Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Test Study 3 > Flashcards

Test Study 3 Flashcards

1
Q

What is the difference in a patent and a trade secret.

A

A patent is legal protection, however what you are protecting is now made public. A trade secret is kept hidden and the only legal protection is from theft.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which application tier involves how an application functions?

A

Tier 2, application logic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What identity method is commonly used by large providers, such as Facebook?

A

OAuth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which step of the DREAD model talks about how bad an attack may be?

A

Damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a trade secret?

A

A formula, process, or design that is generally not known by others and has viable commercial use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are 3 types of backups?

A

Full backup
Differential
Incremental

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What part of the RMF involves ongoing review and updating of controls?

A

Monitor and Update

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which step of the DREAD model talks about how easy it is to identify the threat?

A

Discoverability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What two phases of the penetration test loop until the test is completed?

A

Discovery and Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the term for hiring a person to perform activities normally performed by a computer?

A

HumBot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which ‘due’ deals with research and planning?

A

Due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A computer is given an IP of 172.17.5.20, what caused this?

A

RFC1918

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a differential backup?

A

Backup the changes since the last full backup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which application tier involves HTML?

A

Tier 1, presentation tier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What US agency upholds the GDPR?

A

US Department of Commerce

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is 802.5

A

Token Ring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What happens during the assess step of the RMF?

A

Having an independent assessor test the controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a generational fuzzer?

A

An intelligent fuzzer that has an understanding of the file format or protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the DREAD model?

A 
Damage
Reproducibility
Exploitability
Affected Users
Discoverability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the three application tiers?

A

Tier 1 - Presentation and organization, HTML and Javascript
Tier 2 - Application logic, functions, programming, C#, C++, Java
Tier 3 - Data tier, databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What can obfuscate a message that works on words or entire blocks of words?

A

Code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is something that XACML does NOT provide?

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is OVAL?

A

Open Vulnerability Assessment Language

Open standard for identifying vulnerabilities and not tied to any proprietary architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which fuzzer is only ‘smart’

A

Generational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What business model has four levels?

A

TOGAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is an incremental backup?

A

Backup the changes since the last backup, full or incremental.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What permissions are around Open Source?

A

Permission to use the original source code design and content in any way.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is NoSQL?

A

A database type created to address the limitations and vulnerabilities associated with relational databases.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What part of the RMF involves making risk determinations based on risk assessments?

A

Authorize

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Graph?

A

A NoSQL implementation that organizes information as nodes, relationships, and properties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What can be implemented as a policy enforcement point between users and a cloud provider?

A

CASB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

In cryptology, what is DEA?

A

Data encryption algoright

Substitution and permutation to 16 rounds.

33
Q

Which fuzzer is only dumb?

A

Mutation

34
Q

What database type was created to address the limitations and vulnerabilities associated with relational databases?

A

NoSQL

35
Q

What are the steps of “the” risk management framework?

A 
Categorize
Select
Implement
Assess
Authorize
Monitor
36
Q

What step of the penetration testing phase involves gaining access, escalating privileges, browsing for additional systems, and installing additional tools?

A

Attack

37
Q

What protocol provides TCP/IP over serial?

A

SLIP

38
Q

What is TOGAF?

A 
The Open Group Architecture Framework
Defines four model levels:
Business
Application
Data
Technology
39
Q

Which NIST rule is related to selecting controls to categorize systems?

A

NIST 800-60

40
Q

What is the standard for token ring?

A

802.5

41
Q

What provides attribute based access control to provide authorization?

A

XACML

42
Q

What is a non-proprietary standard for identifying vulnerabilities?

A

OVAL

43
Q

What permission are around Freeware?

A

Software provided without charge, however there may be limitations on how it is supposed to be used.

44
Q

Which backup is many small backups that all are required to recover?

A

Incremental

45
Q

Which step of the DREAD model talks about how easy it is to launch the attacks?

A

Exploitability

46
Q

What is NIST 800-60

A

Categorization, controls to categorize systems

47
Q

What happens during the categorize step of the RMF?

A

Discovering, identifying, and assigning security roles to an IT system,

48
Q

A computer is given an IP of 169.254.3.20, what caused this?

A

DHCP failure, APIPA

49
Q

What is APIPA?

A

Automatic Private IP Addressing
Self assigning an IP address in case of DHCP failure.
169.254.x.x range

50
Q

What is a HumBot?

A

A human robot, a person who will manually perform activities in place of a computer.

51
Q

What happens during the select step of the RMF?

A

Identify and choose the appropriate controls needed to reduce risk.

52
Q

What does Fibre Channel over Ethernet do?

A

Replaces FC0 and FC1 layers with Ethernet
Allows Fibre Channel to use 10 Gigabit ethernet networks while maintaining the fibre channel protocol
Encapsulates Fibre Channel frames over ethernet networks

53
Q

Freebie

A

Blank

54
Q

What database organizes information as nodes, relationships, and properties?

A

Graph

55
Q

What is a mutation fuzzer?

A

A dumb fuzzer that blindly fuzzes the input and doesn’t understand the structure.

56
Q

What are the steps in the penetration testing methodology?

A

Planning
Discovery
Attack
Reporting

57
Q

What part of the RMF involves discovering, identifying, and assigning security roles to an IT system?

A

Categorize

58
Q

Which ‘due’ deals with activities and decisions?

A

Due Care

59
Q

What happens during the montior step of the RMF?

A

Ongoing review and updating of controls and security status.

60
Q

What is the difference in OAuth and OpenID?

A

OpenID is based on OAuth, however OpenID provides an ID token.

61
Q

What business model has five guides?

A

ITIL

62
Q

What part of the RMF involves having an independent party test the security controls?

A

Assess

63
Q

What is RFC1918?

A

A group of internal IP ranges.

  1. x.x.x
  2. 16-31.x.x
  3. 168.x.x
64
Q

What happens during the authorize step of the RMF?

A

Management reviews a risk assessment and makes a risk determination on whether the risk is acceptable.

65
Q

What does XACML provide?

A

Authorization

66
Q

Which step of the DREAD model talks about the scope of the damage?

A

Affected Users

67
Q

What is SLIP?

A

Serial line interface protocol

Provides TCP/IP over serial connection.

68
Q

In what pen test phase are the scope and objectives defined?

A

Planning

69
Q

What part of the RMF involves putting selected controls into place?

A

Implement

70
Q

What is a CASB?

A

Cloud access security broker

A security enforcement point between the consumer and the cloud provider.

71
Q

What is the name of the IP range assigned when DHCP fails?

A

APIPA

72
Q

What are some tenets of ITIL?

A

It is best practicies on how to use IT as a tool to facilitate business change.
Advocates that services must be aligned to the needs of the business.
Has five core guides.

73
Q

Which non-full backup type has the largest footprint?

A

Differential

74
Q

Which application tier stores data?

A

Tier 3, data tier

75
Q

What happens during the implement step of the RMF?

A

Put into place the selected security controls.

76
Q

What part of the RMF involves choosing the appropriate controls needed to reduce risk?

A

Select

77
Q

How many rounds does DEA perform on its data?

A

16

78
Q

Which pen test phase occurs alongside the others?

A

Reporting

79
Q

What is XACML

A

Extensible Access Control Markup Language
Implements attribute based access control to determine whether a principal should be granted access to a system. Only provides authorization.

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions