Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Domain 3 > Flashcards

Domain 3 Flashcards

1
Q

Characteristics of Biba Model

A 
All about Integrity
Write down, read up
STAR Integrity
Simple Integrity Property
Invocation Property
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Characteristics of Bell Lapadula Model

A 
All about Confidentiality
Write up, read down
Star Property
Simple Property
Strong STAR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Types of Fire Extinguishers

A 
Class
A. Common Combustible
B. Liquid
C. Electrical
D. Metal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the State Machine Security Model

A

Based on Finite State Machine
Map out the finite possible operational outcomes
verify that all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Common Security Models

A 
MATRIX - (Access Control)
Bell - Lapadula (Confidential control)
Biba (Integrity Control)
Information Flow Model
Clark Wilson (Integrity Model)
Multi Level Lattice
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Information Flow Model

A

Extends The State Machine Model
Finite State Machine; you specify well defined paths for information to flow on those paths
Uses lots of reference monitors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Non-Interference Model

A

Make sure objects and subjects are not affected on the level you’re at

Mandates that there is a hierarchy of levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

MATRIX Model

A

Provides Access rights

Matrix to match users to privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Clark Wilson Model

A

Integrity Model
Invented “Triple Security” which is now know as reference modeling
Very Commercial
Dictates
-Separation of Duties
- subjects access DTA through arbiter app
- Heavy Auditing Requiring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Brewer Nash (Chinese Wall)

A

Stopping conflicts of internet problems

poster child of where BN should have been used in Arthur Anderson in Houston

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Graham Denning

A

Integrity and Confidentiality

Assigns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Cloud Types

A

Public (AWS or AZURE)
Private (Data Center)
Community (Group of students sharing a space)
Hybrid (Hosting your website to public on private cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Deployment Models

A

IaaS (provide your own software)
PaaS (cloud provider uses software and your software)
SaaS ( All software is Cloud providers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Traits of Cloud

A 
Rapid Elasticity
On Demand Self Service
Metered Service
Broad Network Access
Resource Pooling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cloud Security Issues

A

Lose controls over security implementation
All security actions must be documented and put in contract BEFORE signing
Who is cloud provider, need to trusted
Limited authentication capabilities
Lack of Access to logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Cryptography Goals

A

P.A.I.N.

Privacy (confidentiality)
Authentication
Integrity
Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Types of Security Models

A 
State Machine Models
Multi Lattice Models
Matrix Models
noninterference Models
Information Flow Models
Confinement
Data in Use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

List the 7 EAL levels

Common Criteria Assurance Level

A

EAL 1 Functionally tested
EAL 2 Structurally tested
EAL 3 Methodically tested and checked
EAL 4 Methodically designed, tested and reviewed
EAL 5 Semi-formally designed and tested
EAL 6 Semi-formally verified design and tested
EAL 7 Formally verified design and tested

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define Certification

A

evaluation of security and technical/non-technical features meet requirement (verify it does what it says it does)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define Accreditation

A

Declare that an IT system is approved to operate in predefined conditions (verify it is right for out system, network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Use of Cryptography

A 
Confidentiality
Integrity
Proof of Origin
Non-repudiation
Protect Data at Rest
Protect Data in Motion
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the Orange Book

A

Collection of criteria based on the Bell-Lapadula Model used to grade or rate the security offered by a computer system product.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Trusted Computer System Evaluation (TCSEC)

A

Evaluates OS, application and system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Green Book

A

Password Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is Red Book
Similar to Orange book, but addresses network Security
26
Chain of Custody
Important to Maintain to prove integrity of evidence to be admissible in court
27
Interview Notes (Evidence collection)
Discoverable Evidence | State Only Facts, No opinions
28
Core competencies of Forensics
Media Analysis Network Analysis Software Analysis Embedded Devices
29
Criminal Court Types of Verdicts
Guilty or Not Guilty Beyond a reasonable Doubt
30
Civil Court Types of Verdicts
Liable or NOT liable Preponderance of the evidence (There can be some doubt, however, the evidence leans a certain direction)
31
Do you call immediately call law enforcement when a crime has happened
Follow what Policy and Senior Management dictate
32
Symmetric Algorithms
``` DES - (Broken) 3DES AES Skip Jack Blowfish Twofish RC4 IDEA CAST ```
33
Asymmetric Algothrims
Diffie-Hellman RSA Elgamal (terrible, subject to cipher text attack) Elliptical
34
Parole Evidence Rule
Whatever is in written agreement is what will win in court. Cant have a written contract, then a verbal agreement later
35
Two Kinds of Failure Modes
Physical Security Failure Mode | Logical Security Failure Mode
36
Logical Failure Modes
Fail Open - Availability is main concern Fail Closed - Main concern is confidentiality and/or Integrity Fail Secure - "Fail into a consistent state" fails to desired state Fail Soft - "fail in to a diminished operating capacity"; essentially Hibernate mode Fail Safe - "When I fail, I take nothing else with me"
37
Physical Failure Modes
Fail Secure - Locks Doors both ways (no in or out) Fail Safe - Locks Doors one way (get out but not in) Fail Open - Does not lock (can get in and out)
38
Physical Failure Modes
Fail Secure - Locks Doors both ways (no in or out) Fail Safe - Locks Doors one way (get out but not in) Fail Open - Does not lock (can get in and out)
39
Incident Response Steps
``` 1. Triage Detect Assess Communicate *React 2. Corrective/Investigation Containment Eradication Root Cause Analysis 3. Recovery Getting back to pre incident production 4. Lessons Learned Ask 3 questions Could we have responded better? Could we have prevented this incident completely Are we sure it was the root cause? ```
40
Disaster Recovery Plan Testing Plans
1. Desk Check 2. Tabletop Exercise 3. Structured Walkthrough 4. Parallel 5. Full scale
41
When is disaster considered over
Disaster is officially over when business is back at 100 percent operational to whatever designated site is to be used
42
Disaster recovery attributes
Recover Most critical First | Moving to hot site/temp location
43
Disaster restoration attributes
Recover least critical first | Moving from hot site/temp location back or to new permanent location
44
Types of Communications Plans
Hazard Communications plan | Personnel Communications plan
45
Crime Prevention through environmental Design (CPTED)
The ability to create land scaping that will identify boundaries, slow,
46
4 foot fence keeps out how many intruders
Casual intruders
47
6 foot fence keeps out what intruder
Most Intruders
48
8 foot fence keeps out what intruders
Determined Intruders
49
If a gate is in front of a residence, not matter the type
is considered a residential gate
50
Types of Commercial Gates
``` residential Gate (in front of homes) Vehicle Gate (controls flow of vehicles) Industrial Gate (controls flow of people) Penitentiary Gate (chain link man trap) ```
51
Type of Security Lights
``` Sodium Light (yellow Hue) This is the best because it works in foggy environment ```
52
Window Security Best Practices
``` Steel Frames Not near doors first floor place landscaping in front to deter or prevent access Tempered glass laminate/wired mesh for tempered glass ```
53
How to Detect broken Windows
Capacitance (Low voltage around window. when broken circuit breaks) Volume Metric Acoustical
54
Five classes of fire
Class A. Paper, wood, conventional (ASH) Class B. Flammable Liquids (Beverage) (don't spray water on this) Class C. Electrical Fire (turn off power) (Circuit) Class D. Metals (Dent metal) Class E.
55
Fire needs
Oxygen Fuel Heat
56
What does Fire Suppression try to stop or restrict during fire
Oxygen Fuel Heat
57
Types of Sprinkler System for fire suppression
Wet Pipe Deluge (flooding) Dry Pipe (Pressurized Air) Halon (removes oxygen, dangerous for humans) ARO-K ( FM200 ARGON ( Replace oxygen, suppresses fire, safe for humans)
58
Recommended Fire suppression systems in server environments
ARO-K ( FM200 ( ARGON (Replace oxygen, suppresses fire, safe for humans)
59
Types of alternative Sites
Cold Site (Location with no equipment, but have an alternate place available) Warm Site (Various level of backup in between cold and hot site some equipment readiness in alternate site) Hot Site (Equipment ready for use. Just restore latest backups and go, likely daily update) Mirroring (Equipment ready, backups sent and restored offsite immediately) Redundant Operations (most expensive as there are dual operations (least amount of down time or impact)
60
Alternatives to Alternative Sites
Mobile Site (business work trailer) Reciprocal Agreements (Other company agrees to support and you support their company, bad idea, must rely on company) Outsourcing (get other company to work my business_ Cloud Hypervisor
61
What impacts Electric Performance
Voltage | Amperage
62
External Monitoring
Time domain reflectometry (TDR) - uses light to help detect intrusion. Coaxial Strain sensitive Cable (CSSC) - Uses electricity Microwave - emitter on one end, receiver on the other, if plane in broken by person, it will set it off. (can go through dry items, even concrete walls) Guard (human can react to new situations)
63
What is external monitoring
Monitors intrusion and alerting people exactly where and how far away
64
Volume Metric
sets sound in room, if somethin enter room, it changes the metric and sets alarm
65
Motion Detector Technology
Volume Metric | Doppler Detection
66
RAID Types
``` RAID0 Striping RAID1 Mirroring RAID3 Parity RAID4 Parity RAID5 Parity RAID 10 striping and Mirroring RAID 15 Parity and Mirroring ``` https://www.prepressure.com/library/technology/raid

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions