) Preventative Controls
4) Contingency Strategies
5) IT Contingency Plan
6) Ensure plan testing
7) Ensure plan maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

List the ISO 27K series:

A 
27001 - Establish ITSM
27002 - Security Controls
27004 - ITSM Success Measurements
27005 - Risk Management 
27799 - PHI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which security model is concerned with confidentiality?

A

Bell-LaPadula Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which security models are concerned with integrity?

A

BIBA, Clark-Wilson

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What type of controls are used to discover and document unwanted or unauthorized activity?

A

Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the ^ mean in “ X ^ Y “?

A

AND - if both values are true, then true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does the down arrow in “ X down arrow Y” mean?

A

OR (Any one value is true, then true)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does the ~ mean in X ~ Y?

A

NOT (reverse the input)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does the + mean in X + Y?

A

Exclusive OR - (Only true if only one value is true, meaning two 1 1s = 0)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Is AES symmetric or asymmetric?

A

Symmetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What block size does symmetric standard DES use?

A

64 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What key size does symmetric standard DES use?

A

56 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
How many rounds are used in symmetric standard DES?
16
26
What is included in Type A fires and how do you put them out?
Common combustibles (i.e. Paper); water
27
What is included in Type B fires and how do you put them out?
Liquid (i.e. gas); CO2, Halon, soda acid
28
What is included in Type C fires and how do you put them out?
Electrical; CO2, Halon (FM-200)
29
What is included in Type D fires and how do you put them out?
Metal; Dry powder
30
What type of water suppression system is always filled with water?
Wet Pipe
31
What type of water suppression system contains compressed air to push out water when there is a fire?
Dry Pipe
32
What type of water suppression system is a dry pipe wiht large pipes that deliver huge volumes of water?
Deluge (not suitable for environments with computers/electronics)
33
What type of water suppression system is a combination of a wet and dry pipe?
Preaction (most suitable for computer rooms with humans)
34
What mode of EMI is the difference between hot and ground wire?
Common Mode
35
What mode of EMI is the difference between hot and neutral wire?
Traverse
36
What level of humidity should computer rooms stay at?
40-60%
37
What is it called if there is a momentary loss of power?
Fault
38
What is it called if there is a complete loss of power?
Blackout
39
What is it called if there is a momentary low voltage?
Sag
40
What is it called if there is a prolonged low voltage?
Brownout
41
Which ring is also known as privileged mode?
Ring 0
42
What does ring 0 house?
OS Kernel
43
What do ring 1 and ring 2 house?
OS System Services (Drivers, ETc)
44
Which level assurance level is "semi-formally designed and tested"?
EAL5
45
Which level assurance level is "formally designed, verified, and tested?"
EAL7
46
Which assurance level is "functionally tested"?
EAL1
47
What is EAL2?
Structurally tested
48
What is EAL3?
Methodically tested and checked
49
What is EAL4?
Methodically designed, tested, and reviewed
50
What is EAL6?
Semi-formally designed, verified, and tested
51
Bell-LaPadula deals with:
confidentiality (simple: no read up, star*: no write down)
52
Clark wilson model deals with:
integrity
53
What is another name for the Brewer Nash Model and what does it do?
Chinese wall - protects conflicts of intererst
54
BIBA model deals with:
Integrity (simple: no read down, star*: no write up)
55
What is the primary focus of COSO?
Addressing issues that lead to and allow for fraudulent financial reporting.
56
Kerberos has built-in protections against authentication replay attacks. Which of the following mechanisms provide that protection?
Time stamps
57
What type of protection is used to maintain confidentiality?
Encryption
58
What type of encryption is used for data in motion?
TLS
59
What type of encryption is used for data at rest?
AES
60
Which form of access control uses specific permission (W, R, Execute) for different users and/or groups?
DAC (Discretionary Access Control)
61
Which form of access control works with labels (objects) and clearance (subjects)?
MAC (Mandatory Access Control)
62
Which form of access control uses a combination of objects, subjects, and environment (such as physical location)?
AAC (Attribute Access Control)
63
In software, if a field allows only 10 digits, and you do not limit the field in anyway (such as not allowing a user to enter 11 digits or having the software ignore 11th digit), what kind of attack could occur?
Buffer overflow
64
What do developers create in a program to easily access the program they are creating via a "backdoor"?
software maintenance hook (can allow attackers to attack the program! make sure the developer agrees that no maintenance hook has been left)
65
What type of attack includes slowly incrementing / making small changes to data?
data diddling
66
What type of attack is when small attacks add up to one major attack?
salami attack
67
What type of software-based password attack includes the attempt of cracking a password using defined words in a word list?
dictionary attack
68
What type of software-based password attack uses different parameters each time over and over again until password crack is successful?
brute force attack
69
What type of software-based password attack to crack a password uses md5 hash and tables?
rainbow table
70
What type of software-based network attack includes placing a computer in between one host and another host and looks at the traffic between the two?
sniffer / sniffing (ARP spoofing, MAC changing, spoofing)
71
In Kerberos, the authentication server + the ticket granting server forms what?
Key Distribution Center (KDC)
72
What authentication method using the following: - User sends username to auth server - Auth server sends secret key and ticket granting ticket to user - User decrypts secret key with user's password - If decryption works, user sends: ---- ticket granting ticket to ticket granting server and ----- information about which resource the user wants to access - Ticket granting server grants access to user to resource
kerberos
73
What type of authentication allows SSO without password by establishing trust between two systems and uses certificate and PKI? Used by websites!
Federation / federated identity | https://blog.empowerid.com/blog-1/bid/164625/what-is-federation-and-how-is-it-different-from-sso
74
What is used for central authentication methods normally?
RADIUS
75
What are the four broad domains of COBIT?
- Acquire and Implement - Plan and Organize - Deliver & Support - Monitor & Evaluate

My CISSP Cards (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions