Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Final Revision > Flashcards

Final Revision Flashcards

(77 cards)

Start Studying
1
Q

Biometrics: CER/ERR =?

A

Crossover Error Rate, also = ERR
Equal Error Rate, also = CER

Where FRR = FAR

The lower the CER/ERR the more accurate the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Biometrics: Type 1 error

A

false rejection rate (FRR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Biometrics: Type 2 error

A

false acceptance rate (FAR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does Kerberos address?

A

SSO for Confidentiality and integrity and availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What form of cryptology is kerberos based on?

A

Symmetric Key cryptology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does Kerberos exchange passwords?

A

Hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Kerberos:

KDC =
AS = 
TGS =
TGT =
TP =
A 
KDC = Key Distribution Center
AS = Authentication Server
TGS =Ticket Granting Service
TGT =Ticket Granting Ticket
TP = Trust Principle (Resource)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IPSEC:

Transport mode =
Tunnel Mode =

A

End to End encryption= Transport = Only payload encrypted

Link Encryption = Tunnel = All headers encrypted and payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SSL/TLS

Use =
Purpose =
Cryptographic components =

A

Use = securing web protocols

Purpose = Confidentiality, Authentication, Integrity

Cryptographic components = Encryption, HMAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

HTTPS

Use =
Purpose =
Cryptographic components =

A

Use = ssl/tls on top of http

Purpose = Confidentiality, Authentication, Integrity

Cryptographic components = Encryption, HMAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

FTPS

Use =
Purpose =
Cryptographic components =

A

Use = ssl/tls on FTP

Purpose = Confidentiality,

Cryptographic components = Encryption,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SSH

Use =
Purpose =
Cryptographic components =

A

Use = secure channel

Purpose = Confidentiality, Integrity

Cryptographic components = Encryption, HMAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SFTP

Use =
Purpose =
Cryptographic components =

A

Use = HHS on FTP

Purpose = Confidentiality,

Cryptographic components = Encryption,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

S/MIME

Use =
Purpose =
Cryptographic components =

A

Use = secure email

Purpose = Confidentiality, Integrity, Non repudiation

Cryptographic components = Encryption, HMAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IPSEC Components, name their functions.

AH = 
ESP = 
IKE = 
SA = 
SPI =
A

AH = Authentication Header (Function: Integrity, Origin authentication, replay attack protection (HMAC)

ESP = Encapsulating Security Payload (Function: Integrity Origin authentication, replay attack protection,
confidentiality (HMAC & Symmetric Encrption)

IKE = Internet Key Exchange (Function: Device Authentication and Establishing Security Association)

SA = Security Association (Function: negotiation that includes the algorithms that will be used (Hashing and encryyption), key length, key information.

SPI = Security Parameter Index (Function: Security association Identifier)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Cipher attacks: order of usefulness?

chosen cipher text
known plain text
chosen plain text
cipher text only

A

1 - cipher text only
2 - known plain text
3 - chosen plain text
4 - chosen cipher text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Cryptography

name 3 algorithms

A

Diffie-Helman-Merke
RSA (Rivest, Shamir-alderman)
ECC (Elyptic Curve Cryptography) *current standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

digital signatures require 2 algorithms:

A 
Hashing Algorithm (e.g. SHA-x)
digital signature function (RSA, DSA (digital signature algorithm)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

digital signature provide:?

A

non-repudiation and integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SESAME, what is it?

A

Secure European Systems for Applications in a multi-vendor environment

public key cryptography, like kerberos. but used for applications not operating systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

federated identity:

A

an arrangement among enterprises for authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

federated identity

1 - SAML
2 - OAuth 2.0
3 - OpenID ,
4 - OpenID Connect

A

1 - SAML (Security Assertion Markup Language)
2 - OAuth 2.0 (Authorisation, think facebook game asking for access)
3 - OpenID ,
4 - OpenID Connect( provides authentication for OAuth 2.0, replacement for SAML)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SAML =
IdP =
SP =
Principle =

A 
SAML = Security Assertion Markup Language
IdP =  Identity Provider
SP = Service Provider
Principle = User
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Network Attack:

SMURF

A

ICMP spoofs packet header to appear attack originated on the victim and send to a broadcast, all machines respond to the victim DOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Network Attack: | Teardrop
uses fragmented packets to confuse the system and crash
26
Network Attack: | Fraggle
similar to SMURF but uses UDP
27
Network Attack:Land Attack
sends a TCP syn attack and spoofs the source as its self so the system loops round and engages with itself.
28
Common Criteria: TOE: PP: ST: SFRs: * EAL0 – * EAL1 – * EAL2 – * EAL3 – * EAL4 – * EAL5 – * EAL6 – * EAL7 –
TOE: Target of evaluation PP: Protection Profile ST: Security Target SFRs: Security Functional Requirement * EAL0 –Inadequate assurance * EAL1 –Functionally tested * EAL2 –Structurally tested * EAL3 –Methodically tested and checked * EAL4 –Methodically designed, tested and reviewed * EAL5 –Semi formally designed and tested * EAL6 –Semi formally verified design and tested * EAL7 –Formally verified design and tested
29
Humidity %?
> 40 and < 60 (static v corrosion)
30
Fire Extinguishers: A B C D
A Common (Water, Soda ACID) B - Liquids -(Gas/CO2, SODA Acid) C - Electrical ( GAS CO2) D - Metals (Dry Powder)
31
types of sprinklers Wet pipe = Dry pipe = Deluge = Pre Action =
Wet pipe = always contains water Dry pipe = water waiting in tank Deluge = releases large amounts of water/foam Pre Action = water in tanks, fills pipes when heat detected, thermal nozzle melts
32
Common ports: 20/21
FTP
33
Common ports: 22
SSH
34
Common ports: | 23
telnet
35
Common ports: | 25
SMTP
36
Common ports: | 69
TFTP
37
Common ports: | 110
POP2
38
Common ports: | 123
NTP
39
Common ports: | 143
IMAP
40
Common ports: | 67/68
DHCP
41
Common ports: | 515
LPD
42
software testing 2x strategies
1 - negative testing (ensures application can gracefully handle invalid input) (populating required fields etc) 2 - positive testing (dtermines if applications works as expected)
43
software testing 2x use case scenarios
1 - use case (description of interaction between system and its environment 2 - misuse case - (from perspective of a hostile actor)
44
software testing (structural coverage) 7x Types of structural coverage:
``` 1 - Statement 2 - Decision (Branch) 3 - Condition 4 - multi-condition 5 - loop 6 - path 7 - data flow ```
45
software testing (structural coverage) Statement
sufficient test cases for each program statement to be executed once
46
software testing (structural coverage) Decision (Branch)
sufficient tests cases for each program decision is run an each possible outcome occurs once (minimum level of coverage)
47
software testing (structural coverage) Condition
sufficient test cases for each condition in a program decision to take on all outcomes at least once.
48
software testing (structural coverage) multi-condition
SUFFICIENT TEST CASES TO EXCERCISE ALL POSSIBLE COMBINATIONS OF CONDITIONS
49
software testing (structural coverage) loop
all loops for 0, 1, 2 and many iterations covering initialization, typical ruining and termination boundaries
50
software testing (structural coverage) path
each feasible path
51
software testing (structural coverage) data flow
each data flow
52
Software Testing (modes) 6x modes
``` 1 - Unit 2 - Integration 3 - Validation 4 - Vulnerability 5 - Acceptance 6 - Regression ```
53
Security Assessment and Testing ROE
= Rules of engagement (document), defines the parameters and expected testing team.
54
Security Assessment and Testing | 5 x approaches
``` 1 - External Untrusted 2 - External trusted 3 - Internal Untrusted 4 - Internal trusted 5 - Tenant to Tenant ```
55
Security Assessment and Testing | 1 - External Untrusted
internet based non-authenticated 3rd party attempting to gain unauthorised access
56
Security Assessment and Testing | 2 - External trusted
internet based authenticated (given some credentials) 3rd party attempting to gain unauthorised access
57
Security Assessment and Testing | 3 - Internal Untrusted
inside network, non-authenticated 3rd party attempting to gain unauthorised access
58
Security Assessment and Testing | 4 - Internal trusted
inside network, authenticated( given some credentials) 3rd party attempting to gain unauthorised access
59
Security Assessment and Testing | 5 - Tenant to Tenant
external attack originating from a tenant instance in multi-tenant environment.
60
Security Assessment and Testing | 2 types of testing
1 - overt | 2 - covert
61
Security Assessment and Testing | 4x levels of testing team knowledge
1 - Zero 2 - Partial 3 - Full 4 - Hybrid
62
Security Assessment and Testing 3 versions of SSAE16-SOC reports: SOC1 = SOC2= SOC3=
SOC1 = financial statements SOC2= based on Trust Service Principles, reports on security: availability, processing integrity, confidentiality and privacy. SOC3= same as SOC2 but does not detail testing performed, designed for public distribution
63
Security Assessment and Testing 2 types of SSAE16-SOC reports: Type 1 = Type 2 =
Type 1 = point in time report showing the controls in place, cant evaluate the operating effectiveness Type 2 = reports on design and implementation over a period of time (generally 6 or 12 months)
64
NIST SP-800-137
information security continuos monitoring annual FISMA reporting (federal agencies)
65
electronic discovery includes 9 phases =
``` information governance identification collection processing review analysis production presentation ```
66
Code Review: | what is the most formal code review process?
Fagan inspections only found in highly restrictive environments where flaws may be catestrophic
67
6x Fagan Code Review steps
``` 1 - planning 2 - overview 3 - preparation 4 - inspection 5 - rework (rework goes back to planning stage) 6 - follow up ```
68
Types Code testing:
``` Static Testing Dynamic Testing Fuzz Testing Mutation (dumb) Fuzzing (zzuf tool) Generational (intelligent) fuzzing ```
69
Code Review: | Static Testing
evaluates security of software without running it. usually uises automated tools to detect common flaws.
70
Code Review: | Dynamic Testing
tests during run time (only option when apps written by 3rd party) includes testing such as looking for SQL injection etc.
71
Code Review: | Fuzz Testing
provides many different types of input to stress its limits. specially crafted to trigger known exploits or randomly for new exploits. tester monitors performance to watch for crashes or buffer overflows etc.
72
Code Review | Mutation (dumb) Fuzzing (zzuf tool)
takes previous input values from actual operation of software and manipulates it.
73
Code Review | Generational (intelligent) fuzzing
develops data models and creates new fuzzed input based on understanding of the data types used.
74
how many bytes long is a TCP header
20-60
75
5x stages of the Software Capability Maturity Model (SW-CMM)
``` 1 = Initial - little or no defined software process 2 = Repeatable - basic life cycle managment process 3 = defined - well defined and followed 4 = managed - quantitive measures are utilized to gain detailed insight 5 = Optimized - continuous improvement occurs, sophisticated software dev processes in place ```
76
5 stages of IDEAL model
``` 1 =Initiating 2 = Diagnosing 3 = Establishing 4 = Acting 5 = Learning ```
77
Nuemonic for IDEAL and SW CMM
II DR ED AM LO (left ideal, right SWCMM IDEAL also works on its own from top to bottom

CISSP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions