Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

cissp > Random > Flashcards

Random Flashcards

1
Q

What is RFC 6749

A

OpenID Connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is RFC 6749?

A

OAuth 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is RFC 5849?

A

OAuth 1.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does multi-homed device mean?

A

A multi-homed device has more than one network connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How often can electronic vaulting occur?

A

Daily, hourlyy, weekly,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What must a user have for all information processed in system high mode?

A

A security clearance and access approval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is geotagging?

A

An investigative technique in which idenfiies the physical location of a given decice by examining the characteristics of the content that is generated by the device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does an attacker typically have in a brute-force attack?

A

Only the ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the ISC Code of Ethic canons?

A
  1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
  2. Act honorable, honestly, justly, responsibily and legally
  3. Provide diligent and competent service to principals
  4. Advance and protect the profession.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is secondary storage?

A

Non-volatile memory such as ROMs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the NIST SP 800-30?

A

Guide for conducting risk assessments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In Micrsoft’s SDL when is static analysis performed?

A

During the Implementation Phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In Microsoft’s SDL when is dynamic analysis and fuzz testing performed?

A

They are both performed in the Verification Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In Microsoft’s SDL when is the incident response plan created?

A

In the Release Phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are examples of circuit switched technology?

A

T1, POTS, ISDN, PPP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are examples of packet switched technologies?

A

Frame-Relay, X.25 (replaced by FR).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the seven categories of access controls?

A
  1. Directive
  2. Deterrent
  3. Preventive
  4. Compensating
  5. Detective
  6. Corrective
  7. Recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is prevention obsfucation?

A

Attempting to make code obscure to computers. Making it difficult to de-obfuscate or to decompile the code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is lexical obfuscation?

A

Renaming classes, fields, and methods and replacing them with new identifiers that lack intuitive meaning. E.g. replacing salary with the letter “a”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is control flow obsfucation?

A

Deals with making an application harder to understand or to decompile.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is NIC teaming?

A

Combining multiple physical network adapters into a virtual NIC which will be presented to the OS as a single NIC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the function of ARP?

A

It assigns IP addresses to MAC addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the function of RARP?

A

It assigns MAC addresses to IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the steps of BCP development process?

A
  1. Develop a BCP policy statement.
  2. Conduct a BIA
  3. Identify preventive controls
  4. Develop recovery strategies
  5. Develop an IT contingency plan
  6. Perform DRP training and testing
  7. Perform BCP/DRP maintenance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a teardrop attack?

A

It is an attack attempting to cause DoS. An attacker sends fragmented packets to the server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is pharming?

A

This is DNS related where the is DNS cache poisoning. The attacker attempts to redirect users to a malicious website.

27
Q

What is RAID 10?

A

Striping for a set of mirrored disks.

28
Q

Class of fire suppression systems.

A

US Classes:
A - wood, paper, ordinary
B - liquids, gases
C - electrical equipment
D - Metals
K - Kitchen, such as oil-based or fat-based fires

29
Q

What is data hiding?

A

Data hiding is also known as encapsulation. It is used to isolate subjects and objects from each other. This is a characteristic of OOP.

30
Q

What is a collision domain

A

A collision domain is a network segment where collisions can occur when frames are sent among the devices on the network segment.

31
Q

What is a broadcast domain?

A

A broadcast domain is a network segment where all devices receive a copy of a broadcast sent out by a device within the network segment.

32
Q

What is the main goal of Federated Identity Mangement?

A

Process of providing access to a company’s data resources to organizations or parties that are not owned by the company.

33
Q

Is SSO a FIM model?

A

No.

34
Q

Under the GDPR when must companies inform authorities of major data breaches?

A

Within 72 hours.

35
Q

What is code freezing?

A

When everything is complete and code no longer require any changes, the code is frozen so no further edits can be made.

36
Q

What is code check-in?

A

This is the same as code commits.

37
Q

What is code check-out?

A

Code is checked-out when developer does not what anyone else to edit the code but themselves.

38
Q

What type of deny rule does most firewalls have be default?

A

Implicit Deny. All traffic that are not explicitly permitted are implicitly denied.

39
Q

What will happen if a firewall is configured with an implicit allow rule?

A

Any packets that are not explicitly denied are implicitly permitted.

40
Q

Explicit is?

A

Specifically defining something.

41
Q

Which plain is centralized on a SDN network?

A

Only the control plane is centralized.

42
Q

What is in the data plane of SDN architecture?

A

The networking devices sit on the data plane of an SDN network. i.e. Layer2/3 Switches, and end devices.

43
Q

What are network management protocols?

A
  • Telnet
  • SSH
  • SNMP
  • Syslog
44
Q

What type of access control is antivirus software?

A

Corrective access control

45
Q

What type of biometric access control is susceptible to counterfeiting?

A

Fingerprint scans

46
Q

What is the safest fire suppression system in an electric environment?

A

FE-13

47
Q

What is Target of Evaluation (ToE) in CC?

A

the system or product that is to be tested

48
Q

What is ST in CC?

A

The security target is the documentation that describes the ToE and any security requirements.

49
Q

What is the goal of the common criteria?

A

The goal of the CC is to identify and remove known vulnerabilities from a product. Rather than discover new vulns.

50
Q

What is the common criteria?

A

It is an international standard used to test the security of IT products.

51
Q

What standard is Bluetooth?

A

IEEE 802.15

52
Q

What type of encryption cipher does Bluetooth v2.1 use?

A

It uses E0. Which is a weak encryption. The key length is 128bits but due to vulnerabilities it is effectively only 38-bits.

53
Q

What encryption does Bluetooth 4.1 use?

A

AES with CBC-MAC (AES-CCM)

54
Q

What is FHSS?

A

This is a modulation technique that changes radio channels in a synchronized pattern.

55
Q

How do capacitance detectors work?

A

They work based on electromagnetic fields

56
Q

How does wave pattern motion detectors work?

A

They transmit ultrasonic or microwave signals to the monitor area, watching for change sin the returned signals bouncing off objects.

57
Q

What is TCSEC?

A

Trusted Computer System Evaluation criteria sets basic requirements for assessing the effectiveness of computer security controls built into a computer system.

58
Q

Why is a requirements traceability matrix (RTM) used in software testing?

A

the function of TM.RTM is to check if the current project requirements are being met, and to help in the creation of a request for proposal, software requirements specification, various deliverable documents, and project plan tasks.

59
Q

In which phase would the penetration tester look for vulns and design the attack?

A

Discovery Phase.

60
Q

What is XACML?

A

Extensible Access Control Markup Language (XACML) deals with authorisation. It presents a standard for assessing authorisation requests. It is used to express security policies and access rights to assets provided through web services and other enterprise applications.
XACML is a standard language for access control that allows for communication between the access control system and implementation, even if they are from a different vendor.

61
Q

What is a compensating control?

A

A compensating control attempts to make up for problems with an existing control or to add additional controls to improve a primary control.

62
Q

What occurs during registration?

A

Users are enrolled in a biometric system

63
Q

What happens during the processing phase of eDiscovery?

A

Rough cut of the collected information for relevance.

64
Q
A

cissp (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions