Random CISSP Flashcards
(38 cards)
Sniffing attack
A sniffing attack uses a sniffer (also called a packet analyzer or protocol analyzer) to capture data and can be used to read passwords sent across a network in cleartext.
A side-channel attack
is a passive, noninvasive attack used against smart cards. Methods include power monitoring, timing, and fault analysis attacks.
role-based access control
A role-based access control policy grants specific privileges based on roles, and roles are frequently job based or task based.
Discretionary access controls
Discretionary access controls allow owners of information to control privileges
mandatory access controls
mandatory access controls use labels to control privileges
Clipping levels
Clipping is a form of nonstatistical sampling that reduces the amount of logged data based on a clipping-level threshold.
Log analysis reviews
Log analysis reviews log information looking for trends, patterns, and abnormal or unauthorized events.
Audit trails are considered to be what type of security control
Passive detective
Audit trails
Audit trails are a passive form of detective security control.
Synchronous token
A synchronous token generates one-time passwords and displays them in an LCD, and this password is synchronized with an authentication server.
asynchronous token
An asynchronous token uses a challenge-response process to generate the token.
Type 1 biometric error
A Type 1 error occurs when a valid subject is not authenticated and is also known as a false negative authentication.
Type 2 biometric error
A Type 2 error occurs when an invalid subject is authenticated. This is also known as a false positive authentication.
crossover error rate
The crossover error rate (also called equal error rate) compares the rate of Type 1 errors to Type 2 errors and provides a measurement of the accuracy of the biometric system.
What is the best choice to support federated identity management systems?
Service Provisioning Markup Language (SPML)
Service Provisioning Markup Language (SPML)
SPML is an XML-based framework used to exchange user information for single sign on (SSO) between organizations within a federated identity management system.
Access control matrix
An access control matrix includes multiple subjects and objects and lists subjects’ access to various objects.
federation
refers to a group of companies that share a federated identity management system for single sign-on.
User entitlement audit
A user entitlement audit can detect when users have more privileges than necessary.
A Type 2 authentication factor
is “something you have,” including a smart card, token device, or memory card.
Type 3 authentication
is “something you are,” and some behavioral biometrics include “something you do.”
Type 1 authentication
“something you know.”
All of the following are needed for system accountability except for one. Which one is not needed?
A) Identification
B) Authentication
C) Auditing
D) Authorization
Authorization
What type of access controls rely upon the use of labels?
Mandatory
