Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Domain 6 - Security Assessment and Testing > Flashcards

Domain 6 - Security Assessment and Testing Flashcards

(54 cards)

Start Studying
1
Q

Security Review

A

Conducted by system maintenance or security personnel

Goal is determine vulnerabilities within a system. Also known as a vulnerability assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Audit

A

Conducted by 3rd party

Determines the degree to which required controls are implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Penetration Testing

A 
Ethical hacking to validate discovered weaknesses
Red Teams (Attack)/Blue Teams (Defend)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

NIST SP 800-42

A

National Institute of Standards and Technology

Guideline on Security Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Zero Knowledge

A

Team has no knowledge of the target and must start with only information that is publically available. This simulates an external attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Partial Knowledge

A

The team has limited knowledge of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Full Knowledge

A

This simulates an internal attack. The team has full knowledge of network operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Blind

A

The assessors have only publicly available knowledge. The network teams knows that testing is taking place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Double Blind

A

The assessors have only publicly available knowledge, but in this instance the network teams do NOT know the test is taking place. This will allow evaluation of incident response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Targeted Testing

A

External consultants work with internal staff to focus on specific systems or applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

OSI Model

A 
Layer 1 Physical
Layer 2 Data Link
Layer 3 Network
Layer 4 Transport
Layer 5 Session
Layer 6 Presentation
Layer 7 Application
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

HTTP

HHTPS

A

80

443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

FTP

A

20/21

File Transfer Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

RDP

A

3389

Remote Desktop Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

DNS

A

53

Domain Name System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

FTPS

A

989/990

Secure File Transfer Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

TFTP

A

69

Trivial File Transfer Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DHCP

A

67/68

Dynamic Host Configuration Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ARP

RARP

A

Address Resolution Protocol

Reverse Address Resolution Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Ethernet standard

A

802.3

CSMA/CD Carrier Sense Multiple Access w/ Collison Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Wireless Standard

A

802.11

CSMA/CA Carrier Sense Multiple Access w/ Collison Avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Vlan Standard

23
Q

WEP

Auth, Encrypt, Integrity

Study These Flashcards
A

PSK Pre Shared Key
Wired Equivalent Protocol encrypted with RC4(Stream Cipher)
integrity check by CRC Cyclic redundancy check
64, 128,256 bit key, but -24 for IV(Initialization Vector) so actual 40,104,232 bit key

24
Q

WPA Personal

Auth, Encrypt, Integrity

Study These Flashcards
A

PSK
encrypted by TKIP(Temporary Key Internet Protocol) with RC4
Integrity by MIC Message Integrity Check
128 bit key + 48 bit IV

25
WPA Enterprise | Auth, Encrypt, Integrity
802.1x with RADIUS Server encrypted with TKIP and RC4 integrity by MIC 128 bit key + 48 bit IV
26
WPA2 Personal | Auth, Encrypt, Integrity
PSK encrypted CCMP(block-chain) with AES(block Cipher) integrity CBC-MAC Chain Block Cipher MAC 256 bit key
27
WPA2 Enterprise | Auth, Encrypt, Integrity
802.1x with RADIUS Server encrypted CCMP with AES integrity CBC-MAC 256 bit key
28
RIPv1 | Interior/exterior, type,class
IGP, Distance Vector, classful
29
IGRP | Interior/exterior, type,class
IGP, Distance Vector, classful | Cisco proprietary
30
RIPv2 | Interior/exterior, type,class
IGP, Distance Vector,classless
31
EIGRP | Interior/exterior, type,class
IGP, Distance Vector, classless | Cisco proprietary
32
OSPF | Interior/exterior, type,class
IGP, Link-state, Classless
33
IS-IS | Interior/exterior, type,class
IGP, Link-state, Classless
34
BGP | Interior/exterior, type,class
EGP, Path-vector, Classless
35
IAAA
``` Identification: Make a claim (userid etc) Authentication: Provide support (proof) for your claim Authorization: What rights and permissions you have Auditing: Accountability—matching actions to subjects ```
36
Access Control Types
Logical Physical Administrative
37
Authentication Type I
Something you know
38
Authentication Type II
Something you Have
39
Authentication Type III
Something you are
40
Type I Error
False Rejection(FRR)--A legitimate user is barred from access. Is caused when a system identifies too much information. This causes excessive overhead.
41
Type II Error
False Acceptance(FAR)—An impostor is allowed access. This is a security threat and comes when a system doesn’t evaluate enough information
42
CER
(Crossover Error Rate) The level at which the FAR and FRR meet. The lower the number, the more accurate the system.
43
Race Condition
try to cause authorization to happen before authentication
44
Single Sign On
``` Ease of use for end users Centralized Control Ease of administration Kerberos LDAP Sesame KryptoKnight ```
45
Kerberos
A network authentication protocol designed from MITs project Athena. Kerberos tries to ensure authentication security in an insecure environment Port 88 Allows for single sign on Never transfers passwords Uses Symmetric encryption to verify Identifications Avoids replay attacks
46
Kerberos Components
Essential Components: AS (Authentication Server): Allows authentication of the user and issues a TGT TGS: After receiving the TGT from the user, the TGS issues a ticket for a particular user to access a particular service KDC (Key Distribution Center) a system which runs the TGS (Ticket Granting Service) and the AS (Authentication Service) Ticket: Means of distributing Session Key Principles (users, applications, services) Kerberos Software (integrated into most Operating Systems. MS Windows 2000 and up support Kerberos) Main Goal: User needs to authenticate himself/herself without sending passwords across the network—needs to prove he/she knows the password without actually sending it across the wire.
47
SESAME
European technology, developed to extend Kerberos and improve on it’s weaknesses Sesame uses both symmetric and asymmetric cryptography. Uses “Privileged Attribute Certificates” rather than tickets, PACS are digitally signed and contain the subjects identity, access capabilities for the object, access time period and lifetime of the PAC. PACS come from the Privileged Attribute Server.
48
DAC
Discretionary Access Control Security of an object is at the owner’s discretion Access is granted through anACL (Access Control List) Commonly implemented in commercial products and all client based systems Identity Based
49
MAC
Mandatory Access Control Data owners cannot grant access! OS makes the decision based on a security label system Subject’s label must dominate the object’s label Users and Data are given a clearance level (confidential, secret, top secret etc)* Rules for access are configured by the security officer and enforced by the OS.
50
RBAC
Role Based Access Control Uses a set of controls to determine how subjects and objects interact. Don’t give rights to users directly. Instead create “roles” which are given rights. Assign users to roles rather than providing users directly with privileges.
51
AAA
Authentication Authorization Auditing
52
RADIUS
``` Port 1812, 1813 UDP 3 separate processes for AAA only encrypts user/pass uses Industry Standard ```
53
TACACS+
``` Port 49 TCP one process for AAA encrypts everything Cisco Devices ```
54
Guideline on Security Testing
National Institute of Standards & Tech SP 800-42

CISSP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions