CISSP Exam Prep
What are the type of fire extinguishers?
A Common combustible B Liquid C Electrical Fire D Metal Burning
is a process of preparing media for reuse and assuring that data cannot be recovered using traditional recovery tools
Clearing, or overwriting
_________must be either uniquely identified by a witness or authenticated through a documented chain of custody.
Real evidence
which stores bits in small capacitors and slower and cheaper than than SRAM
Dynamic Random Access Memory
What is DRAM?
Dynamic Random Access Memory which stores bits in small capacitors and slower and cheaper than than SRAM
Explain the the need for security-minded acquisitions and what does it mean?
Integrating cyber security risk management with acquisition strategies and practices is a means to ensure a more robust and successful security strategy in organizations of all sizes.
Public Key infrastructure uses LDAP for what?
Integrating digital certificates into transmissions but remember PKI technology is used to manage digital certificates. LDAP is one of the protocols used when clients need to query a certificate authority.
What is a Bastion host?
It is a hardened computer implementation. It is a special computer on a network to sustain an attack. It's characteristics consists of a hosted single application.
What is a gateway?
It is a network device or service that working at the Application layer. It serves as a protocol translation tool. For example, an IP-to-IPX gateway takes inbound communications from TCP/IP and translates them over to IPX/SPX for outbound transmission
What is a Redundant Site?
It is a site owned by the company and mirrors the original production environment
In order to investigate an email related crime, what is the venue be familiar with the internal operations of the email server used to send that email.
Knowledge of internal operations of such servers is not necessary and if needed, assistance can be sought from Network administrators who maintains the server
What are the two conceptual approaches to intrusion detection?
Knowledge-based intrusion detection uses a database of known vulnerabilities to look for current attempts to exploit them on a system and trigger an alarm if an attempt is found. The behaviour-based or statistical analysis-based is another conceptual approach.
Which of these would be easier for an investigator to locate? Internet Email user
LAN email systems are specific to a company and are used by employees only, hence easier to locate
to network performance refers to the delay that packet may experience on their way to reach the destination from the source
Latency
What IDS monitors the general patterns of activity and traffic on the network, and create a database of normal activities within the system.
Neural Network Based IDS
what is the Simple Security Property?
No read up
What is the Simple Security Property?
No read up deals with confidentiality ---a secret subject can not read a top secret subject. This follows under Bell Lapula Model and no write down
A central authority directrs what subjects can have access to certain objects based on the organizational security policy under what type of access control?
Non-Discretionary Access Control
Rule-Based Access Control (RuBAC) access is determined by rules. Such rules would fit within what category of access control ?
Non-Discretionary Access Control
AppleTalk and IPX is what type of protocol?
Non-IP Protocols
some computer designs use two buses what are they?
Northbridge and Southbridge
what are tools that provide real-time analysis of events occurring on systems throughout an organization they include agents install the remote systems that monitor for specific events known as alarm triggers
Security Event Management SEM
What is best described as those that can be performed manually at a tolerable cost for an extended period of time.?
Sensitive functions
What is a Permanent Virtual Circuit?
a connection type uses a logical circuit that always exists and waits for customers to send data?
What is acquisition analysis access appropriation?
The sequence of steps of an attack methodology
remember The meet‐in‐the‐middle attack demonstrated that it took relatively the same amount of computation power to defeat 2DES as it does to defeat standard DES. This led to the adoption of Triple DES (3DES) as a standard for government communication.
To determine the number of keys in a key space, raise 2 to the power of the number of bits in the key space.
what is hyperlink spoofing?
To direct a user to a malicious server
When would you use hardware encyption?
To implement encryption into systems in such a way that it goes as fast as possible. This is to ensure that users do not have to wait too long. For such speedy encryption, his best option is to use
Is based on Life Cycle Assurance Requirements -steps are: Security Testing, Design Specification, Configuration Management, Trusted System Distribution.
Trusted Distribution
IPSec can be run in either tunnel mode or transport mode.
Tunnel mode is most commonly used between gateways, or at an end-station to a gateway, the gateway acting as a proxy for the hosts behind it. Transport mode is used between end-stations or between an end-station and a gateway, if the gateway is being treated as a host
What are some disadvantages of Tunneling?
Tunneling is generally an inefficient means of communicating because all protocols include their own error detection, error handling, acknowledgment, and session management features, and using more than one protocol at a time just compounds the overhead required to communicate a single message.
What is the IP header contains a protocol field for UDP?
UDP=17
What are the LAN transmission methods?
Unicast, Multicast, Broadcast
How would you prevent a replay attack?
Using one time authentication mechanism in sequence session for identification.
What are some of the vulnerabilities of a web server?
Web servers ordinarily listen on TCP port 80 and are thus listening for incoming SYN packets and thus are subsepitible to SYN flood attacks
Can Website be defaced with 'read' access to the server?
Website defacement requires 'write' access on the web server's root directory
How does the Graham Denning Model operate?
addresses how access rights between subjects and objects are defined, developed, and integrated. It defines a set of basic rights in terms of commands that a specific subject can execute on an object.
What is an SQL injection?
allow hackers to bypass normal access controls and gain access to the database supporting a web application
With a Likelihood Assessment what reflects the number of times a business expects to experience a given disaster each year?
annualized rate of occurrence or ARO
The use of the SCRIPT tag is a tell tale sign of a ____________attack.
cross-site scripting (XSS) attack
What is a Neural Network Based IDS?
monitors the general patterns of activity and traffic on the network, and create a database of normal activities within the system.
What is a Mutual assistance agreement?
popular in disaster recovery literature but difficult to implement. They are agreements between two parties to mutually assist one another in the event of disaster.
define overall risk management process
process of identifying factors that could damage or disclose data, evaluating those factors in light of data value and countermeasure cost, and implementing cost-effective solutions for mitigating or reducing risk is known as risk management
What is the Simple Security Policy?
prohibits subjects from reading a higher security level..no read up
What are the The first two phases of the BCP process
project scope and planning and the business impact assessment
To manage the security function, an organization must implement what?
proper and sufficient security governance. The act of performing a risk assessment to drive the security policy is the clearest and most direct example of management of the security function.
The Computer Fraud and Abuse Act does what? protects computers
protects computers used by the government or in interstate commerce from a variety of abuses
SHA-2 supports variable lengths of what?
ranging up to 512 bits
The primary goal of risk management is to?
reduce risk to an acceptable level.
What is Software Prototyping?
refers to building software application prototypes which display the functionality of the product under development but may not actually hold the exact logic of the original software.
What is Tayloring?
refers to modifying the list of security controls within a baseline so that they align with the mission of the organization.
What is Scoping?
refers to reviewing a baseline baseline security controls and determining what standard will be used or employed
What is Scoping?
refers to reviewing baseline security controls and selecting only those controls that apply to the IT system you're trying to protect
Remember: To begin the quantitative assessment, the BCP team should draw up a list of organization assets and then assign an asset value (AV) in monetary terms to each asset.
remember: The second quantitative measure that the BIA team must develop is the maximum tolerable downtime (MTD) , sometimes also known as maximum tolerable outage
if the compromised tickets are used within an allotted time window what is that called?
replay
Both WPA and WPA2 supports?
supports the enterprise authentication known as 802.1x/EAP, a standard port-based network access control that ensures clients cannot communicate with a resource until proper authentication has taken place
test
test
RAID levels 3 and 5 run ____________on hardware
faster
What is the The Open Group Architecture Framework (TOGAF) ?
is a vendor-neutral platform for developing and implementing enterprise architectures. It focuses on effectively managing corporate data through the use of metamodels and service-oriented architecture (SOA). AIt also adjusts to new innovations and capabilities to ensure new changes can easily be integrated into the enterprise platform.
What is an The access control matrix?
is a way of describing the rules for an access control strategy. The matrix lists the users, groups and roles down the left side and the resources and functions across the top. The cells of the matrix can either indicate that access is allowed or indicate the type of access
What is content dependent access control?
it is focused on the internal data in each field
Remember this: A static packet filtering firewall is the simplest and least expensive type of firewalls, offering minimum security provisions to a low-risk computing environment.
A static packet filter firewall examines both the source and destination addresses of the incoming data packet and applies ACL's to them. They operates at either the Network or Transport layer...
What Stores MAC addresses for the purpose of forwarding frames
CAM table
What are especially vulnerable to buffer overflow attacks because they are developed rapidly and are available to external users?
CGI and other web-based programs
Name at least seven security management concepts and principles
CIA Triad, confidentiality, integrity, availability, privacy, identification, authentication, authorization, auditing, accountability, and nonrepudiation
What is a preferred way to suppress an electrical fire in a computer server?
CO2 It must be noted that Halon is now banned in most countries or cities. The reason CO2 is preferred in an information center is the agent is considered a clean agent, as well as non-conductive.
Meeting Stakeholder Needs, Covering the Enterprise End to End, Applying a Single Integrated Framework, Enabling a Holistic Approach, Separating Governance From Management is what
COBIT 5 framework
the HTTP proxy is used as a means to implement what?
content filtering
What you are able to implement a sound risk management policy in terms of quantitative risk analysis?
exposure factor or E F
Exposure factor (EF)
%
What size is an MD5 message digest
128 bits
What is a dedicated line?
A dedicated line is always on it is reserved for specific customer. These are such as T3E1E3 and cable modems for example.
Value or benefit of a safeguard
ALE1 - ALE2 - ACS
How is abstraction used
Abstraction is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions
who grants access to data based on guidelines provided by the data owners.
Administrators
What is a Hypervisor?
Allows multiple virtual operating systems run on one host.
What should only provide the recovery of critical systems? And if automation cant occur how can processing take place?
Business Continuity Plan for critical systems while manual procedures for processing occurs
COBIT is a ____________governance framework?
COBIT is an IT governance framework not a security governance framewook
What is the control framework to manage IT risk and governance?
Control Objectives for Information and Related Technology
Which of the following statement INCORRECTLY describes network device Bridge? a. Bridge filters traffic based on MAC address b. Bridge forwards broadcast packets c. Bridge assigns a different network address per port d. Bridge reads header information but does not alter i
Correct Answer is: c. Bridge assigns a different network address per port
What are the three goals of the Business Impact Analysis?
Criticality prioritization, downtime estimation, and resource requirements are the three primary goals
Cryptography does NOT help in
Cryptography is a detective control in the fact that it allows the detection of fraudulent insertion, deletion or modification but it usually does not offers any means of detecting disclosure
means that DHCP servers can assign IP addresses to only selected systems which are identified by their MAC addresses?
DHCP snooping
What are aggregate functions?
DIFFERENCE()is not a valid aggregate function. COUNT(), MIN(), and SUM()are aggregate functions specified in SQL.
Who are typically third-party entities that process data for an organization?
Data processors
Which of the following is not appropriate in addressing object reuse?
Deleting files on disk before reusing the object
what stores all files that have been modified since the time of the most recent full backup; they affect only those files that have the archive bit turned on, enabled, or set to 1?
Differential backups
Data owners decide who has access to resources based only on the identity of the person accessing the resource is what kind of access?
Discretionary Access Control
What is due diligence?
Due diligence is the act of investigating and understanding the risks the company faces. A company practices by developing and implementing security policies, procedures, and standards.
This is the amount of damage that the risk poses to the asset, expressed as a percentage of the asset's value?
Exposure Factor
The RAID Advisory Board has defined three classifications of RAID:
Failure Resistant Disk Systems (FRDSs), Failure Tolerant Disk Systems, and Disaster Tolerant Disk Systems.
It is when a valid user is rejected by the system is called what?
False Reject or Type I Error
What are used to enforce referential integrity constraints between tables that participate in a relationship?
Foreign Keys
Name at least six protocol services used to connect to LAN and WAN communication technologies
Frame Relay, SMDS, X.25, ATM, HSSI, SDLC, HDLC, ISDN
What are packet switched services described?
Frame relay and X.25 networks
What are the following network devices is used to connect networks that are using different network protocols?
Gateway...
What are the Common logical data models?
Hierarchical database model Network model Relational model Object-relational database models
What combines both hierarchical and compartmentalized environments so that security levels have subcompartments?
Hybrid environments
What is the "International Common Criteria for Information Technology Security." It was developed as the standard for evaluating information technology products?
ISO 15408
___________is used in operations internal to the processor that must be performed requires no address because the operation is performed on the internal register.
Implied addressing.
How does end to end encryption work?
Information stays encrypted from one end of its journey to another
__________are used to ensure that transactions are properly entered into the system once?
Input Controls
Which virus spreads by multiple methods?
Multipartite
Which is the best recommended water system for a computer room?
Preaction. Preaction combines both the dry and wet pipe systems and allows manual intervention before a full discharge of water on the equipment occurs.
_____________is deployed to stop unwanted or unauthorized activity from occurring
Preventive access control
What is RAID-2
RAID-2 is no longer used
What type of memory is secure and maintains its integrity?
ROM
Why is ROM so reliable when it comes to security?
ROM is burned at the factory and then unchangeable. Thus, ROM is the most secure because it will always maintain its integrity
remember this: Unit testing uses set of test cases that focus on control structure of procedural design. These tests ensures internal operation of the programs according to the specification.
Remember this :concepts of change control and change management. Change introduces loopholes, overlaps, missing objects, and oversights that can lead to new vulnerabilities. The only way to maintain security in the face of change is to systematically manage change
Remember this an attack related to phishing is pre-texting which is the practice of obtaining your personal information under false pretenses.
Remember this hash totals and CRC checks can use to verify message integrity.
Remember this: Capabilities Tables are bound to a subject while and Access Control List (ACL) is bound to an object
Remember this: Assigning the values for the inputs to a purely quantitative risk assessment requires both a lot of time and significant experience on the part of the assessors. The most experienced employees or representatives from each of the departments would be involved in the process.
Remember this: Auditing, or monitoring is means by which subjects are held accountable for their actions
Remember this: Auditing is also the process by which unauthorized or abnormal activities are detected on a system.
Remember this: Accreditation is the official management decision to operate a system. Accreditation is the formal declaration by a senior agency official Designated Accrediting Authority (DAA information system is approved to operate at an acceptable level of risk
Remember this: Continuous authentication is a type of authentication that provides protection against impostors who can see, alter, and insert information passed between the claimant and verifier even after the claimant/verifier authentication is complete
Remember this: Layering of processes implements a structure similar to the ring model used for operating modes
Remember this: Nondiscretionary access control enables the enforcement of systemwide restrictions that override object-specific access control.
Remeber this: Trade secrets are one of the best legal protections for computer software.
Remember this: Using a block list or black list is a valid form of security filtering; it is just not a form of spoofing filtering.
Remember: Evaluation criterias are defined as a benchmark, standard, or yardstick against which accomplishment, conformance, performance, and suitability of an individual, hardware, software, product, or plan, as well as of risk-reward ratio is measured.
Remember: Fences should be Eight feet high and two feet out.
What is notice, choice, onward transfer, security, data integrity, access, and enforcement?
Safe Harbor principles
what was the predecessor to Point to Point protocol?
Serial Line Internet Protocol (SLIP) which offered no authentication
__________is the person who owns the system that processes sensitive data?
System Owners
identifying business priorities is what number task in the Business Impact Assessment?
The First Task
Which of the following is a class C fire? soda acid liquid common combustibles electrical
The correct answer is: electrical.
What is a way of describing the rules for an access control strategy?
The matrix lists is a strategy the users, groups and roles down the left side and the resources and functions across the top. The cells of the matrix can either indicate that access is allowed or indicate the type of access
What attack specifically targets encryption algorithms that use two rounds of encryption, such as Double DES?
The meet in the middle attack
Brute-force attacks are attempts to randomly fi nd the correct cryptographic key. Known plaintext, chosen ciphertext, and chosen plaintext attacks require the attacker to have some extra information in addition to the ciphertext.
The meet-in-the-middle attack exploits protocols that use two rounds of encryption. The man-in-the-middle attack fools both parties into communicating with the attacker instead of directly with each other.
what does the motherboard contain?
The motherboard contains hardware including the CPU, memory slots, firmware, and peripheral slots such as peripheral component interconnect slots
In Mandatory Access Control, sensitivity labels attached to object contain what information?
The object classification and category
What manages complex data such as required for computer-aided design and imaging.
The object-relational and object-oriented models
A CA acts as a front end to a RA, verifying the identity of the entity requesting a certificate True or False?
The opposite is true. "An RA acts as a front end to a CA by receiving end entity requests, authenticating them, and forwarding them to the CA". Pg 532, Official ISC2 Guide to the CISSP CBK, 4th Ed
The largest acceptable size for an ICMP packet is 65,536 bits
The parol evidence rule states that a written contract is assumed to contain all the terms of an agreement and cannot be modified by a verbal agreement.
What is provided by the operating system where it uses a combination of RAM and disk storage to simulate a much larger address space than is actually present?
Virtual storage
Name at least five possible threats that should be evaluated when performing a risk analysis
Viruses; buffer overflows; coding errors; user errors; intruders (physical and logical); natural disasters; equipment failure; misuse of data, resources, or services; loss of data; physical theft; denial of service
What is located right behind your first Internet facing firewall
Your DMZ
What is used to create a robust enterprise architecture, not a security architecture, technical or not. The framework is not security specific.
Zachman Architecture Framework
What is an exposure factor?
amount of damage that the risk poses to the asset
What is normally stored on ________ to allow for "flash" updates when the BIOS needs revision.
an EEPROM chip
_____________identifies the resources that are critical to an organization's ongoing viability and the threats posed to those resources?
business impact assessment
What creates a virtual circuit, or a point-to-point connection between a client and a server, but they don't know all of the details about this specific application that's being proxied on certain criteria that are met or not met to be accepted, or the traffic could be denied, or the traffic could be discarded
circuit-level proxy firewall
Capacitance detectors monitor what?
electrical field surrounding the object being monitored. They are used for spot protection within a few inches of the object, rather than for overall room security monitoring used by wave detectors.
Enkoder Form Enkoder Form is designed to prevent
email harvesting
the four steps of the business continuity planning process?
four distinct phases: project scope and planning, business impact assessment, continuity planning, and approval and implementation.
Behavior-based intrusion detection is what?
intrusion detection techniques assume that an intrusion can be detected by observing a deviation from normal or expected behavior of the system or the users
What is Sanitization?
is any number of processes that prepares media for destruction. It ensures that data cannot be recovered by any means from destroyed or discarded media.
What is third-party governance of security?
is the system of oversight that may be mandated by law, regulation, industry standards, or licensing requirements
Secure Sockets Layer (SSL) uses a Message Authentication Code (MAC) for what purpose
message integrity
What is the agile software development methology?
methodology prioritizes flexible development that emphasizes responding to change over following a plan
Hardware and software maintenance access controls are used to what?
monitor the installation of, and updates to, hardware and software to ensure that the system functions as expected and that a historical record of changes is maintained. Integrity verification programs are more integrity controls than software maintenance controls.
Children's Online Privacy Protection Act of 1998 for websites have certain restrictions, what are they?
must have a privacy notice that clearly states the types of information they collect and used for any information is disclosed to third parties--must also include contact information for the operators of the site.
What is The Computer Security Act?
outlines steps the government must take to protect its own systems from attack.
remember this: an off-site information processing facility should have the same amount of physical access restrictions as the primary processing site.
remember this::off-site information processing facility should not be easily identified to prevent intentional sabotage.
What is a Primary Key?
selected from the set of candidate keys for a table to be used to uniquely identify the records in a table
What is an entity that can exploit a vulnerability?
threat agent
FTPS and SFTP are what?
two ways of transferring files
Annualized rate of occurrence (ARO)
# / year
Annual cost of the safeguard $ / year
$ / year
Risk management - NIST Special Publication 800-30 has the following 8 steps
1. System Characterization 2. Threat Identification 3. Vulnerability Identification 4. Control Analysis 5. Likelihood Determination 6. Impact Analysis 7. Risk Determination 8. Control Recommendations 9. Results Documentation
What is the the number of encryption rounds depends on the key length chosen when it comes to AES when it comes to 128 bit keys?
10 rounds of encryption
In the United States, trademarks are granted for an initial period of__________________________
10 years and can be renewed for unlimited successive 10‐year periods.
What is the maximum length of cable that can be used for a twisted-pair, Category 5 10Base-T cable
100 meters
What is the maximum throughput rate and maximum usable distance for 10Base2 cable
10Base2 cable has a throughput of 10 Mbps and can be run up to distances of 185 meters
Rijndael requires ________ rounds of encryption when used with 192-bit cryptographic keys.
11 rounds
What is the the number of encryption rounds depends on the key length chosen when it comes to AES when it comes to 192-bit keys require
12 rounds of encryption
How many bits is the address space reserved for the source IP address within an IPv6 header?
128 Bits
AES uses key sizes of______________
128 bits or 192 bits and AES 256 uses a key size of 256 bits.
The AES cipher allows the use of three key strengths what are they?
128 bits, 192 bits, and 256 bits.
Twofish is a block cipher. It operates on______
128-bit blocks of data and is capable of using cryptographic keys up to 256 bits in length
What is the the number of encryption rounds depends on the key length chosen when it comes to AES when it comes to 256-bit keys require
14 rounds of encryption
Triple DES has an effective key length of?
168 bits
What is the maximum effective key length of the Triple DES (3DES) encryption algorithm?
168 bits
You are assessing an encryption algorithm that uses an 8-bit key. How many possible key values exist in this approach?
256
What is the maximum key size for Rijndael cipher?
256 bits
Which represents the maximum distance of a single run of Category 5 cable?
328 feet
An ethernet address is composed of how many bits?
48 bits that is hardwired into the NIC
What is a good key size for DES?
56 bits
What is the effective key size of DES?
56 bits
mwhat is the maximum allowed ping packet size?
65,536 bytes
The maximum allowed ping packet size is _________
65,536 bytes.
to engage in the ping of death attack, the attacker must send a packet that exceeds the maximum allowed ping packet size, what is the size?
65,537 bytes
size of the frame that sniffers capture is usually __ bytes. 70 68 60 78
68
ISO 17799 11 areas, renumbered as ISO 27002. Broad-based approach for infosec code of practice is 1. Policy 2. Organization of information security 3. Asset management 4. Human resources security 5. Physical and environmental security 6. Communications and operations management
7. Access control 8. Information systems acquisition, development, and maintenance 9. Information security incident management 10. Business continuity management 11. Compliance
What key size is used by the Clipper Chip
80 bits
NIST has published continuity planning best practices in
800-34
The term personal area network is most closely associated with what wireless technology?
802.15 (aka Bluetooth) creates personal area networks (PANs).
what is a MAC-Based security measure and each device that wants to talk on the network must have a valid certificate.
802.1x
remember this:To protect against replay attacks, the Kerberos authentication protocol uses the concept of an authenticator.
A Kerberos authenticator is embedded in Kerberos protocol exchanges that occur between the authenticating client and authentication server in Windows, the domain controller—DC. It holds additional authentication data, such as the ticket lifetime, and most important, the client's timestamp.
What is a system is the best tool to search through large log files looking for intrusion-related events?
A Security Information and Event Management (SIEM) system
TCP sequence number attack is what?
A TCP sequence number attack exploits the communication session which was established between the target and the trusted host that initiated the session.
this is a hardware-imposed network segmentation created by switches that requires a routing function to support communication between different segments.
A VLAN
How do you distinguish between a bridge and a router?
A bridge simply connects multiple networks, a router examines each packet to determine which network to forward it to.
What is transparency
A characteristic of a service, security control, or access mechanism that ensures it is unseen by users
what is is designed to work well with a narrow range of other systems, generally all from the same manufacturer?
A closed system
What is a compensating control?
A compensating control is just an alternate control or a way of providing a similar protection such using a fence versus a security guard
Covert Storage Channel:
A covert channel that involves writing to a storage location by one process and the direct or indirect reading of the storage location by another process.
_________is the process undertaken by CAs to establish a trust relationship in which they rely upon each other's digital certificates and public keys as if they had issued them themselves.
A cross certification?
What is a segment?
A data object called in the Transport layer
Remote mirroring is the most advanced, complete, and expensive off-site backup solution. With this solution, a live database server is kept off site at some secure remote location.
A data object is called a datagram or a packet in the Network layer. It is called a PDU in layers 5 through 7It is called a segment in the Transport layer and a frame in the Data Link layer.
A persistent collection of interrelated data items can be defined as what
A database can be defined as a persistent collection of interrelated data items.
Remember this: A brute-force attack is an attempt to discover passwords for user accounts by systematically attempting every possible combination of letters, numbers, and symbols
A dictionary attack checks passwords against a database or dictionary. A rainbow table attack checks hashed values of passwords against the values stored in a rainbow table.
How are domains related to decentralized access control
A domain is a realm of trust that shares a common security policy. This is a form of decentralized access control
Remember this: The Computer Ethics Institute created the Ten Commandments of Computer Ethics.
A drawback of classification schemes, especially as implemented via a mandatory access control concept, is that they require significant administration for a large organization.
A momentary loss of power is what form of power issue is called?
A fault is any abnormal situation in an electrical system when electrical current does not flow through the intended parts.
What supports one-to-many relationships, often expressed in a tree structure?
A hierarchical DBMS
Physically securing the tapes from unauthorized access is obviously a security concern and is considered a function of the Security Operations Domain.
A keyed hash also called a MAC message authentication code is used for integrity protection and authenticity. a message authentication code is a generated value used to authenticate a message. The MAC protects both a message's integrity as well as its authenticity, because only someone who knows the secret key could have modified the message.
What is a replay or playback attack?
A malicious user records the traffic between a client and a server and then retransmits them to the server with slight variations of the timestamp and source IP address. It is similar to hijacking
What should be calculated using all of the original file's data?
A message digest
Remember this: Nonrepudiation requires the use of a public key cryptosystem to prevent users from falsely denying that they originated a message
A mode is the method in which the IPSec protocol is applied to the packet. IPSec can be used in tunnel mode or transport mide Typically, the tunnel mode is used for gateway-to-gateway IPSec tunnel protection
What does not "directly " sense motion there is a narrow beam that won't set off the sensor unless the beam is broken?
A photoelectric sensor Photoelectric sensors, along with dry contact switches, are a type of perimeter intrusion detector.
_________is a unique identifier in the table that unambiguously points to an individual tuple or record in the table?
A primary key
What is tunneling, and why is it used
A process that protects the contents of packets by encapsulating them in another protocol. This creates the logical illusion of a communications tunnel through an untrusted intermediary network
What looks at higher layers in terms of the OSI model, so it can read application specific information to decide whether or not the traffic should be allowed through.
A proxy firewall
The Internet Security Glossary (RFC2828) defines an attribute certificate as a digital certificate that binds a set of descriptive data items, other than a public key, either directly to a subject name or to the identifier of another certificate that is a public-key certificate.
A public-key certificate binds a subject name to a public key value, along with information needed to perform certain cryptographic functions. Other attributes of a subject, such as a security clearance, may be certified in a separate kind of digital certificate, called an attribute certificate.
remember this: A threat is an event or activity that has the potential to cause harm to the information systems.
A risk is the probability that a threat will materialize. A vulnerability, or weakness, is a lack of a safeguard, which may be exploited by a threat, causing harm to the information systems.
What is ia domain of trust that shares a single security policy and single management?
A security domain is a domain of trust that shares a single security policy and single management.
What reviews change requests and evaluates them for potential negative impacts. All changes aren't necessarily approved or rejected. The analysis doesn't attempt to identify changes?
A security impact analysis
WHat is responsible for enforcing a security policy. It is a strict implementation of a reference monitor mechanism.
A security kernel
Data classification programs are put in place is to ensure all types of data are protected in the most cost beneficial way possible
A security policy is a document that portrays a senior manager directives it outlines Security roles and responsibilities, data classification, needs and goals, level of risk that a company is willing to accept
What filters traffic by examining data from a message header
A static packet-filtering firewall
What is suitable for hardware implementation?
A stream cipher treats the message as a stream of bits or bytes and performs mathematical functions on them individually
What is the star property?
A subject at a given security level must not write to any object at a lower security level - no write down this is also known as the confinement property
Which of the following is a proximity identification device that does NOT require action by the user and works by responding with an access code to signals transmitted by a reader?
A transponder--A transponder is a proximity identification device that does not require action by the user.
What is a Caesar cipher?
A very simple substitution cipher that can be easily defeated and it does show show repeating letters
Which best defines a virtual machine?
A virtual instance of an operating system A virtual machine can also be called a guest, which runs in a host environment. The host environment—usually an operating system—
What is a stealth virus?
A virus that hides itself from OSes and other protective software, such as antivirus shields is what?
What can be defined as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire? a. Authority revocation list b. Certificate revocation tree c. Untrusted certificate list d. Certificate revocation list
A. Authority revocation list The Internet Security Glossary (RFC2828) defines the Authority Revocation List (ARL) as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire.
Which of the following is NOT a true statement about public key infrastructure (PKI)? a The Registration authority role is to validate and issue of digital certificates to end users b Root certificate authority's certificate is always self signed c The Registration authority (RA) acts as a verifier for Certificate Authority (CA) d The Certificate authority role is to issue digital certificates to end users
A. The Registration authority role is to validate and issue digital certificates to end users A PKI (public key infrastructure) enables users of a basically unsecure public network such as the Internet to securely and privately exchange data and money through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority.
NIST released FIPS 197, which mandated the use of ___________for the encryption of all sensitive but unclassified data by the US government.
AES
Of the following which is the strongest symmetric encryption algorithm, 3DES, AES, RSA 3AES
AES
Annualized loss expectancy (ALE) ALE
ALE = SLE * ARO or ALE = AV * EF * ARO
The ALE is calculated using the following formula
ALE = single loss expectancy (SLE) times annualized rate of occurrence (ARO)
Calculating Safeguard Cost/Benefit is:
ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard ACS = value of the safeguard to the company
what is annualized loss expectancy ALE and how is it calculated?
ALE is an element of quantitative risk analysis that represents the possible yearly cost of all instances of a specifi c realized threat against a specific asset. The formula is ALE = single loss expectancy SLE * annualized rate of occurrence ARO
what are passed with each API call to authenticate the API user?
API keys
Single loss expectancy (SLE) SLE = AV * EF
AV times EF AV X EF
What is used to defi ne what types of data an object can contain, what types of functions can be performed on or by that object, and what capabilities that object has.
Abstraction
What are firewall policy actions?
Accept, Discard
Preventing unwanted software installations are best handled by what form of control?
Access Control
What is is the automated mechanism that can prevent or permit system changes, installations, and updates on a selective basis?
Access Control
what is the difference between an ACL in a capability table?
Access Control Lists are object focus and identify access granted to subjects for any specific object. capability tables are subject focus and identify the object that subjects can access
Remember this: In a smurf attack, the attacker sends a single forged packet bearing a source address corresponding to the victim machine.
Access control is any hardware, software, or organizational administrative policy or procedure that grants or restricts access, monitors and records attempts to access, identifies users attempting to access, and determines whether access is authorized.
Access controls consists of
Access control refers to a wide area of protection of data, system and user access.
When ensuring that subjects can only access objects through the use of an application ... This is referred to as what?
Access triple Under the security model framework, some models enforce separation of duties which divide operations into different parts- ensures subjects access objects to the application. The subject must go to an application to access an object.
If a security mechanism offers availability, then it offers a high level of assurance that authorized subjects can _____ the data, objects, and resources. Control Audit Access Repudiate
Accessibility of objects and resources is the goal of availability. If security is involved, then data, resources are accessible to authorized subjects
The TCP _______scan sends an _______ packet, simulating a packet from the middle of an already established connection.
Acknowledgment
What is the non interference model?
Actions take place at a higher security level do not affect actions at the lower security level
To validate system capability and functionality to return to a normal system state and plan for future outages what needs to occur?
Activation/Notification phase
What interpret DoS and read-only memory ROM BIOS calls, looking for malware like actions?
Active Monitors
What is the default valuation clause property insurance. It is also known as depreciated value. It involves estimating the amount to be subtracted, which reflects the building s age, wear, and tear?
Actual Cash Value (ACV)?
What improves the security of password hashing?
Adding salts to the passwords before hashing them reduces the effectiveness of rainbow table attacks
how cryptographic salts improve the security of password hashing?
Adding salts to the passwords before hashing them reduces the effectiveness of rainbow table attacks
Remember this Secuirity baselines don't apply equally to all organizations. Instead, organizations as they use scoping and tailoring techniques to identify the security controls to implement in their baselines.
Additionally, organizations ensure that they implement security controls mandated by external standards that apply to their organization
What is an aggregation attack?
Aggregation attacks involve the use of specialized database functions to combine information from large number of database records revealing information that is more sensitive than the info a single record would reveal
You work for a software development house. Your main concern is being first to market with new software products. What software development model would be best to use.
Agile
Agile development is a phrase used in software development to describe methodologies for incremental software development.
Agile development is a phrase used in software development to describe methodologies forAgi development is an alternative to traditional project management where emphasis is placed on empowering people to collaborate and make team decisions in addition to continuous planning, continuous testing and continuous integration.
What is a phrase used in software development to describe methodologies for incremental software development emphasis is placed on empowering people to collaborate and make team decisions in addition to continuous planning, continuous testing and continuous integration
Agile software development
What does the Digital Signature Standard allow?
Allows the federal government use Digital Signature Algorithm, RSA, or the Elliptic Curve DSA in conjunction with the SHA-1 hashing function to produce a digital signature
The Kernel mode is what?
Also referred to as system mode, is one of the two distinct modes of operation of the CPU (central processing unit) in Linux. The other is user mode, a non-privileged mode for user programs, that is, for everything other than the kernel.
Remember this: Other services after a disater, in descending priority order are: IS operations, IS support services, market structure, marketing/public relations
Also, after a disaster,customer service & systems support, market regulation/surveillance, listing, application development, accounting services, facilities, human resources, facilities security, legal and Office of the Secretary, national sales
What act amendends criminalize scausing damage to federal systems, federal interest systems, and computers involved in interstate commerce
Amendments to the Computer Fraud and Abuse Act
What are the functions of an intrusion detection system (IDS)?
An IDS automates the inspection of audit logs and real-time system events, detects intrusion attempts, and watches for violations of confidentiality, integrity, and availability
Remember this: Metadata is data that provides information about other data Two types of metadata exist: structural metadata and descriptive metadata. Structural metadata is data about the containers of data. Descriptive metadata uses individual instances of application data
An IS auditor must review the change management process, including patch management procedures, and verify that the process has adequate controls and make suggestions accordingly.
What generates and displays one-time passwords using a challenge-response process to generate the password?
An asynchronous token
What is a man-in-the-middle attack?
An attack in which a malicious user is positioned between the two endpoints of a communication's link
Which of the following offers confidentiality to an e-mail message
An e-mail message's confidentiality is protected when encrypted with the receiver's public key, because he is the only one able to decrypt the message. The sender is not supposed to have the receiver's private key.
WHat is an object-relational database?
An object-relational database (ORD), or object-relational database management system ORDBMS, is a database management system (DBMS) classes and inheritance are directly supported in database schemas and in the query language.
What is generally involved in the processes of risk management
Analyzing an environment for risks, evaluating each risk as to its likelihood and damage, assessing the cost of countermeasures, and creating a cost/benefit report to present to upper management
What is electronic vaulting? a. Information is backed up to tape on a hourly basis and is stored in a on-site vault. b. A transfer of bulk information to a remote central backup facility. c. Information is backed up to tape on a daily basis and is stored in a on-site vault. d. Transferring electronic journals or transaction logs to an off-site storage facility
Answer B A transfer of bulk information to a remote central backup facility. bElectronic vaulting is defined as "a method of transferring bulk information to off-site facilities for backup purposes". Remote Journaling is the same concept as electronic vaulting, but has to do with journals and transaction logs, not the actual files.
Which one of the following determinations might result from a qualitative risk assessment? A. Annualized loss expectancy B. Single loss expectancy C. Categorical prioritization D. Exposure factor
Answer C. Qualitative risk assessment uses nonnumerical factors, such as categorical prioritization. The other choices listed are examples of factors used in quantitative risk assessment.
An amplification network is used to wage a DoS attack in which of the following? A.Smurf attack B.Spamming attack C.Teardrop attack D. Land attack
Answer: A A smurf attack occurs when an amplifying server or network is used to flood a victim with useless data.
An amplification network is used to wage a DoS attack in which of the following? A. Smurf attack B. Spamming attack C. Teardrop attack D. Land attack
Answer: A A smurf attack occurs when an amplifying server or network is used to flood a victim with useless data.
What is used to increase the strength of cryptography by creating a unique cipher text every time the same message is encrypted with the same key? A. Initialization vector B. Vignere cipher C. Steganography D. Stream cipher
Answer: A An initialization vector (IV) is a random bit string (a nonce) that is the same length as the block size that is XORed with the message. IVs are used to create a unique cipher text every time the same message is encrypted with the same key.
A _______________ contains levels with various compartments that are isolated from the rest of the security domain. A. Hybrid environment B. Compartmentalized environment C. Hierarchical environment D. Security environment
Answer: A Hybrid environments combine both hierarchical and compartmentalized environments so that security levels have subcompartments.
In what type of cryptographic attack does the attacker interfere with the connection establishment and then gain access to all subsequent communications? A. Man-in-the-middle attack B. Chosen plain-text attack C. Birthday attack D. Meet-in-the-middle attack
Answer: A In the man-in-the-middle attack, the attacker sits between the two communicating parties and relays messages between them. Both parties think they are communicating directly with each other.
On a much smaller scale, _______________ is deployed to repair or restore capability, functionality, or resources following a violation of security policy. A. Recovery access control B. Corrective access control C. Detective access control D. Compensation access control
Answer: A Recovery access control is deployed to repair or restore resources, functions, and capabilities after a violation of security policies.
Which one of the following cipher types operates on individual characters or bits of a message without knowledge of what came before or after? A. Stream cipher B. Caesar cipher C. Block cipher D. ROT3 cipher
Answer: A Stream ciphers operate on one character or bit of a message (or data stream) at a time.
In an agile software development process, how often should business users be involved in development? A. Daily B. Weekly C. Monthly D. At each release
Answer: A The agile development process requires that business users interact with developers on a daily basis.
What is the primary purpose of most viruses today? A. Infecting word processor documents B. Creating botnets C. Destroying data D. Sending spam
Answer: B Most viruses are designed to add systems to botnets, where they are later used for other nefarious purposes, such as sending spam or participating in distributed denial of service attacks.
What malicious code avoidance technique provides users with the ability to identify code originating from a trusted source? A. Sandboxing B. Control signing C. Whitelisting D. Access permissions
Answer: B Control signing utilizes a system of digital signatures to ensure that the code originates from a trusted source. It is up to the end user to determine whether the authenticated source should be trusted.
What feature of the TCP/IP protocol suite makes it possible for tools like Loki to bypass firewall restrictions by passing otherwise prohibited traffic across the network sentry using ICMP? A. Dynamic IP addressing B. Encapsulation C. VLSM D. Supernetting
Answer: B Encapsulation is the feature of the TCP/IP protocol suite that makes it possible for tools like Loki to bypass firewall restrictions by tunneling prohibited traffic through an alternate protocol, such as ICMP.
Which of the following choices is the most reliable method of destroying data on a CD? A. Degaussing B. Physical destruction C. Deleting D. Overwriting
Answer: B Physical destruction is the most reliable method of destroying data on any media, including a CD. Degaussing won't affect a CD. Deleting rarely deletes the data. Overwriting might destroy the data depending on the method used, but it isn't as reliable as physical destruction.
The Twofish algorithm uses an encryption technique not found in other algorithms that XORs the plain text with a separate subkey before the first round of encryption. What is this called? A. Preencrypting B. Prewhitening C. Precleaning D. Prepending
Answer: B Prewhitening XORs the plain text with a separate subkey before the first round of encryption.
Which source of interference is generated by electrical appliances, light sources, electrical cables and circuits, and so on? A. Cross-talk noise B. Radio frequency interference C. Traverse mode noise D. Common mode noise
Answer: B Radio frequency interference (RFI) is the source of interference that is generated by electrical appliances, light sources, electrical cables and circuits, and so on.
Which essential element of an audit report is not considered to be a basic concept of the audit? A. Purpose of the audit B. Recommendations of the auditor C. Scope of the audit D. Results of the audit
Answer: B Recommendations of the auditor are not considered basic and essential concepts to be included in an audit report. Key elements of an audit report include the purpose, scope, and results of the audit.
In an agile software development process, how often should business users be involved in development? A. Daily B. Weekly C. Monthly D. At each release
Answer: B Spoofing is the replacement of valid source and destination IP and port addresses with false ones. It is often used in DoS attacks but is not considered a DoS attack itself. Flooding, smurf, and ping of death are all DoS attacks.
Which of the following best describes change management? A. Preventing changes to systems B. Ensuring only approved changes are implemented C. Ensuring that changes do not reduce security D. Auditing privilege access
Answer: B The goal of change management is to ensure that any change does not lead to unintended outages or reduce security. Change management doesn't affect personnel safety. A change management plan will commonly include a rollback plan, but that isn't a specific goal of the program. Change management doesn't perform any type of auditing.
What is the primary purpose of change management? A. To prevent unwanted reductions to security B. To allow management to review all changes C. To delay the release of mission-critical patches D. To improve productivity of end users
Answer: B The primary purpose of change management is to allow management to review all changes. However, it is true that the overall goal of change management is to prevent unwanted reductions to security.
In addition to job rotation, what other security mechanism supports peer auditing? A. Separation of duties B. Principle of least privilege C. Mandatory vacations D. Job responsibilities
Answer: C Mandatory vacations support peer auditing by placing another user in a job position for at least a week every year.
The operating system design concept of protection rings was derived from what early operating system? A. Windows B. Unix C. Multics D. Macintosh
Answer: C Multics has left two enduring legacies in the computing world. First, it inspired the creation of a simpler, less-intricate operating system called Unix (a play on the word multics), and second, it introduced the idea of protection rings to operating system design.
What remote access protocol replaced SLIP? A.802.11 B. SSH C. PPP D. TLS
Answer: C PPP is a replacement for SLIP.
What database backup technology uses frequent, perhaps hourly, transfers of information between the primary and alternate sites? A. Remote mirroring B. Electronic vaulting C. Remote journaling D. Fault tolerance
Answer: C Remote journaling technology transfers copies of the database transaction log to the alternate site on a frequent basis.
The normal operations of a business are restored at the conclusion of the _______ phase of incident response. A. Identification B. Analysis C. Closure D. Lessons learned
Answer: C The closure phase includes the restoration of the normal business operations of an organization.
Which one of the following files is least likely to contain a virus? A. COMMAND.COM B. SOLITAIRE.EXE C. SECRET.TXT D. LOVE.VBS
Answer: C The filename extension .txt is normally used to describe text files, which do not contain executable code
When attempting to impose accountability on users, what key issue must be addressed? A. Reliable log storage system B. Proper warning banner notification C. Legal defense/support of authentication D. Use of discretionary access control
Answer: C To effectively hold users accountable, your security must be legally defensible. Primarily, you must be able to prove in a court that your authentication process cannot be easily compromised. Thus, your audit trails of actions can then be tied to a human.
A tunnel mode VPN is used to connect which types of systems? A. Hosts and servers B. Clients and terminals C. Hosts and networks D. Servers and domain controllers
Answer: C Tunnel mode VPNs are used to connect networks to networks or networks to hosts. Transport mode is used to connect hosts to hosts. Host, server, client, terminal, and domain controller are all synonyms.
The backup administrator configures a system to perform full backups on Sundays and differential backups on Mondays through Saturdays. The system fails on Wednesday. What backups must be applied? A. Sunday only B. Sunday, Monday, Tuesday and Wednesday C. Sunday and Wednesday only D. Sunday, Monday and Wednesday only
Answer: C With differential backups, you must first restore the most recent full backup and then apply the most recent differential backup.
In what scenario would you perform bulk transfers of backup data to a secure offsite location? A. Incremental backup B. Differential backup C. Full backup D. Electronic vaulting
Answer: D Electronic vaulting describes the transfer of backup data to a remote backup site in a bulk-transfer fashion.
_______________ is the process by which a subject provides a username, logon ID, personal identification number, and so on. A. Accountability B. Authentication C. Confidentiality D. Identification
Answer: D Identification is the process by which a subject professes an identity and accountability is initiated
Which one of the following alternate processing arrangements is rarely implemented? A. Hot site B. Warm site C. Cold site D. MAA site
Answer: D Mutual assistance agreements are rarely implemented because they are difficult to enforce in the event of a disaster requiring site activation.
Which of the following is a benefit of packet-switching technologies over circuit-switching technologies? A. Fixed known delays B. Connection oriented C. Sensitive to connection loss D. Supports bursty traffic
Answer: D Packet-switching technologies support bursty traffic rather than constant traffic. The others are benefits of circuit switching.
What method is not integral to assuring effective and reliable security staffing? A. Screening B. Bonding C. Training D. Conditioning
Answer: D Screening, bonding, and training are all vital procedures for ensuring effective and reliable security staffing because they verify the integrity and validate the suitability of said staffers
what proposes a framework for international enforcement of intellectual property protections. As of February 2015, the treaty awaited ratification by the European Union member states, the United States, and five other nations
Anti‐Counterfeiting Trade Agreement
What is a countermeasure?
Any hardware or software or procedure that helps to mitigate a potential risk
The two logs maintained in Apache server are 'error' logs and __ logs. network system request access
Apache server maintains error logs and access logs
Non-IP Protocols
AppleTalk and IPX
What determines the identity of the communication partners in the DoD Modeal where Non-Repudiation service would be provided as well and what layer does this reside in?
Application Layer
What are the layers of a software-defined network?
Application layer, Control layer, Infrastructure layer
FTP, TFTP, SNMP, and SMTP are provided at what level of the Open Systems Interconnect OSI Reference Model?
Application. The Layer 7 Application Layer of the Open Systems Interconnect (OSI) Reference Model is a service for applications and Operating Systems data transmission, for example FTP, TFTP, SNMP, and SMTP.
There are four layers that deal with both the physical and the software including drivers components. The four layers include:
Applications 3 Hardware 2 Operating System 1 Kernel 0
Threat modeling is the process of identifying, understanding, and categorizing potential threats, including threats from attack sources.
Asset valuation identifies the value of assets. Vulnerability analysis identifies weaknesses. An advanced persistent threat is a form of attack, often sponsored by a government.
what Communications is the basic language of modems and dial-up remote access systems?
Asynchronous Communication is the basic language of modems and dial-up remote access systems
What is cell switching technology?
Asynchronous Transfer Mode-ATM which is WAN communication technology at 53 byte cells
Defining Data Security Requirements, what steps should an organization take to protect email?
At a minimum, an organization should label and encrypt sensitive email. Using strong encryption methods such as Advanced Encryption Standard with 256-bit cryptography keys AES 256 makes it almost impossible for unauthorized personnel to read the text.
What encompasses a wide variety of different activities, including the recording of event/occurrence data, examination of data, data reduction, the use of event/occurrence alarm triggers, and log file analysis?
Auditing
Which of the following should NOT be a role of the Security Administrator?
Authorizing access rights For proper segregation of duties, the security administrator should not be responsible for authorizing access rights. This is usually the responsibility of user management/data owner.
This allows a PBX to be configured so that incoming calls are distributed to the next available agent or placed on-hold until one become available?
Automatic Call distribution
Which Orange book security rating introduces called "Labeled Security" and each data object must have a classification label and each subject a clearence label. On each access attempt, the classification and clearence are checked to verify that the access is permissable?
B1
Orange book security rating introduces security labels?
B1 is also called "Labeled Security" and each data object must have a classification label and each subject a clearence label. On each access attempt, the classification and clearence are checked to verify that the access is permissable.
What is covert channel analysis required for?
B2 Structured Protection normally includes covert channel, device labels, subject sensitivity labels, trusted path, trusted facility management, configuration management.
Who implements a combination of policies, procedures, and processes such that a potentially disruptive event has as little impact on the business as possible?
BCP planners
Which routing protocol enables routers on different autonomous systems to share routing information?
BGP
What are the business impact analysis steps? 1. Select individuals to interview for data gathering. 2. Create data-gathering techniques (surveys, questionnaires, qualitative and quantitative approaches). 3. Identify the company's critical business functions. 4. Identify the resources these functions depend upon.
BIA Steps 5. Calculate how long these functions can survive without these resources. 6. Identify vulnerabilities and threats to these functions. 7. Calculate the risk for each different business function. 8. Document findings and report them to management.
what are vectors for attackers to bypass security checks, such as authentication? Be wary when someone says something will make computing both easier and more secure.
Backdoors
Differential backup process will?
Backs up data labeled with archive bit 1 and leaves the data labeled as archive bit 1
Which addressing uses a value stored in one of the CPU's registers as the base location from which to begin counting. The CPU then adds the offset supplied with the instruction to the value and retrieves the operand from that computed memory location?
Base+Offset addressing
when using Link encryption, packets have to_______
Be decrypted at each hop
Why was Triple DES adopted as a standard for government communications?
Because the meet in the middle attack showed that it took the same computing power to defeat 2 DES as it would standard DES.
What type of intrusion detection techniques assume that an intrusion can be detected by observing a deviation from normal or expected behavior of the system or the users?
Behavior-based intrusion detection
Which of these is not permitted by the Bell-LaPadula Model? Read from a higher level of security Write to a higher level of security None of these Read at the same security level
Bell-LaPadula Model does not allow subjects to read from a higher level of security (relative to their own security level). Rest of the given options ar
The __________Model which describes rules for the protection of data integrity
Biba Integrity Model
What type of symmetric-key encryption algorithm that transforms a fixed-size block of plaintext unencrypted text data into a ________ of ciphertext encrypted text data of the same length. They are appropriate for software implementations and can operate internally as a stream.
Block ciphers
What use key sizes of 32 bits to 448 bits and is a strong encryption protocol?
Blowfish
What is another alternative to DES and IDEA. that operates on 64-bit blocks of text by allowing the use of variable-length keys ranging from a relatively insecure 32 bits to an extremely strong 448 bits?
Blowfish block cipher
What is BGP?
Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the Internet.
what keys can uniquely identify records in a table?
Both Primary and Candidate Keys
What supports the enterprise authentication known as 802.1x/EAP, a standard port-based network access control that ensures clients cannot communicate with a resource until proper authentication has taken place?
Both WPA and WPA2
The Clark-Wilson model focuses on data integrity. The Bell-LaPadula model supports data confidentiality.
Both the Biba model and the Clark-Wilson model address the integrity of data. The Clark-Wilson Integrity Model addresses the three integrity goals and defines constrained data items and integrity verification procedures, and confirms transformation procedures.
What is diameter for remote access?
Building on the success of radius in TACAcS + its an enhanced version of of radius. diameter supports a wide range of protocols including traditional IP mobile IP, voice over IP and supports extra commands it's popular were roaming support is needed such as wireless devices and smart phones.
Because scripts contain credentials, they must be stored in a protected area and the transmission of the scripts must be dealt with carefully. Operators might need access to batch files and scripts.
Business Continuity Plans are designed to minimize the damage done by the event, and facilitate rapid restoration of the organization to its full operational capacity. They are for use "after the fact", thus are examples of corrective controls
What is most critical to survival to an organization?
Business Impact Analysis
What measures the potential loss that could be caused by a disaster?
Business Impact Analysis
Who own the processes and ensure the systems provide value to the organization.
Business and mission owners
Who own the processes and ensure the systems provide value to the organization?
Business and mission owners
What does it mean when it says " do not put your eggs in one basket?"
By splitting or dividing your outfit into several divisions, branches, offices, and so on, you create multiple sites and reduce the impact of a major disaster.
Which one of the following files might be modified or created by a companion virus?
COMMAND.EXE
Remeber: The Committee of Sponsoring Organizations of the Treadway Commission (COSO)2 sponsor the National Commission on Fraudulent Financial Reporting, which studied factors that lead to fraudulent financial reporting and produced recommendations for public companies, their auditors, the Securities Exchange Commission, and other regulators.
COSO identifies five areas of internal control necessary to meet the financial reporting and disclosure objectives. These include: (1) control environment, (2) risk assessment, (3) control activities, (4) information and communication, and (5) monitoring.
What is Immediate addressing
CPU does not need to actually retrieve any data from memory. The data is contained in the instruction itself
What is a fast form of memory?
CPU registers are the fastest form of memory.
the notification requirements placed on organizations that experience a data breach occured where?
California's SB 1386 implemented the fi rst statewide requirement to notify individuals of a breach of their personal information.
the notification requirements placed on organizations that experience a data breach are?
California's SB 1386 implemented the first statewide requirement to notifyindividuals of a breach of their personal information. All but three states eventually followed suit with similar laws. federal law only requires the notification of individuals when a HIPAA‐covered entity breaches their protected health information
_____can be any column or a combination of columns that can qualify as unique key in database?
Candidate Key
What is a subset of attributes that can be used to uniquely identify any record in a table.
Candidate Keys
remember this: When an intrusion has been detected and confirmed, if you wish to prosecute the attacker in court, the following actions should be performed in the following order: Capture and record system information and evidence that may be lost, modified, or not captured during the execution of a backup procedure.
Capture and record system information and evidence that may be lost, modified, or not captured during the execution of a backup procedure.
Input for one system comes from the output of another system. Feedback: One system provides input to another system, which reciprocates by reversing those roles One system sends input to another system but also sends input to external entities.
Cascading
What are the Risk Management Framework RMF steps?
Categorize, Select, Implement, Assess, Authorize, Monitor.
the six steps of the risk management framework
Categorize, Select, Implement, Assess, Authorize, and Monitor
six steps of the risk management framework are:
Categorize, Select, Implement, Assess, Authorize, and Monitor C S I A A M
the six steps of the risk management framework are?
Categorize, Select, Implement, Assess, Authorize, and Monitor.
What is the best means to improve the security of a challenge-response based authentication system?
Challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks. Security management should be aware of this and engage in risk assessment and control design when they employ this technology.
In a brute force attack why changing a password frequently will not stop or delay an attack?
Changing the password frequently does not have an effect on the speed or ease with which it can be cracked.
What is the preparation of storage media by overwriting with unclassified data for later reuse or redistribution?
Clearing is a method of sufficiently deleting data on media that will be reused in the same secured environment
When a website provides one version of a page to search engines while serving a different version to users, this is called website ___. cloaking mirroring spoofing hiding
Cloaking is a search engine optimization (SEO) technique in which the content presented to the search engine spider is different from that presented to the user's browser.
remember this: Port knocking is where the client will attempt to connect to a predefined set of ports to identify him as an authorized client. The port knocking sequence is used to identify the client as a legitimate user
Common Criteria 15408 generally outlines assurance and functional requirements through a security evaluation process concept of Protection Profile PP, Target of Evaluation TOE, and Security Target ST for Evaluated Assurance Levels EALs to certify a product or system.
Hierarchical database model Network model Relational model Object-relational database models are what?
Common logical data models
Sampling is a form of data reduction that allows an auditor to quickly determine the important issues or events from an audit trail.
Common mode noise is generated by the difference in power between the hot and ground wires of a power source or operating electrical equipment.
What environments require specific security clearances over compartments or domains instead of objects?
Compartmentalized environments require specific security clearances over compartments or domains instead of objects.
What law extension of the United States Secret Service's jurisdiction over credit card fraud and computer fraud?
Comprehensive Crime Control Act of 1984
What is Every X number of words within a text, is a part of the real message,
Concealment cipher
What is the Clark Wilson model?
Concerned with change control with the assurance that all modifications to objects maintain integrity by well formed transactions and usage of access triple which is subject - interface- object
What uses a "lock" feature to allow an authorized user to make changes and then "unlock" the data elements only after the changes are complete so another user is unable able to access the database to view and/or make changes to the same elements at the same time.
Concurrency
what is a preventive security mechanism that endeavors to make certain that the information stored in the database is always correct or at least has its integrity and availability protected?
Concurrency
What is the best symmetric cryptography, both parties will be using the same key for encryption and decryption?
Confidentiality
______________assures that the information is not disclosed to unauthorized persons or processes?
Confidentiality assures that the information is not disclosed to unauthorized persons or processes.
A message encrypted and digitally signed provides:
Confidentiality, Authentication, Non-repudiation, and Integrity
Which of the following is best provided by symmetric cryptography?
Confidentiality. When using symmetric cryptography, both parties will be using the same key for encryption and decryption. Symmetric cryptography is generally fast and can be hard to break. It offers limited overall security in the fact that it can only provide confidentiality.
In the Bell-LaPadula model, the Star-property is also called?
Confinement Property
What are the the various types of software license agreements?
Contractual license agreements are written agreements between a software vendor and user. Shrink‐wrap agreements are written on software packaging and take effect when a user opens the package. Clickwrap agreements require the user to accept the terms during the software installation process
__________is a security concept infrastructure used to organize the complex security solutions
Control Objectives for Information and Related Technology
What is a security concept infrastructure used to organize the complex security solutions of companies?
Control Objectives for Information and Related Technology COBIT
The main responsibility of the network layer is to insert information into the packet's header so that it can be properly routed. The protocols at the network layer must determine the best path for the packet to take
Controlling access by a subject an active entity such as individual or process to an object a passive entity such as a file involves setting up access rules.
What law guarantees the creators of "original works of authorship" protection against the unauthorized duplication of their work?
Copyright law
When should a post-mortem review meeting be held after an intrusion has been properly taken care of? a. Within the first month after the investigation of the intrusion is completed. b. Within the first week of completing the investigation of the intrusion. c. Within the first week after prosecution of intruders have taken place, whether successful or not. d. Within the first three months after the investigation of the intrusion is completed.
Correct Answer is: A Within the first week of completing the investigation of the intrusion. A post-mortem review meeting should be held with all involved parties within three to five working days of completing the investigation of the intrusion. Otherwise, participants are likely to forget critical information
Failure of a contingency plan is usually: Because of a lack of training. Because of a lack of awareness. A management failure. A technical failure.
Correct Answer is: A management failure. Failure of a contingency plan is usually management failure to exhibit ongoing interest and concern about the BCP/DRP effort, and to provide financial and other resources as needed. Lack of management support will result in a lack awareness and training.
The purposes of RAID (Redundant Array of Inexpensive Disks) are to provide which of the following? a Performance Increase b. Prevent file server hard disks crashes c. Fault Tolerance d. Redundancy and Higher Data Transfer performance
Correct Answer is: A. Redundancy and Higher Data Transfer performance This is a tricky question, as you probably noted the word "purposes" is plural which means there is more than one choice expected. The plural form kind of gives it away as there is only one answer with two choices. If the question would have contained the keywords "primary purpose" then fault tolerance would have been the best choice.
Which of the following statement INCORRECTLY describes circuit switching technique? a. Packet uses many different dynamic paths to get the same destination b. Fixed delays c. Traffic travels in a predictable and constant manner d. Connection oriented virtual links Correct Answer is: Packet uses many different dynamic paths to get the same destination
Correct Answer is: Packet uses many different dynamic paths to get the same destination
when deleting a file is not enough to get rid of it, which of these are recommended? Shredding Whipping Overweighting All of these
Correct answer: All of these Wiping, overwriting, and shredding are all considered excellent safety precautions to ensure that data is truly inaccessible after its intentional removal.
which measure will most likely delay a successful brute force attack
Correct answer: Increasing the size of the password While changing passwords frequently may help ensure the integrity of a password, a brute-force attack rapidly applies a series of combinations to find a match;
Which method will most likely delay a successful brute force attack?
Correct answer: Increasing the size of the password therefore, increasing the size of a password exponentially increases the workload and therefore the time a brute-force attack must use to succeed.
Bluejacking is what?
Correct answer: The sending of a message without the authorized user's consent Bluejacking is where messages are sent from a user or a system without authorized consent. The transmission often involves the use of a receiving blue tooth device.
It has been determined that a specific role in an organization could upset a system of checks and balances. In terms of risk analysis, this kind of danger is determined as what?
Correct answer: Threat When the danger only has the potential to create a negative impact, it is considered a threat. If specific roles in the organization could upset checks and balances
How many parts are there in the common criteria for SLDC?
Correct answer: Three The Software Development Life Cycle (SDLC) includes three parts. Part one is the introduction, part two includes the details of specific functional requirements, and part three details security assurance requirements.
Identify the choice that reflects a control an organization might establish to increase security measures? vacation Job rotations None of these Vacations and job rotations
Correct answer: Vacations and job rotation Vacations and job rotation give organizations an opportunity for employees to work in positions they normally do not in the hopes they uncover an issue which is not in the normal pattern of processes.
What are countermeasures to spoofing attacks
Countermeasures to spoofing attacks include patching the OS and software, enabling source/destination verification on routers, and employing an IDS to detect and block attacks
involves writing to a storage location by one process and the direct or indirect reading of the storage location by another process
Covert Storage Channel:
which one process modulates its system resource for example, CPU cycles, which is interpreted by a second process as some type of communication.
Covert Timing Channel
remember this: A covert channel is an unintended communication path within a system, therefore it is not protected by the system's normal security mechanisms.
Covert channels are a secret way to convey information. Covert channels are addressed from TCSEC level B2.
_______Outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior?
Crime Prevention Through Environmental Design CPTED
When a team conducts a BIA to understand the functions and resources an organization requires for productivity, the team must calculate the maximum to tolerable downtime (MTD). What needs to properly identified for each resource?
Criticality of each resource
Can Honeypots monitor hacker activities and use their results as evidence in court?
Currently honeypot logs cannot be produced as evidence in a court of law
Who helps protect the integrity and security of data by ensuring it is properly stored and protected ensuring the data is backed up in accordance with a backup policy. If administrators have configured auditing on the data_________would also maintain these logs.
Custodians
The concept of best practices as closely associated with what kind of law?
Customary law
A portable data storage device has been determined to have malcious firmware. Which of the following is the BEST course of action to ensure data confidentiality. A. Format the devie B. Re-image the device C. Perform virus scan in the device D. Physically destroy the device
D- physically destroy the device to preserve confidentiality.
Which of the following is a Microsoft technology for communication among software components distributed across networked computers
DCOM Distributed Component Object Model
What uses a hierarchical model to organize data, with root name servers representing the top-level domains and authority distributed hierarchically to child servers.
DNS
Which protocol is secured by using TSIG?
DNS
DNS uses a ______________ model to organize data, with root name servers representing the top-level domains and authority distributed hierarchically to child servers.
DNS uses thehierarchical model to organize data, with root name servers representing the top-level domains and authority distributed hierarchically to child servers.
_______is the alteration of existing data. Many times, this modification happens before the data is entered into an application or as soon as it completes processing. The most common reason is to overstate revenue and assets and understate expenses and liabilities.
Data Diddling
What is a subset of SQL containing the commands used to interact with data?
Data Manipulation Language DML
When a Proxy transfers a copy of each accepted data packet from one network to another what is masked?
Data Origin
Who are typically third-party entities that process data for an organization?
Data Processors
Data diddling is the__________?
Data diddling is the alteration of existing data. Many times, this modification happens before the data is entered into an application or as soon as it completes processing. The most common reason is to overstate revenue and assets and understate expenses and liabilities.
What is a key element in security controls
Data hiding and programming
TLS is a secure protocol implemented in web application traffic to ensure privacy between client and server communications to protect this type of data:
Data in Transit/Motion
What is the difference between Data manipulation language and data definition language?
Data manipulation language is a grouping of computer languages used by computer programs to manipulate data in a database; Data definition language is a computer language used specifically to define data structures.
Who is responsible for defining data classifications and ensuring systems and data are properly marked?
Data owners
Who is responsible for defining data classifications and ensuring systems and data are properly marked?
Data owners
Who has a responsibility to protect the privacy of the data and not use it for any other purpose than directed by the data controller?
Data processors
who are typically third-party entities that process data for an organization?
Data processors
Remember this: Pretty good privacy is a freeware email security application that uses IDEA algorithm for encryption and RSA algorithm for key distribution.
Data remanence is the data that prevails on a computer after an erase operation has been performed
what is the difference between data remanence and residual data?
Data remanence is the data that prevails on a computer after an erase operation has been performed where as Residual Data is data that is unintentionally left behind on computer media.
developers use to restrict users' access to a limited subset of database attributes or records is what?
Database views use SQL statements to limit the amount of information that users can view from a table.
What technique would raise the False Acceptance Rate (FAR) and Lower the False Reject Rate (FRR) in a fingerprint scanning system?
Decrease the amount of minutiae that is verified
In the ________________ stage of the CMM, all development projects take place within the constraints of a standardized management model.
Defined stage
What is the Internet glossary RFC 2828?
Defines an attribute certificate as a digital certificate that binds a set of descriptive data items other than a public key either directly to a subject name or the identifier of another certificate that is a public key certificate.
Explain why the separation of duties and responsibilities is a common security practice?
Definition -------------------------------------------------------------------------------- It prevents any single subject from being able to circumvent or disable security mechanisms
What is Degaussing?
Degaussing is the process of decreasing or eliminating a remnant magnetic field. It is named after the gauss, a unit of magnetism, which in turn was named after Carl Friedrich Gauss. The magnetic field of a degausser, the magnetic data on a tape or hard disk is neutralized, or erased.
network based IDS can detect many attacks and are the first to dectect unlike a Host based IDS would be what kind of attack?
Denial of Service Attack or a DoS
What are the most common threats against communication systems?
Denial of service, eavesdropping, impersonation, replay, and modification
Code of Ethics Canons Protect society, the commonwealth, and the infrastructure Act honorably, honestly, justly, responsibly, and legally Provide diligent and competent service to principals Advance and protect the profession
Developing a BCP/DRP Develop Contingency Planning Policy Statement Conduct the Business Impact Assessment (BIA) Identify Preventative Controls Develop Recovery Strategies Develop an IT Contingency Plan Plan Testing, Training and exercises Plan Maintenance
In NIST SP 800-18 outlines the following responsibilities for the system owner?
Develops a system security plan in coordination with information owners, the system administrator, and functional end users. Maintains the system security plan and ensures that the system is deployed and operated according to the agreed-upon security requirements
RADIUS = Uses UDP 1812 and 1813. AAA system. RADIUS request and response data is carried in 8-bit Attritbute Value Pairs TACACS - centralized access control system that uses UDP port 49 and may use TCP PAP and CHAP = PAP is plaintext, CHAP is better
Diameter = RADIUS' successor with more accountability and a 32-bit AVP field.
Which of the following algorithm enables two systems to generate a symmetric key securely without requiring a previous relationship or prior arrangements?
Diffie-Hellman The Diffie-Hellman key agreement protocol also called exponential key agreement)was developed by Diffie and Hellman in 1976 and published in the ground-breaking paper "New Directions in Cryptography." The protocol allows two users to exchange a secret key over an insecure medium without any prior secrets.
what prohibits the circumvention of copy protection mechanisms placed in digital media and limits the liability of Internet service providers for the activities of their users?
Digital Millennium Copyright Act of 1998
The uses of digital rights management is what ?
Digital rights management (DRM) solutions allow content owners to enforce restrictions on the use of their content by others. DRM solutions commonly protect entertainment content, such as music, movies, and e-books
The main purpose for the use of digital signatures is to assure
Digital signatures provide integrity because the digital signature of a signed message (file, mail, document, etc.) changes every time a single bit of the document changes; thus, a signed document cannot be altered.
What is a spamming attack
Directing floods of messages to a victim's email inbox or other messaging system. Such attacks cause DoS issues by filling up storage space and preventing legitimate messages from being delivered
Who should direct short-term recovery actions immediately following a disaster?
Disaster Recovery Manager. The Disaster Recovery Manager should also be a member of the team who assists the development of the Disaster Recovery Plan. Senior-level management supports the process but not be involved with the initial process.
_____give the subject (user) some ability to define the objects to access. This access control mechanism ensures that the owner or creator of an object controls and defines the access other subjects have to that object
Discretionary controls
What is Microsoft technology for communication among software components distributed across networked computers?
Distributed Component Object Model DCOM is a proprietary Microsoft technology for communication among software components distributed across networked computers.
What are the Divisions of the TCSEC?
Divisions and classes D — Minimal protection C — Discretionary protection B — Mandatory protection A — Verified protection
What differs from traditional multi-site datacenter architecture based primarily on the concept that it is possible to shift active-running workload from one site to another with no interruption in services. While providing the ability to shift active running workload from one site to another?
Dual-Core Datacenter
What is the notion of preserving and protecting assets and interests for a given organization as exercised through a formalized security structure comprising baselines, guidelines, policies, procedures, and rules?
Due care
Remember this :A brouter is a device that attempts to route first, but if that fails, it defaults to bridging.
Due care is the notion of preserving and protecting assets and interests for a given organization as exercised through a formalized security structure comprising baselines, guidelines, policies, procedures, and rules.
Protection mechanisms are continually maintained and operational where risks are constantly being evaluated and reviewed ia an example of what?
Due diligence
Certain types of attacks have been made more potent by which of the following advances to microprocessor technology?
Due to the increase of computer processing power, brute-force and cracking attacks against security mechanisms are possible. These instructions can be used to attempt to crack passwords or encryption keys or instructions to send nefarious packets to victim systems.
When do you define business priorities?
During the first step of the Business Impact Analysis.
What is the the process used to develop a continuity strategy?
During the strategy development phase, the BCP team determines which risks will be mitigated
Describe the process used to develop a continuity strategy
During the strategy development phase, the BCP team determines which risks will be mitigated. The provisions and processes phase procedures that will mitigate the risks are designed. The plan must then be approved by senior management and implemented.
What is a large group of internal clients to share a single or small group of ROUTABLE IP addresses for the purpose of hiding their identities when communicating with external hosts or expanding the internal network address?
Dynamic translation
What are the Target of Evaluation levels TOE
EAL 1 : functionally tested EAL 2 : structurally tested EAL 3 : methodically tested and checked EAL 4 : methodically designed, tested and reviewed EAL 5 : semiformally designed and tested EAL 6 : semiformally verified design and tested EAL 7 : formally verified design and tested.
What is structurally tested
EAL 2
What is methodically tested and checked
EAL 3
Common Criteria has assurance level from EAL 1 to EAL 7 regarding the depth of design and testing. Which of the following assure the Target of Evaluation or is methodically designed, tested and reviewed?
EAL 4
What is methodically designed, tested and reviewed?
EAL 4
What is semiformally designed and tested?
EAL 5
What is semiformally verified design and tested
EAL 6
What is formally verified design and tested.
EAL 7
The Data Encryption Standard operates in four modes: Electronic Codebook mode, Cipher Block Chaining mode, Cipher Feedback mode, and Output Feedback mode.
ECB mode is considered the least secure and is used only for short messages. 3DES uses three iterations of DES with two or three different keys to increase the effective key strength to 112 or 168 bits, respectively
ECC key size is what?
ECC requires shorter keys for equivalent security. Some argue that ECC key length pf 160 bits is the same as an RSA key length of 1024 bits.
What provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties apply when the individual knows that the information will benefit a foreign government
Economic Espionage Act
What is an extension of the Diffie-Hellman key exchange algorithm that depends on modular arithmetic?
El Gamal
What is used for transmitting digital signatures and key space exchanges, and it has logarithmic functions?
El Gamal
What is an Elliptic curve Diffie-Hellman (ECDH)?
Elliptic curve Diffie-Hellman (ECDH) is an anonymous key agreement protocol that allows two parties, each having an elliptic curve public-private key pair, to establish a shared secret over an insecure channel.[1][2
What is the most serious threat of email
Email is a common delivery mechanism for viruses, worms, Trojan horses, documents with destructive macros, and other malicious code.
What provides confidentiality in IPSEc?
Encapsulating Security Payload ESP
What uses simple encryption to encipher their computer code. Each virus is encrypted with a different key so that even with a key to one virus, another instance of the same virus cannot be scanned.
Encrypted Viruses
What is a firewall feature that allows users on an external network to authenticate themselves to prove that they are authorized to access resources on the internal network
Encrypted authentication
Of the following, what can mitigate the success of a sniffing attack?
Encrypted passwords (and one-time passwords) can reduce the success of a sniffing attack. Rainbow tables are used by attackers to crack hashed passwords. Salting passwords helps reduce the success rate of rainbow attacks.
Information stays encrypted from one end of its journey to another is what type of encryption?
End to End encryption
responsible for protecting information assets on a daily basis through adherence to the security policies that have been communicated is?
End user
What are the issues related to user acceptance of biometric enrollment and throughput rate?
Enrollment times longer than 2 minutes are unacceptable; subjects will typically accept a throughput rate of about 6 seconds or faster
What is an attack phase of a penetration test?
Escalate Privileges
What is a general term is described as the process of independently assessing a system against a standard of comparison?
Evaluation
Which can best describe a Concealment cipher
Every X number of words within a text, is a part of the real message, A concealment cipher is a message within a message
What are some examples of Non-volatile memory?
Examples of non-volatile memory include read-only memory, flash memory, ferroelectric RAM (F-RAM), most types of magnetic computer storage devices (e.g. hard disk drives, floppy disks, and magnetic tape), optical discs, and early computer storage methods such as paper tape and punched cards.
With relevance to volatile information gathering from a router, which of these is considered Direct access? SNMP scan Executing show commands Port scan All of the above
Executing the 'show' commands on the Router, comes under 'Direct Access'
maintains the overall responsibility for protection of the information assets. The business operations are dependent upon information being available, accurate, and protected from individuals without a need to know.
Executive Management/Senior Management -
Which of the following relational database terms would include a central repository of metadata and data relationships? File Database Database management system Data dictionary
Explanation: The correct answer is data dictionary. The data dictionary is a central repository of metadata and data relationships.
Which of the following would be your first step as an investigator during an Email crime investigation? Classify violation Collect Evidence Analyze the header Copy the email
Explanation: The first step is always to classify the violation done during the crime
An Exploitation occurs when?
Exploitation occurs when the attacker sends "guesses" to password information or other login credentials to gain access to a system. Brute force attacks are an example of exploitation. SQL injection is another form.
What is extensible markup language?
Extensible market language goes beyond describing how to display the date up by actually describe the data. I can include tags to describe the data anything desired
Synchronous Dynamic Tokens - refresh every 60 seconds. Use time or counters to synchronize a code with the AS Asynchronous Tokens - not synchronized with central server. Challenge-response. Throughput - biometric system response time
False Reject Rate (FRR): Type 1 Error False Accept Rate (FAR): Type 2 Error Crossover Error Rate (CER): Where the two rates meet
A _____ is any abnormal situation in an electrical system when electrical current does not flow through the intended parts.
Fault
What are multiple organizations that join a group where they agree on a method to share identities between them?
Federated identity management.
What is the most difficult network segment to eavesdrop because the act of doing so is always detectable?
Fiber
The following are typical biometric characteristics that are used to uniquely authenticate an individual's identity:
Fingerprints - Retina scans - Iris scans - Facial scans - Palm scans - Hand geometry - Voice - Handwritten signature dynamics
what are the requirements for successful use of a one-time pad?
For a one-time pad to be successful, the key must be generated randomly without any known pattern. The key must be at least as long as the message to be encrypted. The pads must be protected from physical disclosure, and each pad must be used one one time and then discarded
Which of the following algorithms is used today for encryption in PGP
For encrypting messages, it actually uses AES with up to 256-bit keys, CAST, TripleDES, IDEA and Twofish. RSA is also used in PGP, but only for symmetric key exchange and for digital signatures, but not for encryption
Give an example of an ARO?
For example, a business in Southern California is much more likely to face the risk of an earthquake than to face the risk posed by a volcanic eruption. A business based in Hawaii might have the exact opposite likelihood that each risk would occur.
remember this-database view is the results of Join, Project, and Select.
For the purpose of the exam you must remember the following terms from relational algebra and their SQL equivalent: Tuple = Row, Entry Attribute = Column Relation or Based relation = Table
What is used to enforce relationships between two tables, also known as referential integrity . Referential integrity ensures that if one table contains a_________ key, it corresponds to a still-existing primary key in the other table in the relationship
Foreign Key
How are PVC, SVC, DTE, and DCE used in a Frame Relay network
Frame Relay requires the use of a DTE and a DCE at each connection point. PVC is always available; SVC is established using the best paths currently available
What are types of Cryptographic Attacks?
Frequency Analysis, Brute Force Attacks, Rainbow Tables
What wireless communication technique employs a form of serial communications
Frequency Hopping Spread Spectrum FHSS an early implementation of the spread spectrum concept. However, instead of sending data in a parallel fashion, it transmits data in a series while constantly changing the frequency in use.
Iris scan, fingerprint, voice verification, keystroke dynamics.
From most effective lowest Cross Over Error Rate to The Least Effective highest Cross Over Error Rate
Which backup has the worst recovery point objective?
Full Back up
Remember IP Sec can only tunnel through IP networks that provide integrity and authentication
Furthermore, IP Sec does not provide any digital certificates that are used in a PKI environment that are tied to the identify of individual systems in a providing IP Sec functionality
remember this: With the advent of public key cryptography (PKI), it is now possible to communicate securely with untrusted parties over the Internet without prior arrangement.
Furthermost in PKI, One of the necessities arising from such communication is the ability to accurately verify someone's identity (i.e. whether the person you are communicating with is indeed the person who he/she claims to be)
Crackers today are MOST often motivated by their desire to what?
Gaining Money or Financial Gains.
What are the fundamental requirements of a hash function?
Good hash functions have five requirements. They must allow input of any length, provide fixed-length output, make it relatively easy to compute the hash function for any input, provide one-way functionality, and be collision free.
What is a strategy hackers use to to gather intelligence about vulnerable systems that they may later attempt to compromise?
Hackers often use scanning attacks to gather intelligence about vulnerable systems that they may later attempt to compromise.
Halon is a compound consisting of bromine, fluorine, and carbon why were these terminated?
Halons are used as fire extinguishing agents, both in built-in systems and in handheld portable fire extinguishers. Halon production in the U.S. ended on December 31, 1993, because they contribute to ozone depletion. Bromine being part of Halon is not a safe replacement for Halon
What are the CDs and DVDs Storage protection recommendations?
Handle by edges or by hole in the middle Be careful not to bend the CD or DVD Avoid long term exposure to bright light Store in a hard jewel case, not is soft sleeves
What is FIPS-140?
Hardware and software cryptographic modules-The 140 series of Federal Information Processing Standards (FIPS) are U.S. government computer security standards that specify requirements for cryptography modules. the current version of the standard is FIPS 140-2, issued on 25 May 2001.
WHat is used to monitor the installation of, and updates to, hardware and software to ensure that the system functions as expected and that a historical record of changes is maintained?
Hardware and software maintenance access controls
what monitor the installation of, and updates to, hardware and softwares as expected and that a historical record of changes is maintained. Integrity verification programs are more integrity controls than software maintenance controls?
Hardware and software maintenance access controls
To implement encryption into his systems in such a way that it goes as fast as possible. This is to ensure that users do not have to wait too long. For such speedy encryption, his best option is to use
Hardware based encryption is the fastest encryption
which model map subjects objects in Access rights to access matrix?
Harrison Ruzzo Ullman model
How does privacy fits into the realm of IT security?
Health Insurance Portability and Accountability Act (HIPAA), the Sarbanes-Oxley Act of 2002 (SOX), and the Gramm-Leach-Bliley Act—as well as the EU's Directive 95/46/EC aka the Data Protection Directive and the contractual requirement Payment Card Industry Data Security Standard PCI DSS
What is a data storage technique, which automatically moves data between high-cost and low-cost storage media. and exist because high-speed storage devices, such as hard disk drive arrays, are more expensive per byte stored than slower devices, such as optical discs and magnetic tape
Hierarchical storage management (HSM)?
Remember this ISDN is a circuit-switched network technology.
Host-based Intrusion Detection Systems are deployed at the host level, and have a very limited view of the network, which is their biggest drawback
What access control method that combines central and decentralize approaches individual users may be able to dictate who can access the shared and local files but the IT administration would control access to file servers network printers and network devices?
Hybrid administration
What kind of Encryption technology does SSL utilize
Hybrid both symmetric and asymmetric SSL use public-key cryptography to secure session key, while the session key (secret key) is used to secure the whole session taking place between both parties communicating with each other.
____________combines both hierarchical and compartmentalized environments so that security levels have subcompartments.
Hybrid environments
The request control process provides an organized framework within which users can request modifications, managers can conduct cost/benefit analysis, and developers can prioritize tasks.
Hybrid environments combine both hierarchical and compartmentalized environments so that security levels have subcompartments
What Allows multiple virtual operating systems run on one host? is the software component that manages the virtual components?
Hypervisor
What is the IP header contains a protocol field for ICMP?
ICMP=1
Which encryption algorithm is used in PGP?
IDEA-- a symmetric encryption algorithm used in PGP software and it is a 64-bit block cipher which uses a 128-bit key.
Abnormal or unauthorized activities detectable to an IDS include which of the following?
IDSs watch for violations of confidentiality, integrity, and availability. Attacks recognized by IDSs can come from external connections viruses, malicious code, trusted internal subjects attempting to perform unauthorized activities, and unauthorized access attempts from trusted locations.
What is the IP header contains a protocol field for IGMP?
IGMP=2
Which protocol is commonly used for corporate e-mail accounts?
IMAP
What provides confidentiality and integrity to information transferred over IP networks through network not transport layer encryption and authentication.
IP Sec
_______is often combined with Layer 2 Tunneling Protocol (L2TP) for VPNs.
IP Sec
What is a data-oriented protocol used for communicating data across a packet-switched internetwork?
IP provides an unreliable service i.e., best effort delivery. This means that the network makes no guarantees about the packet.
What are two disadvantages of an IPS?
IPS creates bottle necks & can generate false positives
What are the characteristics of IPSec Tunnel Mode?
IPSEC work at the Network layer of the OSI model. Tunnel mode is most commonly used between gateways, or at an end-station to a gateway, the gateway acting as a proxy for the hosts behind it. Transport mode is used between end-stations or between an end-station and a gateway,if the gateway is being treated as a host.
Name at least 10 network and protocol security mechanisms
IPSec, SKIP, SWIPE, SSL, S/MIME, SET, PEM, PGP, PPP, SLIP, PPTP, L2TP, CHAP, PAP, RADIUS, TACACS, S-RPC
What protocol suite runs at the networking layer that provides confidentiality, integrity protection, data origin authentication and replay protection of each message by encrypting and signing every message
IPsec
What address configuration does not require NAT to extend its address space?
IPv6 has an increased address space in comparison to IPv4, hence does not require NAT
Primary victims of the Smurf attacks are the _ servers.
IRC servers
What are converged protocols?
ISCSI, VoIP, and FCoE are converged protocols.
is a standard for software life cycle processes. It establishes a process for the life cycle of software. It does not specifically cover security but it references other security standards.
ISO 1227
what defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that standard
ISO 27799
What is the standard for the establishment, implementation, control, improvement of the information security management system?
ISO/IEC 27001
COBIT Control Objectives for Information and Related Technology: control framework to manage IT risk and governance
ITIL (Information Technology Infrastructure Library) - Framework for providing IT service management Service strategy Service design Service transition Service operation Continual service improvement
______________is the process by which a subject professes an identity and accountability is initiated
Identification
What are the keystones of most access control systems?
Identification and authentication are the keystones of most access control systems
Each participant in an asymmetric cryptosystem is issued two keys: a public key and a private key.
Identification of priorities is the first step of the business impact assessment process.
Name the four key principles upon which access control relies?
Identification, authentication, authorization, accountability
What is federated identity management?
Identity management is a management of user identities in their credentials. Multiple organizations can join a federation a group where they agree on a method to share identities between them.
Which one of these indicates a spoofed email during investigation? Return Path server and Received From server are the same Return Path server and Received From server are different
If received from and return path servers differ, it is an Indication of a spoofed email
What does the CPU does not need to actually retrieve any data from memory. The data is contained in the instruction itself?
Immediate addressing
What types of threats does cryptography, like digital signatures, help fight against?
Impersonation, Eavesdropping, and Tampering
The change control process of configuration or change management has several goals or requirements: they are:
Implement changes in a monitored and orderly manner. Changes are always controlled. A formalized testing process is included to verify that a change produces expected results. All changes can be reversed also known as backout or rollback plans/procedures.
Security is likely to be most expensive when addressed in which phase?
Implementation
What are the goals of change management
Implementation of changes in an orderly manner, formalized testing, ability to reverse changes, ability to inform users of changes, systematical analysis of changes, minimization of negative impact of changes
What DES mode uses the exclusive OR function to combine each block of unencrypted text with the immediately preceding cipher-text block?
In Cipher Block Chaining (CBC) mode, each block of unencrypted text is XORed with the block of cipher text immediately preceding it before it is encrypted using the DES algorithm.
The CPU uses absolute addresses. Applications use logical addresses. Relative addresses are based on a known address and an offset value.
In IPSec, Security Associations is a concept of building security functions into IP - Internet Protocol. A security association is a bundle of algorithms and parameters like keys which is used to encrypt and authenticate a particular flow of data.
The common applications of cryptography to secure networking is
In IPsec transport mode packet contents are encrypted for peer-to-peer communication. In tunnel mode, the entire packet, including header information, is encrypted for gateway-to-gateway communications.
What is a hijack attack?
In a hijack attack, which is an offshoot of a man-in-the-middle attack, a malicious user is positioned between a client and server and then interrupts the session and takes it over.
What type of attack can be used against cryptographic algorithms that do not incorporate temporal protections? A. Chosen plain-text attack B. Meet-in-the-middle attack C. Man-in-the-middle attack D. Replay attack
In a replay attack, the malicious individual intercepts an encrypted message between two parties (often a request for authentication) and then later replays the captured message to open a new session.
to make a request to the server, is the IP of the host who originally made the request would be logged in the server?
In case of a proxy request, the IP of the proxy would be logged, but not of the end user who actually made the request
What is point to point protocol?
In computer networking, Point-to-Point Protocol is a data link protocol used to establish a direct connection between two nodes. It can provide connection authentication, transmission encryption using ECP, RFC 1968 and compression.
__________ is a collection of ports from a set of connected Fibre Channel switches over a network, be partitioned into multiple sharing hardware resources.
In computer networking, a virtual storage area network (VSAN) is a collection of ports from a set of connected Fibre Channel switches, that form a virtual fabric. Ports within a single switch can be partitioned into multiple VSANs, despite sharing hardware resources.
What is polyinstantiation?
In databases, polyinstantiation is database-related SQL structured query language terminology. It allows a relation to contain multiple rows with the same primary key; the multiple instances are distinguished by their security levels. It occurs because of mandatory policy.
which of these is true about 'Persistent attacks' None of the above Hard to detect Cannot cause severe damage Attacker constantly injects a substantial amount of 'bad' packets into the router
In persistent attacks, an attacker 'constantly' injects bad packets into the router
remember this: A stealth virus is a hidden computer virus that attacks operating system processes and averts typical anti-virus or anti-malware scans. Stealth viruses hide in files, partitions and boot sectors and are adept at deliberately avoiding detection.
In software development, static testing is a form of software testing where the actual program or application is not used. Instead this testing method requires programmers to manually read their own code to find any errors.
What type of attack does a malicious individual sits between two communicating parties and intercepts all communications including the setup of the cryptographic session?
In the man-in-the-middle attack
In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?
In the provisions and processes phase, the BCP team actually designs the procedures and mechanisms to mitigate risks that were deemed unacceptable during the strategy development phase.
When the TTL of a packet reaches zero, it sends back a TTL ___ message to the originator. depleted exhausted limit exceeded
In this case a TTL exceeded message is sent back to the originator
What are the two modes available through IPSec, and what do they do
In transport mode, the IP packet data is encrypted, but the header is not. In tunnel mode, the entire IP packet is encrypted, and a new header is added to govern transmission through the tunnel
What is a complexed password consist of?
Increasing the size of the password increasing the size of a password exponentially increases the workload and therefore the time a brute-force attack must use to succeed.
To run at regular intervals would take the MOST time to complete restoration?
Incremental backups only backup changed data changes archive bit to not backup again if not changed.
What attacks involve combining several pieces of nonsensitive information to gain access to information that should be classified at a higher level it--makes use of the human mind's deductive capacity rather than the raw mathematical ability of modern database platforms.
Inference
Inference
Inference attacks involve combining several pieces of nonsensitive information to gain access to information that should be classified at a higher level. However, inference makes use of the human mind's deductive capacity rather than the raw mathematical ability of modern database platforms.
What is access?
Information flow from objects to subjects
Capability Maturity Model
Initial/Performed, Repeatable, Defined, Quantitatively managed, optimized
NIST SP 800-37: four-step certification and accreditation process:
Initiation Phase Security Certification Phase Security Accreditation Phase Continuous Monitoring Phase
What is Cascading?
Input for one system comes from the output of another system. Feedback: One system provides input to another system, which reciprocates by reversing those roles One system sends input to another system but also sends input to external entities.
Electromagnetic Interference (EMI) issues such as crosstalk primarily impact which aspect of security?
Integrity
What is a standby site ready with all the technology and equipment necessary to run the applications positioned there to effectively restart an application without having to perform any bare metal recovery of servers while running non-time sensitive processes?
Internal Hot Sites
___________ is the protocol used to set up a security association (SA) in the IPsec protocol suite?
Internet Key Exchange (IKE or IKEv2)
Which translates source code one command at a time for execution on a computer?
Interpreters translate one command at a time during execution, as opposed to compilers and assemblers where source code for the whole application is transformed to executable code before being executed
What are patterns of analysis and recognition?
Intrusion Detection
From most effective lowest Cross Over Error rate to least effective highest Cross Over Error rate are:
Iris scan, fingerprint, voice verification, keystroke dynamics.
What is service provisioning market language?
Is a newer framework based on XML but specifically designed for exchanging user information for federal identity single sign-on purposes.
What is a Trusted Distribution?
Is based on Life Cycle Assurance Requirements -steps are: Security Testing, Design Specification, Configuration Management, Trusted System Distribution.
What is a virtual password
Is the length and format that is required by specific system to log into or a software application.
IT governance is defined as the processes that ensure the effective and efficient use of IT in enabling an organization to achieve its goals. IT demand governance --what IT should work on is the process by which organizations ensure the effective evaluation, selection, prioritization, and funding of competing IT investments;
It Governance oversee their implementation; and extract (measurable) business benefits. It is a business investment decision-making and oversight process, and it is a business management responsibility. IT supply-side governance is concerned with ensuring that the IT organization operates in an effective, efficient and compliant fashion.
What is Polyinstatiation?
It allows the insertion of multiple records that appear to have the same primary key values into the database at different classification levels.
How would you describe IPsec?
It can be used to establish direct communication between computers or to set up a VPN between networks. IPsec uses two protocols: Authentication Header (AH) and Encapsulating Security Payload (ESP).
What are the pros and cons of a network-based IDS
It can monitor a large network and can be hardened against attack. It may be unable to handle large data flows, requires a central view of traffic, and can't pinpoint compromised resources
What are the pros and cons of a host-based IDS?
It can pinpoint resources compromised by a malicious user. It can't detect network-only attacks or attacks on other systems, has difficulty detecting DoS attacks, and can be detected by intruders
What is a major disadvantage of the El Gamal Crypto System?
It doubles the length of any message it encrypts. Therefore a 2048 bit plain text message would yield a 4096 bit ciphertext message when El Gamal is used for encryption
What is A packet-filtering firewall?
It examines all of the fields in the headers in the packet. For example, it might look at the source IP address field in the IP header, or it might look at the destination port number field in a TCP header to decide whether or not traffic should be allowed to go through.
What is transparency?
It is a characteristic or service that is unseen by users
What is a Trojan?
It is a code that appears to have some useful purpose but also contains code that has a malicious or harmful purpose imbedded in it
What is Hybrid administration?
It is access control method that combines central and decentralize approaches individual users may be able to dictate who can access the shared and local files but the IT administration would control access to file servers network printers and network devices
What is transverse mode noise?
It is generated by the difference in power between the hot and neutral wires power source or operate electrical equipment.
Remediation attempts to identify the cause of the incident and steps that can be taken to prevent a reoccurrence, but this is the last step, not the first.
It is important to protect evidence while trying to contain an incident, but gathering the evidence will occur after containment.
What is security assertion market language?
It is in XML-based language that is commonly used to exchange authentication and authorization information between Federated organizations it is often used to provide SSL capabilities for browser access.
What is a throughput rate when it comes to biometrics?
It is the amount of time the system requires to scan a subject and approve or deny access. The more complex the longer the process. Typical throughput rate is 6 seconds.
What is ISO/IEC 27001?
It is the standard for the establishment, implementation, control, improvement of the information security management system.
What is False Accept or Type II Error?
It is when an invalid user is permitted access.
What is A stateful or dynamic inspection firewall?
It keeps track of the state of a network connection, like a TCP connection. This way, it can distinguish already established authentic connections and allow further transmissions.
What is a A proxy firewall?
It looks at higher layers in terms of the OSI model, so it can read application specific information to decide whether or not the traffic should be allowed through. A packet-filtering firewall cannot look at any data in the packet that is application specific
What is a IDEA cipher algorithm ?
It operates on 64-bit plaintext blocks and uses a 128 bit key.
What is NIST 800-34?
It provides Contingency Planning Guide for Federal Information Systems, provides instructions, recommendations, and considerations for federal information system contingency planning
DREAD risk assessment model
It provides a mnemonic for risk rating security threats using five categories. The categories are: Damage Reproducibility Exploitability Affected users Discoverability
What does hybrid cryptography provide?
It provides message encryption, which the symmetric key or secret key provides. while the asymmetric key is used to encrypt the symmetric key.
Containment should be the first step when an incident has been detected and verified to limit the effect or scope of an incident.
It should be reported based on an organization's policies and governing laws, but this is not the first step.
What is TEMPEST?
It was developed in the 1950s by the US government to address electromagnetic radiation being emitted from electrical equipment data that can be captured via electrical signals in reconstructed which threatens the confidentiality of sensitive data
What is a soft control?
It's another name for Administrative control.
What is remote mirroring ?
It's usually between storage arrays or storage appliances, and can be synchronous or asynchronous. Synchronous remote mirroring is the highest possible level for DR recovery point objective RPO and recovery time objective RTO. The RPO is "zero" lost data, and the RTO is typically seconds to minutes.
The technical aspects of software development vary according to the software development model used. What's the Build and Fix model?
It's when development is conducted without much prior planning.
What is an authentication service that uses a single-factor or multi-factor authentication methods?
Kerberos
what depends on secret keys symmetric ciphers. which is a third party authentication protocol an open source and relies on the user's secret keys. The password is used to encrypt and decrypt the keys.
Kerberos
Kerberos depends on what ?
Kerberos depends on secret keys (symmetric ciphers). Kerberos is a third party authentication protocol. It is considered open source but is copyrighted and owned by MIT. It relies on the user's secret keys. The password is used to encrypt and decrypt the keys.
Dynamic Packet Filtering Firewalls - Fourth Generation n Allows modification of security rules n Mostly used for UDP n Remembers all of the UDP packets that have crossed the network's perimeter, and it decides whether to enable packets to pass through the firewall.
Kernel Proxy - Fifth Generation n Runs in NT Kernel n Uses dynamic and custom TCP/IP-based stacks to inspect the network packets and to enforce security policies.
What is referred to as system mode, is one of the two distinct modes of operation of the CPU (central processing unit) in Linux?
Kernel mode
What can be defined as an instance of two different keys generating the same ciphertext from the same plaintext
Key clustering
What individuals would not normally be included in your organization's incident response team?
Law enforcement officials would not usually serve on your internal incident response team. Rather, you would typically appoint an individual to serve as a liaison with law enforcement.
Ethernet sniffers operate at what layer of the OSI Model?
Layer 2 - Data Link Layer.
IP SEC is often combined with ____________for VPN?
Layer 2 Tunneling Protocol L2TP
What firewall technology is most thorough?
Layer 7 Application Layer because it can block websites
There are some layers in ring model scheme that is not normally implemented into use? What are they?
Layers 1 and 2 contain device drivers but are not normally implemented in practice. Layer 0 always contains the security kernel. Layer 3 contains user applications. Layer 4 does not exist.
What level of assurance for a digital certificate verifies a user's name, address, social security number, and other information against a credit bureau database
Level 2/Class 2
What is the The Skipjack algorithm and its size?
Like many block ciphers, Skipjack operates on 64-bit blocks of text. It uses an 80-bit key and supports the same ,Cryptography and Symmetric Key Algorithms four modes of operation supported by DES
what attack is simply a series of packets sent to the target where the source and destination IP Addresses are the same as the victim
Local Area Network Denial LAND Attack
What is a LAND Attack?
Local Area Network Denial attack is simply a series of packets sent to the target where the source and destination IP Addresses are the same as the victim.
What are measure of impact are calculated during the impact assessment phase?
Loss expectancies
What uses scripting languages such as Visual Basic for Applications?
Macro viruses
What are some countermeasures to eavesdropping
Maintaining physical access security, using encryption, employing one-time authentication methods
In which CMM level is a detailed measure of the software process where a product quality is collected, analyzed, and then used to control the process?
Managed
The object classification and category, sensitivity labels attached to object is what type of access control?
Mandatory Access Control
What is multilevel security refered to as at times?
Mandatory access control
____________ occurs when a person presents him- or herself as another user, typically to gain access to unauthorized information or processes.
Masquerading
What type of virus infects the system's boot sector and load when the system is started.
Master boot record MBR virus
COBIT 5 framework, benefit all enterprises, regardless of size, geography or industry. The following five principles are key:
Meeting Stakeholder Needs, Covering the Enterprise End to End, Applying a Single Integrated Framework, Enabling a Holistic Approach, Separating Governance From Management
What provides redundant connections to systems, allowing multiple segment failures without seriously affecting connectivity.
Mesh topologies
What is a mode of data transmission in which a message is sent as a complete unit and routed via a number of intermediate nodes at which it is stored and then forwarded.
Message Switching
What are the two common data classification schemes?
Military and private sector
__________device that translates data from digital form and then back to digital for communication over analog lines.
Modem
Which of the following is NOT a technical control? Intrusion Detection Systems Identification and authentication methods Password and resource management Monitoring for physical intrusion
Monitoring for physical intrusion --It is considered to be a 'Physical Control' The 3 categories of access control: administrative, technical, and physical. A
Why is monitoring an important part of a security policy?
Monitoring is used to watch for security policy violations and to detect unauthorized or abnormal activities
What is MOM?
Motivations, Opportunities, and Means (MOM). Motivations are the who and why of a crime. Opportunities are the where and when of a crime, and Means pertains to the capabilities a criminal would need to be successful.
What is a rudimentary form of parallel processing in which several programs are run at the same time on a uniprocessor?
Multi programming
_________ is a one-to-many transmission method in which the network carries a message to multiple receivers at the same time.
Multicast
The operating system design concept of protection rings was derived from what early operating system?
Multics has left two enduring legacies in the computing world. First, it inspired the creation of a simpler, less-intricate operating system called Unix (a play on the word multics), and second, it introduced the idea of protection rings to operating system design.
When is it there is no requirement that all users have appropriate clearances to access information processed on a system?
Multilevel security mode system
Using a CPU in Parallel is called what?
Multiprocessing
What is a concept of performing concurrent tasks over a certain period of time by executing them concurrently
Multitasking
is the ability of a program or an operating system process to manage its use by more than one user at a time and to even manage multiple requests by the same user without having to have multiple copies of the programming running in the computer
Multithreading
_________popular in disaster recovery literature but difficult to implement. They are agreements between two parties to mutually assist one another in the event of disaster.
Mutual assistance agreements
Hybrid environments combine both hierarchical and compartmentalized environments so that security levels have subcompartments.
NAT does not allow initiations from external entities. Therefore, allowing external initiations is not a benefit. The benefit is that NAT does not allow them.
NIST has published continuity planning best practices in
NIST 800-34
This publication provides guidelines for applying the Risk Management framework to federal information systems?
NIST 800-37
When modifying the list of security controls within a baseline so that they align with the mission of the organization or customizing a standard for your organization, what source should you use?
NIST 800-53
what uses the following control categories: technical. management, and operational
NIST 800-53
What outlines the following responsibilities for the information owner, which can be interpreted the same as the data owner?
NIST SP 800-18
What outlines the following responsibilities for the system owner:
NIST SP 800-18
What outlines/regulation discusses following responsibilities for the information owner, which can be interpreted the same as the data owner?
NIST SP 800-18
What regulation frequently uses the phrase "rules of behavior," which is effectively the same as an acceptable usage policy (AUP)?
NIST SP 800-18
What regulation outlines the responsibilities and expected behavior of individuals and state the consequences of not complying with the rules or AUP? Called the "Rules of Behavior"
NIST SP 800-18
BCP/DRP Considerations -Regulations
NIST SP 800-34, ISO/IEC 27031
What is the Initiation Phase Security Certification Phase Security Accreditation Phase Continuous Monitoring Phase
NIST SP 800-37: four-step certification and accreditation process:
Security baselines provide a set of security controls that an organization can implement as a secure starting point under what publication?
NIST SP 800-53
What regulation discusses security control baselines as a list of security controls. It stresses that a single set of security controls does not apply to all situations, but any organization can select a set of baseline security controls and tailor it to its needs?
NIST SP 800-53
______block cipher had been chosen as the replacement for DES?
NIST released FIPS 197, which mandated the use of AES/Rijndael for the encryption of all sensitive but unclassified data by the US government.
Personally identifiable information (PII) is any information that can identify an individual. What policy is it under?
National Institute of Standards and Technology (NIST) Special Publication SP 800-122
What is National Institute of Standards and Technology (NIST) Special Publication for PII?
National Institute of Standards and Technology NIST Special Publication SP 800-122
This is a network vulnerability scanning tool that searches systems for known vulnerabilities
Nessus
A central authority determines what subjects can have access to certain objects based on the organizational security policy is called?
Non-Discretionary Access Control --A central authority determines what subjects can have access to certain objects based on the organizational security policy. The key focal point of this question is the 'central authority' that determines access rights
Read-only memory, flash memory, ferroelectric RAM F-RAM, most types of magnetic computer storage devices e.g. hard disk drives, floppy disks, and magnetic tape, optical discs, and early computer storage methods such as paper tape and punched cards are what type of memory?
Non-volatile memory
What is Non-volatile memory?
Non-volatile memory, nonvolatile memory, NVM or non-volatile storage is computer memory that can retrieve stored information even after having been turned off and back on.
What offers the least assurance of communication because they require a link to be established before communication can take place?
Nondedicated leased lines
What enables the enforcement of systemwide restrictions that override object-specific access control?
Nondiscretionary access control
What operates on a set of defined rules or restrictions that filter actions and activities performed on the system?
Nondiscretionary access control enables the enforcement of systemwide restrictions that override object-specific access control.
What are some important aspects to consider when designing email security
Nonrepudiation, access control, message integrity, source authentication, verified delivery, acceptable use policies, privacy, management, and backup and retention policies
Which form of memory is used for long-term retention?
Nonvolatile secondary memory is used for long-term storage. Examples of this memory type include hard drives, optical discs, and magnetic tape.
What protects against dictionary attacks as they often force users to write down the password which creates a new vulnerability having an office full of sticky notes with scribbled passwords is an attractive atmosphere for a potential hacker?
Not using password generators
using the CiS metric, which would fall under application security?
Number of Applications Using the standardized metrics chart represents the Application Security metric is Number of Applications-the compilation and review of the size, scope, and quantity of application is the concept
_________provides the response procedures for occupants of a facility in the event of a situation posing a potential threat to the health and safety of personnel, the environment, or property?
Occupant emergency plan
In an incremental backup, only the files that changed since the last backup will be backed up. In a differential backup, only the files that changed since the last full backup will be backed up. differentials require more space than incremental backups while incremental backups are faster to perform.
On the other hand, restoring data from incremental backups requires more time than differential backups. To restore from incremental backups, the last full backup and all of the incremental backups performed are combined. Restoring from a differential backup requires only the last full backup and the latest differential
___________is an internet protocol used for determining the revocation status of an X.50 Certificate.
Online Certificate Status Protocol
What is a limitation of the Bell-LaPadula model!
Only addresses confidentiality, control of writing one form of integrity ★-property and discretionary access control
What is OWASP Open Web Application Security Project?
Open Web Application Security Project is a nonprofit security project focusing on improving security for online or web-based applications
remember this: Declassification is required once an asset no longer warrants the protection of its currently assigned classification or sensitivity level.
Organizations often implement IT governance methods such as Control Objectives for Information and Related Technology COBIT. These methods help business owners and mission owners balance security control requirements with business or mission needs.
Crime Prevention Through Environmental Design CPTED
Outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior?
Remember : A wiring closet is the infrastructure component often located in the same position across multiple floors in order to provide a convenient means of linking floor‐based networks together.
Output Feedback (OFB) mode prevents early errors from interfering with future encryption/decryption. Cipher Block Chaining and Cipher Feedback modes will carry errors throughout the entire encryption/decryption process. Electronic Codebook (ECB) operation is not suitable for large amounts of data.
______channel is a path within a computer system or network that is designed for the authorized transfer of data?
Overt channel
What element of data categorization management can override all other forms of access control? Classification Physical Access Custodian responsibilities Taking ownership
Ownership gives an entity full capabilities and privileges over the object they own.
is a symmetric encryption algorithm is used in what type software and it is a 64-bit block cipher which uses a 128-bit key?
PGP
What methods could you use to protect data being transferred between two offices from an individual running a network sniffer?
PKI certificates could be used to encrypt files or to secure a connection using HTTPS encapsulation. S/MIME uses PKI certificates to protect email messages in transit. SFTP or SSH file transfer or IPSEC tunnel
PPP operates at the _ layer of the OSI. data link presentation transport physical
PPP and SLIP operate at the data link layer
The Point-to-Point Protocol (PPP) was designed to support multiple network types over the same serial link, just as Ethernet supports multiple network types over the same LAN. .
PPP replaces the earlier Serial Line Internet Protocol SLIP that only supports IP over a serial link. PPTP is a tunneling protocol.
What are the four primary VPN protocols
PPTP, L2F, L2TP, and IPSec (Note: SSL/TLS is a valid VPN protocol as well, but it's not necessarily recognized on the exam as such.
Circuit level proxy does not analyze the application content of the packet in making its decisions, it has lower overhead than an application level proxy. A circuit-level proxy creates a conduit through which a trusted host can communicate with an untrusted one.
Packet Filtering Firewall - First Generation n Screening Router n Operates at Network and Transport level n Examines Source and Destination IP Address n Can deny based on ACLs n Can specify Port
Frame relay and X.25 networks are part of which of the following?
Packet-switched services. Frame relay and X.25 are both examples of packet-switching technologies. In packet-switched networks there are no dedicated connections between endpoints, and data is divided into packets and reassembled on the receiving end.
Commercial competitors or any other entity that is not directly connected or related to the primary organization cannot have that organization's third-party governance mandated or forced on them.
Parallel security designs are insecure because a threat could pass through a single checkpoint that did not address its particular malicious activity.
_________represent the next level in testing and involve actually relocating personnel to the alternate recovery site and implementing site activation procedures
Parallel tests
What can ensure that users create strong passwords of sufficient length and complexity that can track password history and prevent users from reusing passwords?
Password Policy
________always a potential attack if a wireless network is not otherwise using some other form of authentication, typically accessed via 802.1x.
Password guessing
What are some countermeasures to common attack methods
Patching software, reconfiguring security, employing firewalls, updating filters, using IDSs/IPSs, improving security policy, using traffic filters, improving physical access control, using system monitoring/auditing
Any Business Impact Assessment has the following steps
Perform a Vulnerability Assessment Carry out a Criticality Assessment — determining how critically important a particular business function is to the ongoing viability of the organization Determine the Maximum Tolerable Downtime Establish recovery targets Determine resource requirements
Which connection type uses a logical circuit that always exists and waits for customers to send data?
Permanent Virtual Circuit PVC
____________is the transformation technique used in cryptography which changes the relative position of values without replacing them. This is also a form of bit-shuffling
Permutation
OCTAVE = Operationally Critical Threat, Asset, and Vulnerability Evaluation from Carnegie Mellon
Phase 1: Staff knowledge, assets, and threats Phase 2: Identifies vulnerabilities and evaluates safeguards Phase 3: Conducts Risk Analysis and develops risk mitigation strategy
Which layer of OSI model uses repeaters?
Physical Layer
What is is the most prominent aspect of an organizational security policy because it directly and indirectly influences all other forms?
Physical security
Remember this: cabling in buildings must meet certain safety requirements when it comes to producing harmful chemicals that dissipate from a fire. This is called what?
Plenum Space
What is an encapsulation protocol designed to support IP traffic over dial up connections?
Point to Point protocol
What allows the insertion of multiple records that appear to have the same primary key values into the database at different classification levels?
Polyinstatiation
What is a virus code that can change or mutate itself so that the originalis not detected by the antivirus scanner BUT the virus can still carry out it's malicious activity?
Polymorphic Code
_________has the capability of changing its own code, enabling it to have many different variants, making it harder to detect by anti-virus software.
Polymorphic viruses
What is a common target of scanning attacks?
Port 22 is the TCP port usually used by the Secure Shell (SSH) protocol, a common target of scanning attacks.
Remember this: Most computers have universal ports where data can be transferred. When these ports are locked and unlocked, this is done through the practice known as port control.
Port control is accomplished through firewall settings at the router or through local firewall software on the computer.
following are WELL KNOWN PORTS assigned by the IANA?
Ports 0 to 1023
What are REGISTERED PORTS range as defined by IANA
Ports 1024 to 49151
The Biba Model or Biba Integrity Model developed by Kenneth J. Biba in 1977, is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity. The model is designed so that subjects may not corrupt data in a level ranked higher than the subject, or be corrupted by data from a lower level than the subject. Which of the following is the integrity goal addressed by the Biba Model? a. Prevent interception of message content by unauthorized parties b. Prevent unauthorized data modification by authorized parties c. Maintain internal and external consistency d. Prevent data modification by unauthorized parties
Prevent data modification by unauthorized parties Details: The correct answer is: d. Prevent data modification by unauthorized parties This is the only integrity goal addressed by the Biba Integrity model. Clark-Wilson addresses all three goals of integrity but the Biba model addresses only the first goal of integrity.
Access control methods are:
Preventive - prevent actions and restrict users' access Detective - send alerts during attack Corrective - correct a damaged system Recovery - restore functionality Deterrent - deter uses from performing actions Compensating - compensating for weakness in another control system
Twofish uses two techniques not found in other algorithms what are they?
Prewhitening involves XORing the plain text with a separate subkey before the first round of encryption. Postwhitening uses a similar operation after the 16th round of encryption.
To effectively hold users accountable, your security must be legally defensibly how is this done?
Primarily, you must be able to prove in a court that your authentication process cannot be easily compromised. Thus, your audit trails of actions can then be tied to a human.
What is selected from the set of candidate keys for a table to be used to uniquely identify the records in a table?
Primary Keys
privacy-aware role-based access control what is it?
Privacy-aware role-based access control is a type of RBAC
What cloud infrastructure is provisioned for exclusive use by comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
Private Cloud
If you are a sender what key should you use to encrypt a message digest?
Private key
what is also called memory protection, ensures that each process has its own isolated memory space for the storage of data and the actual executing application code?
Process isolation
The cardinality of a table refers to the number of rows in the table whereas the degree of a table is the number of columns.
Processing screens the collected information to perform a "rough cut" of irrelevant information, reducing the amount of information requiring detailed screening.
Risk analysis is MOST useful when applied during which phase of the system development process?
Project initiation and Planning Thus risk management should be established at the commencement of the project with a risk assessment during project initiation.
The BCP process, as defi ned by (ISC)2 , has four main steps
Project scope and planning Business impact assessment Continuity planning Approval and implementation
the ISO International Standard 15408 "Evaluation Criteria for Information Technology Security", also commonly known as the Common Criteria (CC) applies to what?
Protection profiles and security targets
The protection profile is one of two building blocks of common criteria which include protection profiles and security targets. They provide reliable verification of a product's security capabilities.
Protection profiles are considered the "I want" from customers when designing security requirements.
_________is erasing the data so the media is not vulnerable to data remnant recovery attacks, including those classified as laboratory level
Purging
_________used to sufficiently cleanse remnants of data on a magnetic storage drive so that it can be reused in unsecure environments.
Purging
what is a more intense form of clearing that prepares media for reuse in less secure environments. It provides a level of assurance that the original data is not recoverable using any known methods.
Purging
Who is responsible to review result and deliverables within each phase and at the end of each phase, and confirm compliance with requirements. Their objective is to ensure that the quality of the project by measuring adherence of the project staff to the organization's software development life cycle?
Quality Assurance
What would you use to prioritize traffic on a converged network?
Quality of Service
What are hard values and percentages measured?
Quantitative risk analysis
What are three remote access authentication mechanisms?
RADIUS, DIAMETER, and TACACS
Which is the RAID implementation that creates one big disk by using two disk as one large volume?
RAID 0 RAiD 0 creates one large disk by using several disks which is a process called striping.
remember this:In an IP Header in Byte Offset 8 there are 8 bits yielding 256 possible maximum hops before any packet expires.
RAID 3- RAID or Redundant Array of Individual Disks is a physical disk drive array that provides fault tolerance by spreading data across separate physical disks to both enhance speed and provide protection against individual disk failure.
What RAID focuses on performance rather than data redundancy and no fault tolerance?
RAID Level 0
What RAID provide no fault tolerance of the disk system rather than increasing it. The entire data volume is unusable if one drive in the set fails
RAID Level 0
Which RAID Writes files in stripes across multiple disks without the use of parity information. This technique allows for fast reading and writing to disk because all of the disks can be accessed in parallel?
RAID Level 0
which RAID has the highest cost per megabyte since every piece of data is written at two different locations simultaneously for redundancy purposes?
RAID level 1 mirroring
Which RAID levels run faster on hardware?
RAID levels 3 and 5
it is volatile hardware memory that loses integrity after power is shut off
RAM
following algorithms is a stream cipher?
RC4
is a symmetric encryption algorithm. It is a block cipher of variable block length, encrypts through integer addition, the application of a bitwise Exclusive OR XOR, and variable rotations
RC5
_____is a symmetric algorithm patented by Rivest, Shamir, and Adleman (RSA) Data Security,
RC5 which is a block cipher of variable block sizes 32, 64, or 128 bits that uses key sizes between 0 zero length and 2,040 bits
What RFC contains the Internet Advisory Board's statement on ethics and the Internet? A. RFC 1087 B. RFC 1918 C. RFC 2048 D. RFC 2296
RFC 1087 outlines the IAB's position on proper use of the Internet.
What is the name for a substitution cipher that shifts the alphabet by 13 places?
ROT13 cipher. ROT13 "rotate by 13 places", is a simple letter substitution cipher that replaces a letter with the letter 13 letters after it in the alphabet. ROT13 is an example of the Caesar cipher, developed in ancient Rome.
an asymmetric encryption algorithm is based on the difficulty of factoring large numbers--what is it?
RSA
What is RAM
Random Access Memory, it is volatile hardware memory that loses integrity after power is shut off
Which one of the following terms can be used to describe RAM memory?
Random access memory RAM is accessed in a random, rather than a sequential, fashion
Input or Information Accuracy in Software Development security requires
Range checks, Relationship checks, Reasonableness checks
what is a software development methodology that uses minimal planning in favor of rapid prototyping?
Rapid application development
what usually provides a quicker warning than fixed-temperature sensors because they are more sensitive, but they can also cause more false alarms?
Rate-of-rise temperature sensors
What is ROM?
Read only memory--nonvolatile memory that maintains integrity after the loss of power.
what must be either uniquely identified by a witness or authenticated a documented chain of custody?
Real evidence
What is the difference between recovery and restoration?
Recovery involves bringing businesses operations and processes back to a workable state. restoration involves bringing a business facility and enviornment back to a workable state.
What type of site is owned by the company and are mirrors of the original production environment
Redundant Site
the software testing level tests software after updates, modifications, or any patches?
Regression testing
Data Classification programs are best sponsored by the highest ranking official
Remember : Security awareness training is supported all the way to the top.
Remember isolation between subjects and objects is the Security kernel
Remember following device in Frame Relay WAN technique is a service provider device that does the actual data transmission and switching in the frame relay cloud is the DCE
Remember this: It is possible that an organization may not need a disaster recovery plan. An organization may not have any critical processing areas or system and they would be able to withstand lengthy interruptions.
Remember that DRP is related to systems needed to support your most critical business functions.
Remember this: Preaction systems allow more reaction time in case of a false alarm.
Remember this : A surge is a prolonged rush of high voltage power.
Remember this :Performing Reduction Analysis is a decomposition process, identify five key concepts: :Trust Boundaries Data Flow Paths Input Points, Privileged Operations, Details about Security Stance and Approach
Remember this : Prioritization and Response to threats using the DREAD rating system solution that is based on the answers to five main questions about each threat
Remember this: Biba is known as the Biba Integrity Model. The Bell-LaPadula model focuses on data confidentiality and controlled access to classified information.
Remember this : The information flow model is based on a state machine, and it consists of objects, state transitions, and lattice states. In this context, objects can also represent users. .
Remember this :The phase of the IDEAL model does the organization develop, test, refine, and implement solutions is in the acting phase
Remember this :The BCP implementation phase is where the largest commitment of hardware and software resources. The other phases are more manpower intensive.
Remember this :Accountability is the ultimate goal of a process started by identification.
Remember this :The process of performing qualitative risk analysis involves judgment, intuition, and experience—in other words, opinions.
Remember this :Commercial competitors or any other entity that is not directly connected or related to the primary organization cannot have that organization's third-party governance mandated or forced on them.
Remember this Electronically erasable programmable read-only memory EEPROM chips can be erased by modulating an electric current applied to the chip.
remember this: In addition to the accuracy of the biometric systems, there are other factors that must also be considered. These factors include the enrollment time, the throughput rate, and acceptability.
Remember this Water is appropriate for class A common combustibles fires. Class B fires liquid are best handled by CO2, soda acid or Halon. Class C fires electrical are best handled by CO2 and Halon. Fire class D is used for combustible metals like magnesium.
Remember this : DREAD rating system is Damage potential, Reproducibility, Exploitability, Affected users, Discoverability
Remember this When evaluating a third party for your security integration, consider the following processes:On-Site Assessment, Document Exchange and Review, and Process/Policy Review
remember this: memory cards and smart cards are different because memory cards and smart cards is their capacity to process information. A memory card holds information but cannot process information. A smart card holds information with hardware and software to actually process that information.
Remember this a very active attack. The attacker will make use of a scanner to perform the attack, the scanner sends packets to the target in order to illicit responses that allows the attacker to find information about the operating system, vulnerabilities, misconfiguration and more.
Remember this SAML is a popular SSL language on the Internet X ACM CL has become popular with software defined networking applications
Remember this the secure European system for application in a multivendor environment SESAMe is a ticket based authentication system developed to address weakness in Kerberos.
Remember this--Generally, the purpose of STRIDE and other tools in threat modeling is to consider the range of compromise concerns and to focus on the goal or end results of an attack.
Remember this--Determining and Diagramming Potential Attacks is often accomplished through the creation of a diagram of the elements involved in a transaction along with indications of data flow and privilege boundaries
Rerember this: A database row contains the information that makes up a single database record.
Remember this: A The top-down approach is the aspect of security governance that is based on the idea that senior management is responsible for the success or failure of a security endeavor.
Remeber this: NAT does not allow initiations from external entities. Therefore, allowing external initiations is not a benefit. The benefit is that NAT does not allow them.
Remember this: A custodian is someone who has been assigned to or delegated the day-to-day responsibility of proper storage and protection of objects. A user is any subject who accesses objects on a system to perform some action or accomplish a work task. An owner is the person who has final corporate responsibility for the protection and storage of data.
Remeber this: The primary key is selected from the pool of available candidate keys for each table.
Remember this: Access control is any hardware, software, or organizational administrative policy or procedure that grants or restricts access, monitors and records attempts to access, identifies users attempting to access, and determines whether access is authorized.
Remember this: When a user manages to compromise a colleagues account of similar privileges it is known as horizontal-privilege escalation.
Remember this: Allowing the compromise of that colleagues files and own account permissions. Vertical-Privilege escalation is the act of compromising an account with nativity higher administrative rights. Generally an administrator or manager account.
Remember this: difference between a hacker attacking a network and a legitimate penetration test is Written permission from the network owner whereas a hacker they dont
Remember this: Anomaly-Based firewall looks for traffic that just isn't normal and if it crosses a threshold, action can be taken by the IDS/IPS. Anything different that the normal traffic triggers action.
Remember this: the user mode is is designed to protect users from accidentally damaging the system through the execution of poorly designed code
Remember this: Auxiliary alarm systems facilitate local, remote, and centralized alarm systems by notifying external sources police, fire, medical of signifying events.
Remember this: Confidentiality is the principle that objects are not disclosed to unauthorized subjects. Integrity is the principle that objects retain their thruth and are intentionally modified by only authorized subjects.
Remember this: Availability is the principle that authorized subjects are granted timely and uninterrupted access to objects.
Remember this: The Loki attack uses the ICMP protocol for communications between two systems,
Remember this: ICMP was designed to be used only for sending status and error messages about the network. Because the Loki attack is using ICMP in an unintended manner, this constitutes a covert channel attack.
Remember this: In cryptanalysis, frequency analysis is the study of the frequency of letters or groups of letters in a ciphertext. The method is used as an aid to breaking classical ciphers.
Remember this: In SQL, a view is a virtual table based on the result-set of an SQL statement. A view contains rows and columns, just like a real table. The fields in a view are fields from one or more real tables in the database.
Remember this principle that can be summed up as "the enemy knows the system is Kerckchoffs. -states that a cryptographic system should remain secure even when all details of the system, except the key, are public knowledge.
Remember this: Industrial espionage is usually considered a business attack.
Remember this: To be effective, the approach to security management must be a top-down approach. The responsibility of initiating and defi ning a security policy lies with upper or senior management.
Remember this: Middle management is responsible for fleshing out the security policy into standards, baselines, guidelines, and procedures
Remember this: The agile software development methodology prioritizes flexible development that emphasizes responding to change over following a plan.
Remember this: Multipartite viruses use more than one propagation technique in an attempt to penetrate systems that defend against only one method or the other.
remember this an off site so that it can quickly be made operational is incorrect as the offsite is also subject to the same disaster as of the primary site.
Remember this: Password management falls into Preventive control. Password management is an example of preventive control. Proper passwords prevent unauthorized users from accessing a system.
Remember this :Requiring authentication time-outs bears no direct result on password attack protection. Strong password enforcement, restricted physical access, and two-factor authentication help improve security posture against automated attacks.
Remember this: Sanitation is the process of wiping storage media clean in preparation for disposal or destruction.
Remember this:act includes provisions to protect consumers' personal financial information held by financial institutions is the Gramm-Leach-Bliley Act" or GLB Act
Remember this: Sarbanes-Oxley Act introduced highly significant legislative changes to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws.
Remember this Need to know is more granular
Remember this: Task-based = another nondiscretionary method
Remember this: Triple DES has an effective key length of 168 bits.
Remember this: The 10 system is a code used in radio communications for brevity and clarity.
Remember this: The lattice model is a label-based Mandatory Access Control (MAC) model
Remember this: The Graham-Denning Model is a computer security model that shows how subjects and objects should be securely created and deleted. It also addresses how to assign specific access rights. It is mainly used in access control mechanisms for distributed systems.
Remember this :The of the key elements of the BCP documentation is a list of future events that might warrant reconsideration of the determination that a risk is acceptable.
Remember this: The SHA-2 algorithms support the creation of message digests up to 512 bits long.
Remember this: SESAME is subject to password guessing like Kerberos.
Remember this: The cost of access control must be commensurate with the value of the information that is being protected
Remember this: Security management planning includes defining security roles, developing security policies, performing risk analysis, and requiring security education for employees.
Remember this: The security management team should develop strategic, tactical, and operational plans.
Remember this: Other aspects of security solution concepts and principles are the elements of protection mechanisms: layering, abstraction, data hiding, and encryption as the common characteristics of security controls
Remember this: Those assigned the senior management role are ultimately responsible and liable for any asset loss, and they are the ones who define security policy
Remember this: Threat modeling refers to security process that depicts potential identified threats categorized threats, and the analysis of threats
Remember this: Threat modeling can be performed: First, as a proactive measure during design and development Second, as a reactive measure taken once a product has been deployed.
Remember this: only two parts of a packet which changes between sending host and the receiving host while in transit is Time to Live and MAC Address
Remember this: Time to Live. It's that part of the IP Header that prevents packets from wandering around the internet forever looking for the destination.
Remember this :Processing screens the collected information to perform a "rough cut" of irrelevant information, reducing the amount of information requiring detailed screening.
Remember this: To make the determination of whether the safeguard is financially equitable ALE before countermeasure - ALE after implementing the countermeasure - annual cost of countermeasure = value of the countermeasure to the company.
Remember this: RAID 1+5 is nested RAID involving the mirroring which is RAID 1 of striped drive sets with evenly distributed parity data which is RAID 5
Remember this: VBScript is the only example of an interpreted language listed. C++, Java, and Fortran are compiled languages
Remember this: the need for encryption is hiding the meaning or intent of a communication from unintended recipients
Remember this: When information is collected about your activities online without your consent, it is known as a violation of privacy.
Remember this: A key should always be using the full spectrum of the keyspace and be extremely random
Remember this: When using link encryption, packets have to be decrypted at each hop and encrypted again.
Remember this: the biggest threat to new devices introduced to a network Default Passwords.
Remember this: default passwords on devices and are usually configured as insecure as possible so that they work right out of the box. Great for marketing, terrible for security.
Remember this: Identification is the process by which a subject professes an identity and accountability is initiated
Remember this: identity must occur by a subject to a system to begin the process of authentication, authorization, and accountability
Remember this:the elements of a formalized security policy structure: security policy, standards, baselines, guidelines, and procedures. Such documentation clearly states security requirements and creates due diligence on the part of the responsible parties.
Remember this: key security roles are: senior manager, organizational owner, upper management, security professional, user, data owner, data custodian, and auditor. By creating a security role hierarchy, you limit risk overall.
Remember this: Encryption doesn't insure integrity. Hashing algorithms would be used instead to validate integrity.
Remember this: method of remote access that was retired by Microsoft because it relies on LANMAN hashes, reuse of session keys and the use of an unauthenticated control channel, PPTP is considered broken and therefore unsafe.
Remember this: MAC Addresses are local only to the network you are on. The moment it hits the first router or switch the Source and Destination MAC Addresses change to the next hop in the path
Remember this: most benefits from the process of encryption is Confidentiality.
Remember this: Integrating cyber security risk management with acquisition strategies and practices is a means to ensure a more robust and successful security strategy in all organizations
Remember this: purchases without security considerations inherent risks occur throught the product life span or cycle.
Remember this: security management planning involves: strategic, tactical, and operational
Remember this: strategic plan is a long-term plan that is fairly stable. The tactical plan is a midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan. Operational plans are short-term
Remember this: implement security awareness training. Before training occurs, awareness of security as a recognized entity must be created for users. Once this is accomplished, training, or teaching employees to perform their work tasks and to comply with the security policy, can begin
Remember this: the concept of abstraction is is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions as a collective. It adds efficiency to carrying out a security plan.
Remember this: It is the responsibility of the operationalmanagers or security professionals to implement the configurations prescribed in the security management documentation
Remember this: the end users' responsibility is to comply with all security policies of the organization
Remember this: Auditing detects malicious actions by subjects, attempted intrusions, and system failures. Auditing can reconstruct events, provide evidence for prosecution, and produce problem reports and analysis
Remember this: the importance of accountability makes subjects held accountable for their actions. Relies on the capability to prove a subject's identity and track their activities.
Remember this: Cipher feedback mode C F B uses streaming cipher compared to C B C block cipher
Remember this: the maximum allowed Ping packet size is 65, 536 bytes. To engage in any pain of death attack and attack or less send a packet that exceeds this maximum. Therefore the smallest packet that might result in a successful attack would be 65,537 bytes..
Remember this: Examples of which attacks a firewall cannot mitigate Reverse-Engineering HTTP Cookies URL Interpretation attacks User Input validation attacks SQL query poisoning
Remember this: two of the most common detection mechanisms for Intrusion Detection or Intrusion Prevention Systems are Anomaly Detection and Signature Detection
Remember this: differences between the Session and Transport layers of the OSI model is that the Transport layer sets up communication between computer systems, while the Session layer sets up connections between applications.
Remember this: web server threats can a packet filter firewall can mitigate are ICMP Flood attacks.
Remember this: Tokens such as RSA tokens are less susceptible to electronic eavesdropping, replay attacks, and password guessing due to their limited life passcode. They provide a higher level of security than static passwords.
Remember this:. When the discretionary access control method is used to control access to a system and network resources, the owner of the resource has the necessary privileges to assign permissions.
Remember this: System owners interact with data owners to ensure the data is protected while at rest on the system, in transit between systems, and in use by applications operating on the system
Remember this:A data administrator is responsible for granting appropriate access to personnel. They don't necessarily have full administrator rights and privileges, but they do have the ability to assign permissions.
Remember this: S/MIME supports the DES, RC2, and 3DES symmetric encryption algorithms and also uses RSA for public key encryption. It does not provide support for IDEA.
Remember this:Degaussing does not remove data from optical media. Overwriting files isn't a reliable method of removing data remnants.
Remember this::Bell-LaPadula Model suitable for preventing unauthorized access to secret informationIt prevents users and processes from reading above their security level.
Remember this:In a lattice model every resource and every user of a resource is associated with one of an ordered set of classes. The classes were based on military security classless . If you had clearance to secret you couldn't read up to top secret
Remember this: Authentication is the process of verifying or testing that a claimed identity is correct. Authentication requires information from the subject that must exactly correspond to the indicated identity.
Remember this:Once a subject is authenticated, its access must be authorized.
Remember this: An ultimate goal of threat modeling is to prioritize the potential threats against an organization's valuable assets
Remember this:STRIDE stands for Spoofing Tampering—Any action resulting in the unauthorized changes Repudiation—The ability for a user or attacker to deny having performed an action Information disclosure Denial of service Elevation of privilege
Remember this: process of authorization requested activity or object access due to the given rights and privileges assigned to the authenticated identity
Remember this:Security governance is the collection of practices related to supporting, defining, and directing the security efforts of an organization
Remember this: least preferred remote access method from a security and control point of view is Dial-up connectivity not based on centralize control and least preferred from security and control standpoint.
Remember this:When attempting to inventory and categorize threats, it is often helpful to use a guide or reference. Microsoft developed a threat categorization scheme known as STRIDE.
Remember this:The person assigned the data owner role is responsible for classifying information, and a data custodian is responsible for maintaining the secure environment and backing up data.
Remember thisAn auditor is responsible for making sure a secure environment is properly protecting assets.
Remember this: individual documents are essential elements to the design and implementation of security in any environment consists of policies, standards, baselines, guidelines, and procedures
Remember. Lattice-based access controls deal primarily with integrity. Lattice-based access controls primarily deal with confidentiality. Lattice-based access control and the Bell-LaPadula model are connected.
Remember: Data classifications provide strong protection against the loss of confidentiality. Data labels and proper data handling are based on first identifying data classifications. Data degaussing methods apply only to magnetic media.
Remember: An asynchronous token generates and displays one-time passwords using a challenge-response process to generate the password. synchronous token is synchronized with authentication server and generates synchronous one-time passwords.
Remember Risk assessments requires and evaluation of assets and related threats to those assets. You never implement countermeasures. You can suggest but not implement.
Remember: Automated tools in risk analysis have a lot of necessary questions that are pre-programmed and are best to use. They can decrease the time alloted
Remember: Stream ciphers can be designed to be exceptionally fast, much faster than any block cipher. A stream cipher generates what is called a key stream a sequence of bits used as a key.
Remember: Block ciphers do not use public cryptography private and public keys.
Remember: B1 does not address covert channels. B2 requires a system to protect against covert storage channels but does not address covert timing channels. B3 and A1 both address covert storage channels and covert timing channels and must perform a covert channel analysis for both types.
Remember: Data should usually be normalized, thus avoiding data redundancy.
Remember: L2TP Protocol works at data link layer. L2TP and PPTP were both designed for individual client to server connections; they enable only a single point-to-point connection per session.
Remember: Dial-up VPNs use L2TP often. Both L2TP and PPTP operate at the data link layer layer 2 of the OSI model. PPTP uses native PPP authentication and encryption services and L2TP is a combination of PPTP and Layer 2 Forwarding protocol L2F.
Remember this: Corporate governance deals with governance procedures of the whole organization and all its functions. Security governance is a subset of it
Remember: Downstream liability requires that companies ensure their activities or lack of activity do not negatively affect other companies.
Remember: The European Union's data privacy directive does not grant individuals the right to delete data from corporate databases.
Remember: Hot sites are the only site capable of activation within the required six-hour timeframe.
Justifications should be provided when data is denormalized, not when it is normalized, because it introduces risk of data inconsistency. Denormalization is usually introduced for performance purposes.
Remember: In response to an access-request from a client, a RADIUS server returns one of three authentication responses: access-accept, access-reject, or access-challenge
Remember Kerberos uses only symmetric encryption and does not make use of any public key component.
Remember: Key Distribution Center provides services to principals , which can be users , applications or network services.
Remember: Due to the nature of the terms, Decentralized and Distributed are used interchangeably. Distributed Access Control is a single sign-on role-based access control system for web servers and server-based software used in the authentication process.
Remember: Logging is the collection of information used in monitoring. Accounting for this activity is necessary for detecting security issues such as unauthorized access incidents. Logging collects and time-stamps system activity and even records a user ID if it's related to auditing user access.
Remember: Security mechanisms are needed within an operating system because software is not trusted
Remember: Most higher-order security models, such as Bell-LaPadula and Biba, are based on the state machine model as well as the information flow and noninterference models.
Remember: Identification establishes user accountability for the actions on the system.
Remember: Transformational procedures programs operate only on unconstrained data items.
Remember: However, it's important to note that copyright law protects only the expression inherent in computer software—that is, the actual source code. It does not protect the ideas or process behind the software.
Remember: it is important to note that officially registering a copyright is not a prerequisite for copyright enforcement.
Remember : Control Objectives for Information Technology is a framework and a set of business practices
Remember: learning a user ID and password and using them is not backdooring but masquerading
Remember: The BCP team should sit down and determine an ARO for each risk identifi ed in the previous section.
Remember: to find likelihood assessments for some risks prepared by experts at no cost to you the U.S. Geological Survey (USGS) developed the earthquake hazard map. Federal Emergency Management Agency (FEMA) coordinates the development of detailed fl ood maps of local communities throughout the United States
What is a __________technology maintains mirrored images of servers at both the primary and alternate sites.
Remote Mirroring
___________can be accomplished on Kerberos if the compromised tickets are used within an allotted time window?
Replay
A BCP team. The team should include, at a minimum, the following individuals
Representatives from departments responsible for the core services performed by the business key support departments Representatives IT representatives with technical expertise Security representatives Legal representatives senior management reps
What is the final step of the business impact assessment (BIA) process?
Resource prioritization
What step is Resource Prioritization in the business impact assessment?
Resource prioritization is the final step
What algorithm has been selected as the AES algorithm, replacing the DES algorithm?
Rijndael
Ring model consists of
Ring zero which is the kernel Ring one with is the Operating System Ring two which is the device drivers Ring 3 is the User Applications
the process by which risk management is achieved and includes analyzing an environment for risks, evaluating each risk as to its likelihood of occurring and the cost of the resulting damage, assessing the cost of various countermeasures for each risk, and creating a cost/benefit report for safeguards to present to upper management
Risk analysis
What is risk analysis?
Risk analysis is the process by which upper management is provided with details to make decisions about which risks are to be mitigated, which should be transferred, and which should be accepted
What is Risk Avoidance?
Risk avoidance is the practice of coming up with alternatives so that the risk in question is not reali
What is Risk Mitigation?
Risk mitigation is the practice of the elimination of, or the significant decrease in the level of risk presented. Examples of risk mitigation can be seen in everyday life and are readily apparent in the information technology world. Risk Mitigation involves applying appropriate control to reduce risk.
What's RSN?
Robust Security Network
Non Discretionary Access Control (NDAC) can also be referred to as?
Role-Based Access Control
Name at least five networking device types other than firewalls
Routers, switches, hubs, repeaters, bridges, gateways, proxies
What are possible mechanisms for adding security to email
S/MIME, MOSS, PEM, and PGP
what is an Extensible Markup Language (XML) standard that allows a user to log on once for affiliated but separate Web sites and is designed for business-to-business (B2B) and business-to-consumer (B2C) transactions.?
SAML
What is SAML?
SAML (Security Assertion Markup Language) is an Extensible Markup Language (XML) standard that allows a user to log on once for affiliated but separate Web sites. SAML is designed for business-to-business (B2B) and business-to-consumer (B2C) transactions.
Which addressed some of the shortcomings in Kerberos and uses public key cryptography for Secret Key distribution provides additional access control support
SESAME -Secure European System for Applications in a Multi-vendor Environment (SESAME) was developed to address the weaknesses in Kerberos and uses public key cryptography for the distribution of secret keys and provides additional access control support.
what is a hashing algorithm producing a 160-bit hash result from any data. and does not perform encryption.
SHA-1
what produces a 160-bit message digest
SHA-1
The SLE is calculated using the following formula:
SLE = asset value (AV) times exposure factor (EF) or more simply: Single Loss Expectancy = Asset Value times Exposure Factor SLE=AV X EF
what is a single loss expectancy (SLE) and how is it calculated?
SLE is an element of quantitative risk analysis that represents the cost associated with a single realized risk against a specific asset. The formula is SLE = asset value (AV) * exposure factor (EF).
clear text protocols is normally disallowed through a firewall from the internet in it's unprotected form?
SNMP are insecure versions uses a community string in clear text. Having a rule on your firewalls allowing such traffic may permit an attacker to gain a lot of information for your devices or in some case have the ability to reconfigure your devices. So never allow SNMP through a firewall
When a user is attempting to connect to a SNMP service on an internal system that while booted and functioning is not actually running an SNMP server, what information response will their system receive?
SNMP is a UDP-based service. UDP can not send back errors, because it is a simplex protocol. Thus, when UDP errors occur, ICMP Type 3 error will be returned.
SNORT is a(n): Firewall IDS Password Cracking tool Password sniffing tool
SNORT is an open source network IDS
what report focuses on a business's non-financial reporting controls as they relate to security, availability, processing integrity, confidentiality, and privacy of a system.
SOC-2 report
What attacks allow hackers to bypass normal access controls and gain access to the database supporting a web application?
SQL injection
What uses a public-key cryptography to secure session key, while the session key secret key is used to secure the whole session taking place between both parties communicating with each other?
SSL
What describes the relationship between SSL and TLS?
SSL is a proprietary protocol whereas TLS was developed by a standards body, making it an open-community protocol
What are some types of threat modeling?
STRIDE, diagramming, reduction/decomposing, and DREAD
_______is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic?
SYN Flood Attack
What is notice, choice, onward transfer, security, data integrity, access, and enforcement
Safe Harbor principles
Communications devices must operate at what rate of speed to communicate?
Same speed
What is any number of processes that prepares media for destruction. It ensures that data cannot be recovered by any means from destroyed or discarded media.
Sanitization
_________is a combination of processes that removes data from a system or from media. It ensures that data cannot be recovered by any means?
Sanitization
What refers to reviewing a baseline baseline security controls and determining what standard will be used or employed?
Scoping
What refers to reviewing baseline security controls and selecting only those controls that apply to the IT system you're trying to protect.
Scoping
What refers to reviewing baseline security controls and selecting only those controls that apply to the IT system you're trying to protect?
Scoping
What is a technology that can allow an automated tool to interact with a human interface?
Screen scraping
firewall that communicates directly with a perimeter router and internal network is called ___.
Screened host
Which from the following list is the lowest military data classification for classified data Sensitive Secret Proprietary Private
Secret.......read the question!!!!!!! There is no sensitive in the military...
_____________provides secure replacements for a number of common Internet utilities.
Secure Shell (SSH)
What should be addressed at the design phase?
Security
who is responsible for providing adequate physical and logical security for IS programs, data and equipment?
Security Administrator
Who is responsible for implementing user clearances in computer based information systems at the B3 level of TCSEC?
Security Administrators are responsible - set clearances, set initial passwords, and new user security or changing policies for existing users.
Security Assertion Markup Language S A M L?
Security Assertion Markup Language SAML is an XML standard that allows secure web domains to exchange user authentication and authorization data. Using SAML, an online service provider can contact a separate online identity provider to authenticate users who are trying to access secure
What is a collection of components in the TCB that work together to implement reference monitor functions is called the _________________?
Security Kernel
Physically securing the tapes from unauthorized access is obviously a security concern and is considered a function of the what?
Security Operations Domain.
Security requires two components? What are those two components?
Security requires both a technological component and a procedural human component to result in a well-balanced information security program.
What specifies the claims of security from the vendor that are built into a Target of Evaluation?
Security targets (STs)
An IT auditor is assigned to perform an independent classification of systems. In the event that the IT auditor identifies a system where functions can be performed manually at an acceptable cost to the company for a long period of time, how should the IT auditor classify that system?
Sensitive functions are best described as those that can be performed manually at a tolerable cost for an extended period of time.
What is the main reason is carry out separation of duties?
Separation of duties - main reason is to ensure one person can't carry out a task that can be damaging or risky for a company.
rerember this : Separation of duties--This prevents any one person from having the ability to undermine or subvert vital security mechanisms.
Separation of duties is also a protection against collusion , which is the occurrence of negative activity undertaken by two or more people, often for the purposes of fraud, theft, or espionage.
What in the OSI-model Transport layer protocol in the IPX/SPX protocol stack. It is a reliable, connection-oriented protocol, similar to the TCP protocol of the TCP/IP, but it is datagram rather than stream protocol.
Sequence Packet Exchange
Which of the following is the most important and distinctive concept in relation to layered security? Multiple Series Parallel Filter
Series basically this states that layering is the multiple CONTROLS in a series when it comes to the distinctive concept in relation to layered security...
What law mandates protection of privacy data. Third parties agree to abide by principles as a method of ensuring that they are complying with the EU Data Protection law. The seven principles are notice, choice, onward transfer, security, data integrity, access, and enforcement
Seven Safe Harbor principles
When online transactions processing system OLTP has erroneous errors on invalid transactions that are noticed what actions do you take?
Should be written to a report and reviewed--logs must be reviewed
Information flow model
Similar to Bell La Padula model and control how information may flow between objects based on security classes. Information flows in accordance with security policy
Simple Network Management Protocol (SNMP) is?
Simple Network Management Protocol (SNMP) is an Internet-standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. Devices that typically support SNMP include routers, switches, servers, workstations, printers, modem racks and more.
What is a subject may not read information at a higher sensitivity level no read up.
Simple Security Property
A Security Information and Event Management SIEM system is the best tool to search through large log files looking for intrusion-related events.
Simulation tests are similar to the structured walk-throughs. In simulation tests, disaster recovery team members are presented with a scenario and asked to develop an appropriate response.
What is an element of quantitative risk analysis that represents the cost associated with a single realized risk against a specific asset?
Single Loss Expectancy
what can be implemented by using scripts that replay the users multiple log-ins against authentication servers to verify a user's identity and to permit access to system services?
Single Sign On
Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers to verify a user's identity which permit access to system services? a. Kerberos b. Smart cards c. Dynamic Sign-On d. Single Sign-On
Single Sign-On SSO can be implemented by using scripts that replay the users multiple log-ins against authentication servers to verify a user's identity and to permit access to system services. Single Sign on was the best answer in this case because it would include Kerberos.
What is an attempt to deceive an insider into performing questionable actions on behalf of some unauthorized outsider..
Social engineering
what is a combination of flash memory EEPROM and DRAM
Solid State Drive
Remember this When purchases are made without security considerations, the risks inherent in those products remain throughout their deployment lifespan.
Some organizations must craft job descriptions to be in compliance with SOC-2, while others following ISO 27001 require annual reviews of job descriptions
what is a security target?
Specifies the claims of security from the vendor that are built into the Target of Evaluation
What is unique "what each must bring" and joined together when implementing dual control
Split knowledge
The STRIDE Threat Model
Spoofing identity Tampering with data Repudiation Nonrepudiation Information disclosure Denial of service Elevation of privilege
Application Level Firewall - Second Generation n Proxy Server n Copies each packet from one network to the other n Masks the origin of the data n Operates at layer 7 n Reduces Network performance since it has do analyze each packet and decide what to do with it. n Also Called Application Layer Gateway
Stateful Inspection Firewalls - Third Generation n Packets Analyzed at all OSI layers n Queued at the network level n Faster than Application level Gateway
What is the tranquility principle of the Bell La Padula Model?
States that the classification of a subject or object does not changed while being referenced.
What prevents ARP attacks?
Static ARP binding help prevent ARP attacks since the attacker's spoofed ARP replies would no longer cause any changes in the (static) ARP cache.
What's a fast expensive memory that uses small latches called "flip flops" to store bits?
Static Random Access Memory
Which of the following NAT firewall translation modes is required to make internal hosts available for connection from external hosts
Static Translation: With static translation also called port forwarding, a specific internal network resource usually a server has a fixed translation that never changes. Static NAT is required to make internal hosts available for connection from external hosts
What are the five generation types of firewalls?
Static packet filtering, application-level gateway, stateful inspection, dynamic packet filtering, and kernel proxy
A virus that hides itself from OSes and other protective software, such as antivirus shields is what?
Stealth Virus
What alter operating system file access routines so that when an antivirus package scans the system, it is provided with the information it would see on a clean system rather than with infected versions of data?
Stealth viruses
The purpose of the CAM table is to:
Store MAC addresses for the purpose of forwarding frames
Storage of Hard DriveS should:
Store hard drives in anti-static bags, and be sure that person removing them from bag is static free If the original box and padding for the hard drive is available, use it for shipping If the hard drive has been in a cold environment, bring it to room temperature prior to installing and using it
What cipher is a type of symmetric encryption algorithm that operates on continuous streams of plain text and is appropriate for hardware-based encryption.
Stream
What Cipher is appropriate for hardware based encryption?
Stream Cipher
What are The Three Parts of the Relational Model?
Structural: defines the core of the data and the relationships involved described in terms of relations , tuples , attributes and domains . Manipulative: defines how the data in the model will be accessed and manipulated. Constraints: defines limits on the model. T
strong business continuity plan requires the use of a proven methodology. This requires the following:
Structured analysis of the business's organization from a crisis planning point of view The creation of a BCP team with the approval of senior management--An assessment of the resources available to participate in business continuity activities--An analysis of the legal and regulatory landscape that governs an organization's response to a catastrophic event
What Uses the same key for communication in any direction
Symmetric key
Remember this: Asymmetric cryptosystems use public-private key pairs for communication between parties but operate much more slowly than symmetric algorithms.
Symmetric key cryptosystems or secret key cryptosystems) rely on the use of a shared secret key. They are much faster than asymmetric algorithms, but they lack support for scalability, easy key distribution, and nonrepudiation
What is the difference between a Synchronous Dynamic Password Token and a Asynchronous Dynamic Password Token?
Synchronous dynamic are based on time and synchronized with an authentication server . They produce a new password periodically like every 60 sections. Asynchronous Dynamic tokens does not use a clock. Passwords are based on an algorithm with an incrementing counter.
What provides the most granular or distinctive control over resources and users because it enforces clearances, requires need to know, and allows the processing of only single sensitivity levels
System High
what are the processes I communicate between the rings?
System calls which allows processes to communicate with the kernel and provide a window between the rings.
Which of the following cannot be undertaken in conjunction or while computer incident handling is ongoing?
System development activity if an Incident Handling is underway an incident has potentially been identified. At that point all use of the system should stop because the system can no longer be trusted and any changes could contaminate the evidence. This would include all System Development Activity.
Who are authorized to process data at different classification levels only if all system users have access to the highest level of classification processes?
System running in system High mode.
___________is responsible for granting appropriate access to personnel. They don't necessarily have full administrator rights and privileges, but they do have the ability to assign permissions
System/Data Administrator
_________is an application that can serve as a basic firewall by restricting access based on user IDs or system IDs.
TCP wrapper
Any backup strategy must include full backups at some point in the process. If a combination of full and differential backups is used, a maximum of two backups must be restored. If a combination of full and incremental backups is chosen, the number of required restorations may be unlimited.
TCP wrapper is an application that can serve as a basic firewall by restricting access based on user IDs or system IDs.
What is the IP header contains a protocol field for TCP?
TCP=6
What was developed in the 1950s by the US government to address electromagnetic radiation being emitted from electrical equipment data that can be captured via electrical signals in reconstructed which threatens the confidentiality of sensitive data?
TEMPEST
What type of data is a secure protocol implemented in web application traffic to ensure privacy between client and server communications to protect this type of data
TLS --Data in Transit/Motion
What was replaced for SSL?
TLS Transport Layer Security was specifically designed as a replacement for SSL.
Traceroute works by exploiting which specific feature? IP TTL ICMP RTT
TTL--To troubleshoot Windows network connectivity problems, use this introduction to time-to-live (TTL) and trace route.
SQL is a relational database Query language. SQL stands for structured query language. What describes how the tables and views are structured?
Tables
What is designed to focus a timeframes of approximately one year and may include scheduling of tasks, assignment of responsibilities, hiring plans, maintenance plans, and even acquisition plans?
Tactical planning
What refers to modifying the list of security controls within a baseline so that they align with the mission of the organization or customizing a standard for your organization?
Tailoring
what refers to modifying the list of security controls within a baseline so that they align with the mission of the organization?
Tailoring
what are the common criteria terms?
Target of evaluation, security target, protection profile, evaluation assurance level.
What include access controls; intrusion detection; alarms; closed-circuit television (CCTV); monitoring; heating, ventilating, and air conditioning (HVAC); power supplies; and fire detection and suppression?
Technical physical security controls
remember this: Bind variables are placeholders for literal values in a Structured Query Language (SQL) query being sent to the database on a server.
The *- star integrity axiom of the Biba access control model states that an object at one level of integrity is not permitted to modify an object of a higher level of integrity -no write up
What is FIPS-140?
The 140 series of Federal Information Processing Standards (FIPS) are U.S. government computer security standards that specify requirements for cryptography modules.
What are the differences between the The Bell-LaPadula model and the Biba model?
The Bell-LaPadula model focuses on data confidentiality and controlled access to classified information, in contrast to the Biba Integrity Model which describes rules for the protection of data integrity.
what is the biba model?
The Biba Model is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity.
In the Biba model, what rule prevents a user from reading from lower levels of classification?
The Biba simple property rule/star axiom is "no read down."
The Brewer and Nash model what is it!
The Brewer and Nash model was constructed to provide information security access controls that can change dynamically. This security model, also known as the Chinese wall model, was designed to provide controls that mitigate conflict of interest in commercial organizations.
what model is based on dynamic changes of user privileges and access based on user activity?
The Brewer-Nash model
Remember this Centralized alarm systems remotely monitor sensors spread around a business facility or campus and trigger on some specified event.
The Caesar cipher is a simple substitution cipher where each letter of a message is changed.
Encrypted viruses use a variety of cryptographic keys in conjunction with encryption and decryption routines to hide their code on the hard drive to escape detection
The Clark-Wilson model enforces separation of duties to further protect the integrity of data. This model employs limited interfaces or programs to control and maintain object integrity.
Which model prevents authorized users from making unauthorized modifications to data, thereby protecting its integrity?
The Clark-Wilson model which uses separation of duties
What protects computers used by the government or in interstate commerce from a variety of abuses
The Computer Fraud and Abuse Act
The DES applies what?
The DES applies a division operation that puts characters through 16 rounds of transposition and substitution functions, with a resulting 64-bit block of ciphertext.
What operates on messages in 64-bit blocks?
The DES cipher operates on messages in 64-bit blocks.
What is used to make modifications to a relational database's schema?
The Data Definition Language (DDL)
What is used to make modifications to a relational database's schema?
The Data Definition Language DDL is used to make modifications to a relational database's schema
What is a subset of SQL containing the commands used to interact with data?
The Data Manipulation Language
Which Backup Method only copies files that have changed since a full backup backup was last performed?
The Differential Backup Method
______only copies files that have changed since a full backup backup was last performed?
The Differential Backup Method
Remember this: Secure RPC (Remote Procedure Call) protects remote procedures with an authentication mechanism.
The Diffie-Hellman authentication mechanism authenticates both the host and the user who is making a request for a service. The authentication mechanism uses Data Encryption Standard (DES) encryption. +.
what prohibits the circumvention of copy protection mechanisms placed in digital media and limits the liability of Internet service providers for the activities of their users?
The Digital Millennium Copyright Act
Digital Millennium Copyright Act of 1998
The Digital Millennium Copyright Act prohibits the circumvention of copy protection mechanisms placed in digital media and limits the liability of Internet service providers for the activities of their users.
explain the basic provisions of the Digital Millennium Copyright Act of 1998?
The Digital Millennium Copyright Act prohibits the circumvention of copy protection mechanisms placed in digital media and limits the liability of Internet service providers for the activities of their users.
Digital Millennium Copyright Act of 1998?
The Digital Millennium Copyright Act prohibits the circumvention of copy protection mechanisms placed in digital media and limits the liability of Internet service providers for the activities of their users.
what is a suite of Internet Engineering Task Force (IETF) specifications for securing certain kinds of information provided by the Domain Name System (DNS) as used on Internet Protocol (IP) networks.
The Domain Name System Security Extensions (DNSSEC)
the best recovery strategy if you have an application which cannot allow downtime without impacting the organization?
The Dual Data Center strategy is employed for applications, which cannot accept any downtime without negatively impacting the organization
What are the basic provisions of the Economic Espionage Act of 1996?
The Economic Espionage Act provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties apply when the individual knows that the information will benefit a foreign government
Economic Espionage Act of 1996.
The Economic Espionage Act provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties apply when the individual knows that the information will benefit a foreign government.
the Economic Espionage Act of 1996?
The Economic Espionage Act provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties apply when the individual knows that the information will benefit a foreign government
What was released in 1991 formalized the prudent man rule, which requires senior executives to take personal responsibility for ensuring the due care that ordinary, prudent individuals would exercise in the same situation?
The Federal Sentencing Guidelines
what provided punishment guidelines to help federal judges interpret computer crime laws.The guidelines formalized the prudent man rule , which requires senior executives to take personal responsibility for ensuring the due care that ordinary, prudent individuals would exercise in the same situation?
The Federal Sentencing Guidelines released in 1991
What primarily run when time and tape space permits, and is used for the system archive or baselined tape sets?
The Full Backup Method
_________is primarily run when time and tape space permits, and is used for the system archive or baselined tape sets
The Full Backup Method
What is an integrity model based on predetermining the set or domain—a list of objects that a subject can access?
The Goguen-Meseguer model
What further develops the federal government information security program?
The Government Information Security Reform
What Act of 2000 amended the Paperwork Reduction Act to implement additional information security policies and procedures?
The Government Information Security Reform Act of 2000
Government Information Security Reform Act of 2000 is what?
The Government Information Security Reform Act of 2000 amended the Paperwork Reduction Act to implement additional information security policies and procedures.
The Simple Integrity Property states that a subject cannot Compartmentalized environments require specific security clearances over compartments or domains instead of objects.read an object of a lower integrity level no read down.
The Graham-Denning model is focused on the secure creation and deletion of both subjects and objects.
what provides more granular approach for interaction between subjects and objects?
The Gramm Denning Model
What is HITECH?
The Health Information Technology for Economic and Clinical Health Act of 2009 HITECH amended HIPAA to include new regulations related to data breach notification and the compliance requirements of covered entity business associates.
What is an ICMP Type 3?
The ICMP destination unreachable message is generated by a router to inform the source host that the destination unicast address is unreachable.
What was developed in response to complaints about the insufficient key length of the DES algorithm operates on 64-bit blocks of plain text/ciphertext?
The International Data Encryption Algorithm IDEA
what is an international agreed-upon standard for describing in testing the security of IT products?
The International common criteria
what provides background security support services for IPSec, including managing security associations?
The Internet Security Association and Key Management Protocol ISAKMP
A directive control is a security tool used to guide the security implementation of an organization.
The National Interagency Fire Center provides daily updates on wildfires occurring in the United States.
List the security features offered by the Network layer of the OSI model
The Network layer (layer 3) offers confidentiality, authentication, and integrity
What is a is a vendor-neutral platform for developing and implementing enterprise architectures. It focuses on effectively managing corporate data through the use of metamodels and service-oriented architecture (SOA)
The Open Group Architecture Framework
Standard includes requirements that merchants promptly report incidents affecting the security of credit card information?
The Payment Card Industry Data Security Standard
what is PCI DSS
The Payment Card Industry Data Security Standard includes requirements that merchants promptly report incidents affecting the security of credit card information.
what is Failure Resistant Disk Systems (FRDSs), Failure Tolerant Disk Systems, and Disaster Tolerant Disk Systems?
The RAID Advisory Board defined three classifications of RAID
Remember : The maximum key size on Rijndael is 256 bits
The Rijndael algorithm is a new generation symmetric block cipher that supports key sizes of 128, 192 and 256 bits, with data handled in 128-bit blocks - however, in excess of AES design criteria, the block sizes can mirror those of the keys.
what is an SOC-2 report?
The SOC 2 report focuses on a business's non-financial reporting controls as they relate to security, availability, processing integrity, confidentiality, and privacy of a system
What was approved for use by the US government in Federal Information Processing Standard FIPS 185, the Escrowed Encryption Standard (EES)?
The Skipjack algorithm
What model is based on defining a set of system states, initial states, and state transitions. Through the use of and limitations to only these predetermined secure states, integrity is maintained and interference is prohibited?
The Sutherland model is based on the idea of defining a set of system states, initial states, and state transitions. Through the use of and limitations to only these predetermined secure states, integrity is maintained and interference is prohibited.
The TCB has which of the following?
The TCB is defined in the Orange Book or Trusted Computer System Evaluation Criteria The TCB does includes the combination of all hardware, firmware and software responsible for enforcing the security policy. As the level of trust increases the level of scrutiny required during evaluation increases as well
What scan sends an ______ packet, simulating a packet from the middle of an already established connection?
The TCP ACKNOWLEDGEMENT PACKET
What can be described as the total protection mechanisms inside the computer, including hardware, firmware and software?
The Trusted Computing Base (TCB) is defined as the total combination of protection mechanisms within a computer system. The TCB includes hardware, software, and firmware. These are part of the TCB because the system is sure that these components will enforce the security policy and not violate it.
What was developed by Bruce Schneier, uses prewhitening and postwhitening?
The Twofish algorithm
What algorithm, developed by Bruce Schneier, uses prewhitening and postwhitening?
The Twofish algorithm, developed by Bruce Schneier, uses prewhitening and postwhitening.
What is the Uniform Computer Information Transactions Act on Software Licensing?
The Uniform Computer Information Transactions Act provides a framework for the enforcement of shrink‐wrap and click‐wrap agreements by federal and state governments.
what enterprise architecture provide six frameworks for providing information security asking what how where who when and why through a frame work matrix?
The Zachman framework
What is the best example of managing the Security Function?
The act of performing a risk assessment to drive the security policy is the clearest and most direct example of management of the security function
The ___________software development methodology prioritizes flexible development that emphasizes responding to change over following a plan.
The agile methodology
What phase of a business impact assessment calculates the ARO for a given risk scenario?
The annualized rate of occurrence (ARO) is a measure of how many times a risk might materialize in a typical year. It is a measure of risk likelihood.
Which of the following statements pertaining to key management is INCORRECT? a. The more a key is used, the shorter its lifetime should be. b. Keys should be backed up or escrowed in case of emergencies. c. When not using the full keyspace, the key should be extremely random. d. A key's lifetime should correspond with the sensitivity of the data it is protecting
The answer is C: When not using the full keyspace, the key should be extremely random. "When not using the full keyspace, the key should be extremely random." The truth is totally the opposite. You should always use the full key sprectrum or else you cannot claim to have randomness if you make use of only a subset of the keys.
What is the MOST important aspect relating to employee termination?
The appropriate company staff are notified about the termination.
What is a spoofing attack
The attacker pretends to be someone or something other than whom or what they are. They can spoof identities, IP addresses, email addresses, and phone numbers. They often replace the valid source and/or destination IP address and node numbers with false ones
Remember System Development Lifecycle (SDLC) is Security Accreditation Obtained during Testing and evaluation control
The basic phases of SDLC are: Project initiation and planning Functional requirements definition System design specifications Development and implementation Documentation and common program controls Testing and evaluation control, (certification and accreditation) Transition to production (implementation)
What process consist of limits set on the memory addresses and resources it can access?
The bounds state or define the area within which a process is confined.
How would you determine the cardinality of a database table?
The cardinality of a database table is the number of records (or rows) in that table.
The opposite of the top-down approach is the bottom-up approach. In a bottom-up approach environment, the IT staff makes security decisions directly without input from senior management. The bottom-up approach is rarely used in organizations and is considered problematic in the IT industry.
The change control process of configuration or change management has several goals or requirements: Implement changes in a monitored and orderly manner. Changes are always controlled. A formalized testing process is included to verify that a change produces expected results. All changes can be reversed also known as backout or rollback plans/procedures.
What is a private cloud?
The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
what hides a message inside of a longer message. For example, every sixth word within a document can be used to spell out a secret message within that document.
The concealment cipher
What is a concealment cipher?
The concealment cipher hides a message inside of a longer message. For example, every sixth word within a document can be used to spell out a secret message within that document.
In the Bell-LaPadula model, the Star-property is also called:
The confinement property
What is a mechanism that allows an entity into an application by bypassing access controls?
The correct answer is trapdoor. Trapdoor also referred to as backdoor or maintenance hook is a mechanism that allows an entity into an application by bypassing access controls.
Which of the following statements pertaining to block ciphers is incorrect? a. Plain text is encrypted with a public key and decrypted with a private key. b. It is more suitable for software than hardware implementations. c. It operates on fixed-size blocks of plaintext. Some Block ciphers can operate internally as a stream d. Some Block ciphers can operate internally as a stream
The correct answer is: A Plain text is encrypted with a public key and decrypted with a private key. Block ciphers do not use public cryptography (private and public keys). Block ciphers is a type of symmetric-key encryption algorithm transforms fixed-size block of plaintext unencrypted text data into a block of ciphertext (encrypted text) data of the same length. They are appropriate for software implementations and can operate internally as a stream.
Which type of Firewall typically operates at the session layer of the OSI model? A. Circuit-Level Gateway Firewall B host-based firewall C. Bastion Host Firewall D. Packet Filtering Firewall
The correct answer is: A. Circuit-Level Gateway Firewall Circuit-Level gateway firewalls operate at the session layer of the OSI model or the TCP layer of the DoD TCP/IP Model. They monitor TCP handshake traffic between hosts to determine whether a request session is legitimate.
Which of the following BEST describes what a SQL Injection is? a. It is an attack used to gain unauthorized access to a database. b. It is a Man-in-the-Middle attack between your SQL Server and Web App Server c. It is an attack involving insecure database encryption d. It is an attack that disconnects the SQL server from its internal network
The correct answer is: A. It is an attack used to gain unauthorized access to a database. it's an attempt to get the web application to pass a rogue SQL query to the database for malicious intent.
Which of the following standard was developed in order to protect against fraud in electronic fund transfers (EFT) by ensuring the packets are coming from its claimed originator and that it has not been altered in transmission?
The correct answer is: A. Message Authentication Code (MAC) protect against fraud in electronic fund transfers (EFT), the Message Authentication Code (MAC), ANSI X9.9, was developed. The MAC is a check value, which is derived from the contents of message itself
What attack would you be seeing if the offset bits in an IP Header overlapped with the value of previously sent packets? A. Teardrop Attack B. LAND Attack C. Null Scan D. XMas Tree Scan
The correct answer is: A. Teardrop Attack The Teardrop attacks involve sending IP Fragments which have overlapping fragment offset numbers so that when the victim's computer tries to reassemble the IP frags into the intended file the target crashes. It doesn't know how to handle the improperly-numbered fragments.
Which of the following is most likely to be useful in detecting intrusions? Access control lists Information security policies Audit trails Security labels
The correct answer is: Audit trails If audit trails have been properly defined and implemented, they will record information that can assist in detecting intrusions.
An incremental backup process a. Backs up the files that been modified since the last full backup. It does not change the archive bit value. b Backs up all the files that have changed since the last full or incremental backup and sets the archive bit to 0. c. Backs up all the data and changes the archive bit to 0. c. Backs up all the data and changes the archive bit to 1
The correct answer is: B Backs up all the files that have changed since the last full or incremental backup and sets the archive bit to 0.
Which of the following terms can be described as the process to conceal data into another file or media in a practice known as security through obscurity? a. NTFS ADS b. Encryption c. Steganography d. ADS - Alternate Data Streams
The correct answer is: C Steganography It is the art and science of encoding hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message or could claim there is a message.
What is the MAC-Based technical security measure used to protect access to the physical network infrastructure?A A. PKI B. 802.1X C. Port Security D. EAP
The correct answer is: C. Port Security Port Security or commonly known as switchport security is a method of controlling access to network media. Notably, a mechanism called VMPS - VLAN Membership Policy Server is a way to prevent unknown MAC Addresses from connecting to your network.
What do you call a user interface that limits the functions that can be selected by a user?
The correct answer is: Constrained user interfaces Constrained user interfaces limit the functions that can be selected by a user. Another method for controlling access is by restricting users to specific functions based on their role in the system.
Which of the following statements pertaining to IPSec is incorrect? a. In transport mode, ESP only encrypts the data payload of each packet. b. ESP provides for integrity, authentication and encryption to IP datagrams. c. Integrity and authentication for IP datagrams are provided by AH. d. A security association has to be defined between two IPSec systems in order for bi-directional communication to be established
The correct answer is: D. A security association has to be defined between two IPSec systems in order for bi-directional communication to be established. This is incorrect, there would be a pair of Security Association (SA) needed for bi directional communication and NOT only one SA. The sender and the receiver would both negotiate an SA for inbound and outbound connections.
Which of the following is a form of Hybrid Cryptography where the sender encrypts the bulk of the data using Symmetric Key cryptography and then communicates securely a copy of the session key to the receiver? A. Asymmetric B. Symmetric key encryption C. Digital Envelope D. Digital Signature
The correct answer is: D. Digital Envelope A Digital Envelope is used to send encrypted information using symmetric keys, and the relevant session key along with it. It is a secure method to send electronic document without compromising the data integrity, authentication and non-repudiation, which were obtained with the use of symmetric keys
What would you call a person that uses his skills for defensive purpose? Phreaker Cracker Ethical Hacker Hacker
The correct answer is: Ethical Hacker The term Ethical Hacker refers to a person who is using his skills for defensive purpose.
Which of the following statements pertaining to quantitative risk analysis is FALSE? A. It requires a high volume of information B. It involves complex calculations C. It requires little experience to apply D. Portion of it can be automated
The correct answer is: It requires little experience to apply Assigning the values for the inputs to a purely quantitative risk assessment requires both a lot of time and significant experience on the part of the assessors. The most experienced employees or representatives from each of the departments would be involved in the process. It is NOT an easy task if you wish to come up with accurate values.
Which of the following alternative business recovery strategies would be LEAST reliable in a large database and on-line communications network environment where the critical business continuity period is 7 days ? Hot site Reciprocal agreement Warm site Redundant or Alternate Site
The correct answer is: Reciprocal Agreement Since Reciprocal Agreement cannot be enforced, a reciprocal agreement is the least reliable solution for business recovery. It is always the worst choice as they cannot be trusted and are unreliable.
The IP header contains a protocol field. If this field contains the value of 6, what type of data is contained within the ip datagram? UDP. IGMP. TCP. ICMP.
The correct answer is: TCP. If the protocol field has a value of 6 then it would indicate it was TCP. The protocol field of the IP packet dictates what protocol the IP packet is using. TCP=6, ICMP=1, UDP=17, IGMP=2
What is called an event or activity that has the potential to cause harm to the information systems or networks? Threat Weakness Vulnerability Threat agent
The correct answer is: Threat: An event or activity that has the potential to cause harm to the information systems or networks.
Secure Shell (SSH-2) provides all the following services except: a. port forwarding b. user authentication c. command execution d. secure remote login
The correct answer is: a. User authentication This is one of the tricky negative question. You have to pay close attention to the word EXCEPT within the question. Authentication in this protocol level is host-based not user based The SSH transport layer is a secure, low level transport protocol. It provides strong encryption, cryptographic host authentication, and integrity protection and it does provide port forwarding
Which are the two primary types of scanner used for protecting against Malware? a. Active and passive Scanner b. Malware mask/signatures and Heuristic Scanner c. None of the above d. Behavioral Blockers and immunizer Scanner
The correct answer is: b. Malware mask/signature and Heuristic Scanner
Which of the following protocols would BEST mitigate threats of sniffing attacks on web application traffic? a. SSH - Secure Shell b. SSL or TLS c. 802.1X d. ARP Cache Securit
The correct answer is: b. SSL or TLS While it traverses the network, without some sort of encryption of web application data is vulnerable to sniffing and interception by attackers on the network. If we observe sniffer traffic on an unencrypted network we can clearly see the contents of user interaction with the web server and its applications
In Operations Security trusted paths provide: a. trustworthy integration into integrity functions. b. trustworthy interfaces into priviledged MTBF functions. c. trustworthy interfaces into priviledged user functions. d. trusted access to unsecure paths.
The correct answer is: c. trustworthy interfaces into priviledged user functions "Trusted paths provide trustworthy interfaces into privledged user functions and are intended to provide a way to ensure that any communications over that path cannot be intercepted or corrupted."
Which of the following is the most important consideration in locating an alternate computing facility during the development of a disaster recovery plan? a. It is convenient to airports and hotels. b. It is close enough to serve its users. c. It is close enough to become operational quickly. d. It is unlikely to be affected by the same disaster
The correct answer is: d It is unlikely to be affected by the same disaster. You do not want the alternate or recovery site located in close proximity to the original site because the same event that create the situation in the first place might very well impact that site also.
A cryptanalyst choose a piece of ciphertext and attempt to obtain the corresponding decrypted plaintext. What is the least effective attack of a public-key cryptosystem? a. Ciphertext-only attack b. Plaintext Only Attack c. Adaptive-Chosen-Plaintext attack d. Chosen-Ciphertext attack
The correct answer is: d. Chosen Ciphertext attack A chosen-ciphertext attack is one in which cryptanalyst may choose a piece of ciphertext and attempt to obtain the corresponding decrypted plaintext.
Under the physical access controls which control category would you use to describe a fire extinguisher?
The correct response is corrective. Under the physical access control type a fire extinguisher would be considered a corrective control. The goal of corrective actions are to remedy circumstances and mitigate damage.
The layer that adds a 'trailer' (containing checksum and padding if needed) to the end of a data frame, is the ___ layer. network transport session data link
The data link layer adds a trailer at the end of the frame
Who is the person who has ultimate organizational responsibility for data. The owner is typically the CEO, president, or a department head. Data owners identify the classification of data and ensure that it is labeled properly?
The data owner
who is is the person responsible for classifying, labeling, and protecting data?
The data owner
the common applications of cryptography to secure web activity
The de facto standard for secure web traffic is the use of HTTP over Transport Layer Security TLS or the older Secure Sockets Layer (SSL). many websites are dropping support for SSL due to security concerns
Which are the set of allowable values that an attribute can take?
The domain of a relation is the set of allowable values that an attribute can take.
What algorithm depends on the elliptic curve discrete logarithm problem and provides more security than other algorithms when both are used with keys of the same length?
The elliptic curve algorithm
What is the amount of damage that the risk poses to the asset?
The exposure factor
what step is the prioritize the allocation of business continuity resources to the various identified risks and assessed in the preceding tasks of the BIA?
The final step of the BIA
Explain the steps of the business impact assessment process.
The five steps of the business impact assessment process are identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization.
What are the four layers of the TCP/IP protocols, and how do they relate to the OSI model layers?
The four layers of TCP/IP are Application layers 5-7 of OSI, Transport layer 4 of OSI, Internet layer 3 of OSI, and Link layers 1 and 2 of OSI.
What is a network device that works at the Application layer. However, an Application layer gateway is a very specific type of component. It serves as a protocol translation tool. For example, an IP-to-IPX gateway takes inbound communications from TCP/IP and translates them over to IPX/SPX for outbound transmission?
The gateway
What is the goal of a business continuity program?
The goal of a business continuity program is to ensure that recovery time objectives are shorter than maximum tolerable downtime measures.
What is the primary goal of a Business Continuity Plan?
The goal of the BCP process is to ensure that your RTOs are less than your MTDs, resulting in a situation in which a function should never be unavailable beyond the maximum tolerable downtime
Remember this: secuirty policy is a formal statement of the rules that people who are given access to an organization's technology and information assets must abide. The policy communicates the security goals to all of the users, the administrators, and the managers.
The goals will be largely determined by the following key tradeoffs: services offered versus security provided, ease of use versus security, and cost of security versus risk of loss.
What action usually closes the identification phase of incident response
The identification phase usually concludes with the notification of the incident response team.
What is an ARP attack
The modification of ARP mappings. When ARP mappings are falsified, packets are not sent to their proper destination. ARP mappings can be attacked through spoofing. Spoofing provides false MAC addresses for requested IP addressed systems to redirect traffic to alternate destinations
Stealth viruses alter operating system file access routines so that when an antivirus package scans the system, it is provided with the information it would see on a clean system rather than with infected versions of data.
The modified waterfall process differs from the standard waterfall process by adding validation and verification phases.
What is the difference from the standard waterfall process by adding validation and verification phases?
The modified waterfall process differs from the standard waterfall process by adding validation and verification phases.
In system high mode, all users have appropriate clearances and access permissions for all information processed by the system but need to know only some of the information processed by that system.
The most commonly overlooked aspect of mobile phone eavesdropping is related to people in the vicinity overhearing conversations (at least one side of them). Organizations frequently consider and address issues of wireless networking, storage device encryption, and screen locks.
What controls access and the use of system resources in preemptive multitasking mode?
The operating system--Operating systems that use preemptive multitasking run the show, and one application does not negatively affect another application as easily.
what would be the most effective method of identifying illegal software packages loaded to the network?
The periodic checking of hard drives would be the most effective method of identifying illegal software packages loaded to the network.
to perform the cost/benefit analysis of a safeguard, you must calculate the following three elements:
The pre-countermeasure ALE for an asset-and-threat pairing The post-countermeasure ALE for an asset-and-threat pairing The Annual Cost of the Safeguard
The primary role of the certificate authority (CA) in the communication process is to:
The primary activity of a CA is to issue certificates. The primary role of the CA is to check the identity of the entity owning a certificate and to confirm the integrity of any certificate it issued.
Protection profiles used in the Common Criteria evaluation process contain five elements. the following establishes the type and intensity of the evaluation?
The protection profile contains the set of security requirements, their meaning and reasoning, and the corresponding evaluation assurance level (EAL) rating that the intended product will require
Remote authentication dial-in user service centralizes authentication for remote connections it is used when organization has more than one network access server.
The radius server is used to verify authentication authorization_track accounting. The radius uses user datagram protocol UDP any encrypts only the exchange of the password --it doesn't encrypt the entire session. It is defined in RFC 2865
_________represents the point in time, prior to such an event or incident, to which lost data can be recovered (given the most recent backup copy of the data
The recovery point objective
______is the maximum acceptable level of data loss following an unplanned "event", like a disaster (natural or man-made), act of crime or terrorism, or any other business or technical disruption that could cause such data loss. The RPO represents the point in time, prior to such an event or incident, to which lost data can be recovered,
The recovery point objective (RPO)
This portion of the BCP documentation essentially recaps the decision-making process undertaken during the business impact assessment is what?
The risk assessment portion
remember this There are two types of cyber squatting. The first type is when a person registers a similar domain name as an official source such as a commonly misspelled version of a trademark. The cyber squatter then redirects traffic to his own domain.
The second type a person registers a domain doesn't use it but refuses to sell it to anyone unless it's for a high price.
What correctly describes the relationship between the reference monitor and the security kernel?
The security kernel implements and enforces the reference monitor. The reference monitor is an access control concept implemented and enforced by the security kernel via the hardware, software, and firmware. The security kernel ensures that subjects have the appropriate authorization to access the objects they are requesting.
Understand the seven Safe Harbor principles what are they?
The seven principles are notice, choice, onward transfer, security, data integrity, access, and enforcement.
What are thethe seven Safe Harbor principles?
The seven principles are notice, choice, onward transfer, security, data integrity, access, and enforcement.
remember this: The TOCTTOU acronym expands to "Time Of Check To Time Of Use". It is a type of File Access Race Condition.
The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check causingf the software to perform invalid actions when the resource is in an unexpected state.
what is really serious criteria in the assignment of a classification label?
The source or origin of a resource.
what is considered a meta-model?
The spiral model. A spiral model uses multiple iterations of the waterfall model.
The DRP plan covers actions to be taken when a disaster occur but DRP PLANNING which is the keywork in the question would also include steps that happen before you use the plan such as development of the plan, training, drills, logistics, and a lot more
The star property (read "star"-property) - a subject at a given security level must not write to any object at a lower security level no write-down. The star property is also known as the Confinement property
What reflects the criticality of the BCP to the organization's continued viability.
The statement of importance--This document is a letter to the organization's employees stating the reason that the organization devoted significant resources to the BCP development process and requesting the cooperation of all personnel in the BCP implementation phase
Which task of BCP bridges the gap between the business impact assessment and the continuity planning phases?
The strategy development task bridges the gap between business impact assessment and continuity planning by analyzing the prioritized list of risks developed during the BIA and determining which risks will be addressed by the BCP.
The security of a computer application is most effective and economical when?
The system is originally designed to provide the necessary security. It is also much more efficient if security is addressed in each phase of the development cycle rather than an add-on because it gets more complicated to add at the end
Who ensures that the system is labeled accurately and that appropriate security controls are in place to protect the data?
The system owner
Who should measure the effectiveness of Information System security related controls in an organization?
The systems auditor -It is the systems auditor leads the effort ensuring security controls in place verify effectively controls comply with polices, procedures, laws, and applicable regulations. The findings would are sent to senior management.
802.15 is what as it applies to wireless technology?
The term personal area network is most closely associated with wireless technology & creates personal area networks PANs such as personal area networks
The return of company property, disabling network access, an exit interview, and an escort from the property.
The termination procedure
with software testing approaches the test plan should what?
The test plan and results should be retained as part of the system's permanent documentation
what is security information and event time management?
The tools provide real-time analysis of events occurring on systems throughout an organization they include agents install the remote systems that monitor for specific events known as alarm triggers
The tranquility principle of the Bell-LaPadula model?
The tranquility principle of the Bell-LaPadula model states that the classification of a subject or object does not change while it is being referenced.
Name the three types of subjects and their roles in a security environment
The user accesses objects on a system to perform a work task; the owner is liable for protection of data; the data custodian is assigned to classify and protect data
What is a virtual directory?
The virtual directory periodically synchronizes itself with all of the identity stores individual network directories to ensure the most up-to-date information is being used by all applications and identity management components within the enterprise.
________states where critical business records will be stored and the procedures for making and storing backup copies of those records.
The vital records program
what allows the development process to return only to the immediately preceding phase of development at any given time.
The waterfall model
There are 34 control objectives or high level processes in what control objective?
There are 34 control objectives in COBIT 4.x
There are three contemporary forms of cryptography. What are they?
There are three contemporary forms of cryptography.
Block ciphers--how are they used as a symmetric-key encryption algorithm?
They transforms a fixed-size block of plaintext unencrypted text data into a block of ciphertext --encrypted text data of the same length. They are appropriate for software implementations and can operate internally as a stream.
CISSP Exam Prep 2016 Maliciously altering the routing data in the routing tables is called Routing Table ___. defacement spoofing hijacking poisoning
This attack results in wrong entries in the routing tables and is known as 'Routing Table Poisoning'
What markup language allows for the sharing of application security policies to ensure that all applications are following the same security rules?
This can happen through eXtensible Access Control Markup Language (XACML). XACML is a markup language and processing model that is implemented in XML. It declares access control policies and describes how to interpret them.
What is Nessus?
This is a network vulnerability scanning tool that searches systems for known vulnerabilities
What firewall has speed and flexibility, as well as capacity to block some denial-of-service and related attacks, makes them ideal for placement at the outermost boundary with an untrusted network?
This is an important point with packet filtering firewalls
When a biometric system rejects an authorized individual, what type of error is this? it is called a Type I error (false rejection rate).
This is called a Type I error false rejection rate.
Which is RAID-1
This is called mirroring. All the data is written to at least two separate disks. If one fails, the other can be used to retrieve data. RAID-1 requires two physical disks
What type of error is a percentage of invalid subjects that are falsely accepted in a biometric system? is called the False Acceptance Rate FAR or Type II Error.
This is called the False Acceptance Rate (FAR) or Type II Error.
Changing the 'index.html' page of a website on a web server without proper authorization, usually to something malicious, is known as web ___. hijacking cloaking defacement vandalism
This is known as the Website defacement att
When possible, operations controls should be invisible, or transparent, to users.
This keeps users from feeling hampered by security and reduces their knowledge of the overall security scheme, thus further restricting the likelihood that users will violate system security deliberately.
RAID Level 0 creates one large disk by using several disks what is this called?
This process is called striping.
Which of these methods does the 'Accent Keyword Extractor' use for attacking passwords? Dictionary Attack None of the above Brute Force Cracking Password guessing
This program loads an Internet page and extracts keywords and uses them as possible passwords
What is NIST in Special Publication 800-37?
This publication provides guidelines for applying the Risk Management framework to federal information systems
_________are accidental or intentional exploitations of vulnerabilities.
Threat events
In a Public Key Infrastructure, how are public keys published
Through digital certificates.
What can best define the "revocation request grace period?"
Time period between the arrival of a revocation request and the publication of the revocation information.
explain total risk?
Total risk is the amount of risk an organization would face if no safeguards were implemented. To calculate total risk, use this formula: threats * vulnerabilities * asset value = total risk.
The National Information Infrastructure Protection Act extends protections to portions of the national infrastructure other than computing systems, such as railroads, gas pipelines, electric power grids, and telecommunications circuits.
Traffic analysis and trend analysis are forms of monitoring that examine the flow of packets rather than the actual content.
What is Traffic Padding?
Traffic padding is a countermeasure to traffic analysis.
A new employee will require what type of awareness of IT Security in the workplace so they will be able to comply with all standards, guidelines, and procedures mandated by the security policy?
Training
What is a characteristic or service that is unseen by users?
Transparency
Which layer is responsible for data transmission and error detection in the OSI model?
Transport layer
In IP Sec, what is themost common mode of operation and is required for gateway-to-gateway and host-to-gateway communications?
Transport mode is established when the enpoint is a host. If the gateway in a gateway-to-host communication was to use transport mode, it would act as a host system, which is acceptable for direct protocols to that gateway. Otherwise, TUNNEL mode is required for gateway services...
________________is generated by the difference in power between the hot and neutral wires of a power source or operating electrical equipment
Traverse mode noise
is generated by the difference in power between the hot and neutral wires of a power source or operating electrical equipment?
Traverse mode noise
A _ is software that functions partially as a proprietary software that can be used without payment.
Trialware
_________uses 56-bit keys but newer implementations use 112-bit or 168-bit keys. Larger keys provide a higher level of security.?
Triple DES
What encrypts a message three times.
Triple DES This encryption can be accomplished in several ways. The most secure form of triple DES is when the three encryptions are performed with three different keys.
A polyalphabetic cipher is any cipher based on substitution, using multiple substitution alphabets. The Vigenère cipher is probably the best-known example of a polyalphabetic cipher, though it is a simplified special case.
Triple DES with three distinct keys is the most secure form of triple-DES encryption. It can either be DES-EEE3 encrypt-encrypt-encrypt or DES-EDE3 encrypt-decrypt-encrypt.
tools can notify you of the possibility of something suspicious in your computer? None of these tcpdump Wireshark Tripwire
Tripwire directly reveals information about something suspicious occurring. While useful for detecting intrusions after the event, it can also serve many other purposes, such as integrity assurance, change management, and policy compliance.
What is a code that appears to have some useful purpose but also contains code that has a malicious or harmful purpose imbedded in it?
Trogan
What is the theft refers to a situation where someone obtains key pieces of personal information such as a credentials, or Social Security number, and then uses that information to impersonate someone else?
True name identity theft
What is trusted recovery?
Trust to recovery provide for services after failure or crash the system is just as secure as it was before the failure or crash occurred
What is tunneling?
Tunneling is the encapsulation of the protocol deliverable message within a second protocol. The second protocol often performs encryption to protect the message contents.
What are most appropriate on secondary or side exits where a security guard is not available or is unable to maintain constant surveillance?
Turnstiles
cable technology refers to the CAT3 and CAT5 categories?
Twisted Pair cables
to achieve added security over DES 3DES must use how many keys?
Two
The Graham-Denning model is focused on the secure creation and deletion of both subjects and objects.
Ultimately, Graham-Denning is a collection of eight primary protection rules or actions (listed in the question) that define the boundaries of certain secure actions.
RFC 1918 describes the range of unroutable addresses; regarding unroutable addresses.
Unroutable addresses can access the internet using PAT. Unroutable addresses can access the internet using NAT.
What is a disadvantage to SSO?
User gains unrestricted access to all the authorized resources
This is basic mode used by the CPU when executing user applications. In this mode, the CPU allows the execution of only a portion of its full instruction set. This is designed to protect users from accidentally damaging the system through the execution of poorly designed code or the unintentional misuse of that code.
User mode
What is is the basic mode used by users?
User mode is the basic mode used by the CPU when executing user applications. The CPU allows the execution of only a portion of its full instruction set. This is designed to protect users from accidentally damaging the system through the execution of poorly designed code or the unintentional misuse of that code.
The change control process of confi guration or change management also
Users are informed of changes before they occur to prevent loss of productivity The effects of changes are systematically analyzed The negative impact of changes on capabilities, functionality, and performance is minimized and approved by a CAB (change approval board).
In the public key infrastructure, certificate authorities (CAs) generate digital certificates containing the public keys of system users.
Users then distribute these certificates to people with whom they want to communicate. Certificate recipients verify a certificate using the CA's public key
Symmetric key uses how many keys?
Uses the same key for communication in any direction
What refers to those that can be performed manually but only for a brief period of time; this is associated with lower costs of disruption than critical functions?
Vital function
What introduces network-specific vulnerabilities to voice communications?
Voice over IP (VoIP)
what is is computer memory that requires power to maintain the stored information; it retains its contents while powered on but when the power is interrupted the stored data is lost very rapidly or immediately?
Volatile memory, contrary to non-volatile memory, is computer memory that requires power to maintain the stored information; it retains its contents while powered on but when the power is interrupted the stored data is lost very rapidly or immediately. RAM is an example.
______________replaces TKIP (used by the original WPA) with AES cryptography
WPA2
What servers would you typically find in the DMZ?
Web server E-mail server Hyper-V server
What means that it is happening in both directions instead of just the user having to authenticate to the server the server also has to authenticate to the user?
What is Mutual authentication
What is a Polymorphic Code?
What is a virus code that can change or mutate itself so that the originalis not detected by the antivirus scanner BUT the virus can still carry out it's malicious activity?
What is NIST SP 800-18?
What outlines the following responsibilities for the information owner, which can be interpreted the same as the data owner &rules of behavior," which is effectively the same as an acceptable usage policy (AUP)
When will Training occur?
When a new employee arrives so they will be able to comply with all standards, guidelines, and procedures mandated by the security policy?
a router for evidence, which of the following actions should NOT be performed? Running show commands All of these Running configuration commands Accessing router through console
When an attack occurs, 'configuration' commands should not be executed in order not to change anything
what is a Multilevel security mode system?
When there is no requirement that all users have appropriate clearances to access information processed on a system?
What are the problems with password generators?
While password generators protect against dictionary attacks they often force users to write down the password which creates a new vulnerability having an office full of sticky notes with scribbled passwords is an attractive atmosphere for a potential hacker
Purchasing a single certificate for each of your domains and subdomains can be an expensive proposal but you can purchase a type of certificate called?
Wildcard Certificate.
What is Dynamic translation?
With dynamic translation also called Automatic, Hide Mode, or IP Masquerade, a large group of internal clients to share a single or small group of ROUTABLE IP addresses for the purpose of hiding their identities when communicating with external hosts or expanding the internal network address
In this Block Cipher method of encoding, the user simply encodes the message by reordering the plaintext in some way or the user scrambles the message by reordering the plaintext. What is this method called?
With the transposition method of block cipher, the user simply encodes the message by reordering the plaintext in some way are shifted according to a regular system, so that the ciphertext constitutes a permutation of the plaintext. That is, the order of the units is changed
Job descriptions are essential to user and personnel security. job description does a background check have true meaning.
Without a job description, auditing and monitoring cannot determine when a user performs tasks outside of their assigned work. Without a job description, administrators do not know what level of access to assign via DAC.
Remember: Current copyright law provides for a very lengthy period of protection. Works by one or more authors are protected until 70 years after the death of the last surviving author.
Works for hire and anonymous works under copyright law are provided protection for 95 years from the date of first publication or 120 years from the date of creation, whichever is shorter
What is X.500
X. 500 standard, and a type of protocol, as in Lightweight Directory Access Protocol (LDAP), that allows subjects and applications to interact with the directory.
______is an ITU-T standard protocol suite for packet switched wide area network WAN communication?
X.25 X.25 is a packet switching technology which uses carrier switch to provide connectivity for many different networks.
What is a series of computer networking standards covering electronic directory services?
X.500
What is a standard and a type of protocol, as in Lightweight Directory Access Protocol (LDAP), that allows subjects and applications to interact with the directory.
X.500
What is the The Zachman Architecture Framework ?
Zachman Framework is used to create a robust enterprise architecture, not a security architecture, technical or not. The framework is not security specific.
What confirms that an individual possesses certain factual knowledge without revealing the knowledge?
Zero-knowledge
What is the concept of zero-knowledge proof?
Zero-knowledge proof is a communication concept. A specific type of information is exchanged but no real data is transferred, as with digital signatures and digital certifi cates.
what is 802.1x?
a MAC-Based security measure. 802.1X or "dot1x" is certificate-based and each device that wants to talk on the network must have a valid certificate.
RAID 1+0 or RAID 10
a combination of disk mirroring & stripping -no parity-requires a minimum of four disks
Solid State Drive
a combination of flash memory EEPROM and DRAM
What is a likelihood Assessment?
a comprehensive list of the events that can be a threat to an organization.
What is electronic vaulting?
a method of transferring bulk information to off-site facilities for backup purposes
What is Message Switching?
a mode of data transmission in which a message is sent as a complete unit and routed though intermediate nodes at which it is stored and then forwarded.
What is the main concern with Single Sign On?
a password can be compromised and a password would allow an intruder to have access to all systems.
Smart cards are:
a plastic card with a built-in microprocessor, used typically for electronic processes such as financial transactions and personal identification.
What is Concurrency?
a preventive security mechanism that endeavors to make certain that the information stored in the database is always correct or at least has its integrity and availability protected.
what is a column or a combination of columns that uniquely identify a record?
a primary key
What is an electronic document which incorporates a digital signature to bind together a _____________— information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual.
a public key certificate or identity certificate
What is a Service organization control SOC report?
a report that verify\ies the security, privacy, and availability controls, through the SOC-2 or SOC-3 report
The Simple Security Property states that
a subject may not read information at a higher sensitivity level no read up.
What is Data Manipulation Language DML?
a subset of SQL containing the commands used to interact with data
What is Screen scraping
a technology that can allow an automated tool to interact with a human interface
What is a Multipartite Virus?
a virus spreads by multiple methods
___________is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions
abstraction
what is an abstraction?
abstraction hides the unnecessary details from user abstraction provides a way to manage complexity.
What is a threat event
accidental or intentional exploitations of vulnerabilities.
The sequence of steps of an attack methodology is?
acquisition analysis access appropriation
What methodology prioritizes flexible development that emphasizes responding to change over following a plan?
agile software development methology
What is Automatic Call distribution?
allows a PBX to be configured so that incoming calls are distributed to the next available agent or placed on-hold until one become available
What is an EEPROM chip
allows for "flash" updates when the BIOS needs revision.
What is a lattice based access control?
allows security controls for complexed environments. It is a complex access control model based on the interaction between any combination of objects and subjects
What is the The waterfall model?
allows the development process to return only to the immediately preceding phase of development at any given time.
What is a pseudorandom number generator?
also known as a deterministic random bit generator DRBG algorithm generating a sequence of numbers whose properties approximate the properties of sequences of random numbers. PRNG-generated sequence is not truly random, because it is completely determined by a relatively small set of initial values, called the PRNG's
remember this when intruder is detected by an IDS they are transferred to a padded cell. The transfer of the intruder into a padded cell is performed automatically without informing the intruder that the change has occurred.
also note padded acells are used to detain intruders not to detect vulnerabilities
What is Point to Point protocol?
an encapsulation protocol designed to support IP traffic over dial up connections?
what is a threat agent?
an entity that can exploit a vulnerability
What is a behavior-based intrusion detection system?
an expert system or a pseudo-artificial intelligence system because it can learn and make assumptions about events. In other words, the IDS can act like a human expert by evaluating current events against known events?
To fully evaluate risks and subsequently take the proper precautions, you must?
analyze the following: assets, asset valuation, threats, vulnerability, exposure, risk, realized risk, safeguards, countermeasures, attacks, and breaches
What is is an element of quantitative risk analysis that represents the expected frequency with which a specific threat or risk will occur in other words, become realized within a single year?
annualized rate of occurrence or ARO
packet filtering gateways are appropriate for:
appropriate choice for a low-risk environment
the steps of the business impact assessment process are
are identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization
Remember: The pair of elements is the subject and object, and the subject has an upper bound equal or higher than the upper bound of the object being accessed.
are the keystones of most access control systems.
who are Data processors?
are typically third-party entities that process data for an organization
What are Data processors
are typically third-party entities that process data for an organization
What is a backdoor?
are vectors for attackers to bypass security checks, such as authentication--Be wary when someone says something will make computing both easier and more secure.
Who are the necessary members of the business continuity planning team?
at a minimum, representatives from each of the operational and support departments; Deparpment IT technical experts security personnel with BCP skills, legal representatives familiar with corporate legal, regulatory, and contractual responsibilities; and representatives from senior management.
What are distributed reflective denial of service attacks?
attack efforts between cooperative machines using traffic in an entirely legitimate manner
attribute base access control what is it?
attribute based access control model these policies that include multiple attributes for rules many software defined networking applications use attribute based access control.
IPsec includes an Authentication Header (AH) which provides what?
authentication and integrity
What is AAA
authentication, authorization, and accountability - provides nonrepudiation
What is called the access protection system that limits connections by calling back the number of a previously authorized location? a. Sendback systems b. Callback systems c. Sendback forward systems d. Callback forward systems
b. Callback systems Details: The correct answer is: Call back Systems; Callback systems provide access protection by calling back the number of a previously authorized location, but this control can be compromised by call forwarding.
When continuous availability (24 hrs-a-day processing) is required what provides a good alternative to tape backups?
back up to jukebox
Children's Online Privacy Protection Act of 1998
became the law of the land in the United States. COPPA makes a series of demands on websites that cater to children or knowingly collect information from children
Why is a complete quantitative analysis is not possible?
because of intangible aspects of risk. The process involves asset valuation and threat identification and then determining a threat's potential frequency and the resulting damage; the result is a cost/ benefit analysis of safeguards
Why is difficult to defend against distributed denial service attacks?
because of their sophistication and complexity
What labeled an expert system or a pseudo-artificial intelligence system because it can learn and make assumptions about events. In other words, the IDS can act like a human expert by evaluating current events against known events?
behavior-based intrusion detection system
What is a Sensitive function?
best described as those that can be performed manually at a tolerable cost for an extended period of time
what is is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity?
biba model
When developing a business continuity plan, be sure to account for ________________
both your headquarters location as well as any branch offices. The plan should account for a disaster that occurs at any location where your organization conducts its business.
What are the steps project scope and planning, business impact assessment, continuity planning, and approval and implementation used for?
business continuity planning
What is project scope and planning, business impact assessment, continuity planning, and approval and implementation. Each task contributes to the overall goal of ensuring that business operations continue uninterrupted in the face of an emergency situation.
business continuity planning
Who are the operational and support departments; technical experts from the IT department; security personnel with BCP skills; legal representatives familiar with corporate legal, regulatory, and contractual responsibilities; and representatives from senior management.
business continuity planning team
operational and support department representatives; Deparpment IT technical experts security personnel, legal representatives familiar with corporate legal, regulatory, and contractual responsibilities;and representatives from senior management are what kind of team
business continuity planning team
What are identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization?
business impact assessment
__________assesses the likelihood that each threat will actually occur and the consequences those occurrences will have on the business
business impact assessment
who are the individuals responsible leading the BCP process determine which departments and individuals have a stake in the business continuity plan used as the foundation for BCP team selection and, after validation by the BCP team, is used as a guide the next stages of BCP development.
business organization analysis
How is metadata is created?
by performing data mining.
What is the difference between the OCSP (Online Certificate Status Protocol) and a Certificate Revocation List (CRL)? a. The OCSP (Online Certificate Status Protocol) is used only by Active Directory and a Certificate Revocation List (CRL) is used by Certificate Authorites b. The OCSP (Online Certificate Status Protocol) is a way to check the attributes of a certificate and a Certificate Revocation List (CRL) is used by Certificate Authorites. c. The OCSP (Online Certificate Status Protocol) provides real-time certificate checks and a Certificate Revocation List (CRL) has a delay in the updates. d. The OCSP (Online Certificate Status Protocol) is a propietary certifcate mechanism developed by Microsoft and a Certificate Revocation List (CRL) is an open standard
c. The correct answer is: The OCSP (Online Certificate Status Protocol) provides real-time certificate checks and a Certificate Revocation List (CRL) has a delay in the updates.
What is a Candidate Key?
can be any column or a combination of columns that can qualify as unique key in database
how are threats evaluated?
can originate from numerous sources, including IT, humans, and nature.Threat assessment should be performed as a team effort to provide the widest range of perspectives. By fully evaluating risks from all angles, you reduce your system's vulnerability.
What specifies the access rights a certain subject possesses pertaining to specific objects?
capability table
What is Asynchronous Transfer Mode-ATM which is WAN communication technology at 53 bytes?
cell switching technology
Remember: for type of authentication: Type 1 - Something you know - Authentication by knowledge - password, pin Type 2 - Something you have - Authentication by possession - token, smart card, magnetic card Type 3 - Something you are - Authentication by characteristic - biometics
check for Input or Information Accuracy in Software Development security are the following Range checks Relationship checks Reasonableness checks Transaction limits check
The expanded use of _________by many organizations requires added attention to conducting reviews of information security controls during the vendor selection process and as part of ongoing vendor governance.
cloud services
What is an abstraction?
collects similar elements into groups, classes, or roles that are assigned to security controls, restrictions, or permissions as a collective, It adds efficiency to carry out a security plan
What is a Hybrid environment?
combines both hierarchical and compartmentalized environments so that security levels have subcompartments
What is a Hybrid environments
combines both hierarchical and compartmentalized environments so that security levels have subcompartments.
how do you prevent in access aggregation attack?
combining defense in depth, need to know in Least privilege principles helps prevent access aggregation attacks.
What is no relationship between one security domain and another. each domain represents a separate isolated compartment to gain access to an object?
compartmentalized enviornment
To be secure, the kernel must meet three basic conditions:
completeness all accesses to information must go through the kernel, isolation the kernel itself must be protected from any type of unauthorized access, and verifiability the kernel must be proven to meet design specifications.
what is the primary communication channel on a computer system the communication between the CPU, memory, and input output devices such as the keyboard mouse display
computer bus
What is Multitasking?
concept of performing concurrent actions over a certain period of time by executing them concurrently
What is a model that encompasses three concepts assets, risk, and vulnerability and their interdependent relationship within a structured, formalized organization?
conceptual security triple
What is the Bell La Padula model
concerned with confidentiality and access control is based on classification of objects and clearance of subjects
What is pivotal when vendor selection process and as part of ongoing vendor governance with cloud services?
conducting reviews of information security controls
Encapsulating Security Payload (ESP) in IPSEC to provides?
confidentiality
The first activity in every recovery plan?
damage assessment, immediately followed by damage mitigation.
Assembly Language is a low level language using symbols to represent complicated binary codes and is considered one step above machine language Assembly, machine and High level are the main categories of languages.
data backup plan is completely different from disaster recovery and they are not synonymous. In order to get the best Data backup and DR state of the art recovery systems should be attached to data backup systems.
What is one of the primary methods of protecting the data confidentiality?
data encryption
Who is responsible for classifying, labeling, and protecting data
data owner
What is a data object or a packet in the Network layer?
datagram
How do you mitigate an access aggregation attack?
defense in depth, need to know, and least privilege principle.
What is Key clustering?
defined as an instance of two different keys generating the same ciphertext from the same plaintext
RFC 2828 is what?
defines a digital signature as a value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity.
What is ISO 27799? defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that standard.
defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that standard.
what table represents the number of columns in a table?
degree
What is a Capacitance sensor?
detect an intruder approaching or touching a metal object including a wire by sensing a change in capacitance between the object (or wire) and the ground (another wire). A change in the dielectric medium or electrical charge results in a change in capacitance.
What is a data loss prevention (DLP) server?
detects the labels, and applies the required protection that will automatically set the labels, In other words, Users apply relevant labels (such as confi dential, private, sensitive, and public) to emails before sending them
What is the formula for safeguard evaluation?
determining the annual cost of a safeguard, you must calculate the ALE for the asset if the safeguard is implemented. Use the formula: ALE before safeguard - ALE after implementing the safeguard - annual cost of safeguard = value of the safeguard to the company, or (ALE1 - ALE2) - ACS
What is Dual-Core Datacenter ?
differs from traditional multi-site datacenter architecture based primarily on the concept that it is possible to shift active-running workload from one site to another with no interruption in services. While providing the ability to shift active running workload from one site to another
What Originated by VISA and MasterCard as an Internet credit card protocol using what?
digital signatures
What is the result of Allowing objects to be used sequentially by multiple users without a refresh of the objects can lead to?
disclosure of residual data
An attack efforts between cooperative machines using traffic in an entirely legitimate manner are what?
distributed reflective denial of service attacks
Network administrator not taking mandatory two week vacation violates:
due diligence (not doing the right thing the right way)
Why is It very difficult to defend against distributed denial-of-service attacks?
due to their sophistication and complexity.
who are the necessary members of the business continuity planning team?
each of the operational and support departments; technical experts from the IT department; security personnel with BCP skills; legal representatives familiar with corporate legal, regulatory, and contractual responsibilities; and representatives from senior management.
What is defined as "a method of transferring bulk information to off-site facilities for backup purposes?
electronic vaulting
What is Password Policy?
ensure that users create strong passwords of sufficient length and complexity that can track password history and prevent users from reusing passwords?
What is the main purpose of off-site hardware testing to ensure the continued compatibility of the contingency facilities?
ensure the continued compatibility of the contingency facilities
Most threats to a company allude toward
errors & omissions
How can a Continuity of Operations plan be described?
establishes senior management and a headquarters after a plan, outlining roles and authorities, orders of succession, and individual role tasks
what is an element of quantitative risk analysis that represents the percentage of loss that an organization would experience if a specific asset were violated by a realized risk?
exposure factor
From a quantitative point of view, what are three specific metrics when looking Impact Assessments?
exposure factor, the single loss expectancy, and the annualized loss expectancy
What are examples of side channel attacks?
fault generation, differential power analysis, electromagnetic analysis, timing, and software attacks
When possible, operations controls should be invisible, or transparent, to users. This keeps users from
feeling hampered by security and reduces their knowledge of the overall security scheme, thus further restricting the likelihood that users will violate system security deliberately.
what is a screened host?
firewall that communicates directly with a perimeter router and internal network
Static RAM chips are built using a number of ___________that retain their charge without requiring constant refreshing.
flip-flop transistors
What is performed the archive bit will be cleared indicating that the files were backup. This allows backup programs to do an incremental or differential backup that only backs up the changes to the filesystem since the last time the bit was cleared?
full backup
What is The Government Information Security Reform?
further develops the federal government information security program
The Government Information Security Reform Act does what?
further develops the federal government information security program
By going through a Business Impact Analysis, the organization will:
gain a common understanding of functions that are critical to its survival.
What is network device or service works at the Application layer knwoing theApplication layer gateway is a very specific type of component. It serves as a protocol translation tool?
gateway
Whjat is an asynchronous token?
generates and displays one-time passwords using a challenge-response process to generate the password
What is RAID 4
good for sequential data but not uses much
What is the role of the administrator?
grants access to data based on guidelines provided by the data owners
a Quantitative risk analysis focuses on?
hard values and percentages
What is a Polymorphic viruses?
has the capability of changing its own code, enabling it to have many different variants, making it harder to detect by anti-virus software
What is dual Control?
has to do with forcing the collusion of at least two or more persons to combine their split knowledge to gain access to an asset
Quantitatively measuring the results of the test of a BCP results in what?
have ways to measure the success of the plan and tests against the stated objectives. results must be quantitatively gauged as opposed to an evaluation based only on observation. Quantitatively measuring the results of the test involves a generic statement measuring all the activities performed during BCP, which gives the best assurance of an effective plan.
The ISC2 Code of Ethics does not include which of the following behaviors for a CISSP: Ethical behavior Legality Control Honesty
he correct answer is: Control. Control is not a behavior characteristic described in the Code of Ethics.
What are the Control Objectives for Information and Related Technology COBIT?
help business owners and mission owners balance security control requirements with business or mission needs
What is a classification labels are assigned in an ordered structure from low security to medium security to high security?
hierarchical environment
What type of attack a malicious user is positioned between a client and server and then interrupts the session and takes it over?
hijack attack
what is a hypervisor mode?
hypervisor mode allows virtual guests to operate in ring zero
steps of the business impact assessment process are
identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization
One of the primary responsibilities of the individuals responsible for business continuity planning is to perform an analysis of the business organization?
identify all departments and individuals who have a stake in the BCP process
What is the The first BIA task facing the BCP team is identifying business priorities?
identifying business priorities
What is the first BIA task facing the BCP team is identifying business priorities?
identifying business priorities
Threat modeling is the process of
identifying, understanding, and categorizing potential threats. The goal is to build a list of the threats, perform analysis, and determine mitigation strategies.
What is a replay when dealing with Kerberos?
if the compromised tickets are used within an allotted time window
What is critical portions of the business impact assessment?
impact assessment
When are Loss expectancies calculated?
impact assessment phase?
The business continuity plan must also contain statements of
importance, priorities, organizational responsibility, and urgency and timing.
what is an open system?
in open system uses open hardware and standards which use components from a variety of vendors.
____________are Technical physical security controls?
include access controls; intrusion detection; alarms; closed-circuit television; monitoring; heating, ventilating, and air conditioning (HVAC); power supplies; and fire detection and suppression.
There are a number of important concepts that underlie solid business continuity planning (BCP) practices, including the following:
including project scope and planning, business impact assessment, continuity planning, and approval and implementation
What is a Master boot record MBR viruses?
infects the system's boot sector and load when the system is started.
_________is generally considered to be more secure to eavesdropping than multidirectional radio transmissions because infrared requires direct line-of-sight paths?
infrared technology
what is an infrastructure as a service?
infrastructure as a service provides an entire virtualize operating system which the customer configures the operating system on up
which are the steps usually followed in the development of documents such as security policy, standards and procedures?
initiation, evaluation, development, approval, publication, implementation, and maintenance
The three requirements of patent law are
invention must be new, useful, and nonobvious.
What is a CSMA/CD?
is LAN media access method. Carrier Sense Multiple Access / Collision Detection, a set of rules determining how network devices respond when two devices attempt to use a data channel simultaneously. Standard Ethernet networks use CSMA/CD to physically monitor traffic on the line at participating stations.
What is an SNMP and what protocol does it use?
is a UDP-based service. UDP can not send back errors, because it is a simplex protocol. When UDP errors occur, the system will switch protocols and use ICMP to send back information over the network. The port is not available, an ICMP Type 3 error will be sent.
What is a substitution cipher?
is a category the Caesar cipher belongs to. Substitution cipher are vulnerable to frequency analysis attacks
What is Sanitization?
is a combination of processes that removes data from a system or from media. It ensures that data cannot be recovered by any means
What us Hierarchical storage management (HSM)?
is a data storage technique, which automatically moves data between high-cost and low-cost storage media. HSM systems exist because high-speed storage devices, such as hard disk drive arrays, are more expensive (per byte stored) than slower devices, such as optical discs and magnetic tape
what is a smurf attack?
is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP Broadcast address.
What is Static Random Access Memory- SRAM
is a fast expensive memory that uses small latches called "flip flops" to store bits
What is an Encrypted authentication
is a firewall feature that allows users on an external network to authenticate themselves to prove that they are authorized to access resources on the internal network
What is a SYN Flood Attack?
is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic?
What is A VLAN?
is a hardware-imposed network segmentation created by switches that requires a routing function to support communication between different segments.
WHat is SHA-1?
is a hashing algorithm producing a 160-bit hash result from any data. and does not perform encryption.
What Agile software development?
is a phrase used in software development to describe methodologies for incremental software development--emphasis is placed on empowering people to collaborate and make team decisions in addition to continuous planning, continuous testing and continuous integration
What is a A federated identity?
is a portable identity, and its associated entitlements used across business boundaries. It allows a user to be authenticated across multiple IT systems and enterprises.
What is Clearing, or overwriting?
is a process of preparing media for reuse and assuring that the cleared data cannot be recovered using traditional recovery tools
IPsec runs on what layer in the OSI Model? .
is a protocol suite that runs at the networking layer It provides confidentiality, integrity protection, data origin authentication and replay protection of each message by encrypting and signing every message
What is Multi programming?
is a rudimentary form of parallel processing in which several programs are run at the same time on a uniprocessor
What is Control Objectives for Information and Related Technology
is a security concept infrastructure used to organize the complex security solutions
What is Data Manipulation Language ?
is a subset of SQL containing the commands used to interact with data
What is RC5
is a symmetric encryption algorithm. It is a block cipher of variable block length, encrypts through integer addition, the application of a bitwise Exclusive OR XOR, and variable rotations
What is L2F, or Layer 2 Forwarding,
is a tunneling protocol developed by Cisco Systems, Inc. to establish virtual private network connections over the Internet no encryption or confidentiality by itself; It relies on tunneled protocol providing privacy. L2F wasreplaced by L2TP
What is identity-based access control? is a type of Discretionary Access Control (DAC) that is based on an individual's identity?
is a type of Discretionary Access Control that is based on an individual's identity.
What is a primary key ?
is a unique identifier in the table that unambiguously points to an individual tuple or record in the table
What is X.25?
is an ITU-T standard protocol suite for packet switched wide area network WAN communication
what is a pseudorandom number generator?
is an algorithm for generating a sequence of numbers whose properties approximate the properties of sequences of random numbers. The PRNG-generated sequence is not truly random, because it is completely determined by a relatively small set of initial values, called the PRNG's seed which may include truly random values.
TCP Wrapper?
is an application that can serve as a basic firewall by restricting access based on user IDs or system IDs.
What is an annualized rate of occurrence (ARO)?
is an element of quantitative risk analysis that represents the expected frequency with which a specific threat or risk will occur in other words, become realized within a single year.
exposure factor or E F is what?
is an element of quantitative risk analysis that represents the percentage of loss that an organization would experience if a specifi c asset were violated by a realized risk.
What is the concept of an exposure factor (EF).
is an element of quantitative risk analysis that represents the percentage of loss that an organization would experience if a specific asset were violated by a realized risk. By calculating exposure factors, you are able to implement a sound risk management policy.
What is El Gamal
is an extension of the Diffie-Hellman key exchange algorithm that depends on modular arithmetic
What is The International common criteria?
is an international agreed-upon standard for describing in testing the security of IT products
What is ISO 1227?
is an international standard for software lifecycle processes. It defines all the tasks required for developing and maintaining software. Establishes a process of lifecycle for software, including processes and activities applied during the acquisition and configuration of the services of the system.
What is a query plan or query execution plan is an ordered set of steps used to access data in a SQL relational database management system?
is an ordered set of steps used to access data in a SQL relational database management system. This is a specific case of the relational model concept of access plans.
What is the Blowfish block cipher?
is another alternative to DES and IDEA. that operates on 64-bit blocks of text by allowing the use of variable-length keys ranging from a relatively insecure 32 bits to an extremely strong 448 bits for public use with no license required.
What is the qualitative risk analysis?
is based more on scenarios than calculations. Exact dollar fi gures are not assigned to possible losses; instead, threats are ranked on a scale to evaluate their risks, costs, and effects. Such an analysis assists those responsible in creating proper risk management policies
What is a message digest
is calculated and included in a digital signature to prove that the message has not been altered since the time it was created by the sender
One of the first steps in asset security is_____________
is classifying and labeling assets
when is a watchdog timer?
is designed to recovery system by rebooting after critical processes hang or crash
What is a closed system?
is designed to work well with a narrow range of other systems, generally all from the same manufacturer.
What is Purging?
is erasing the data so the media is not vulnerable to data remnant recovery attacks, including those classified as laboratory level
What is Traverse mode noise?
is generated by the difference in power between the hot and neutral wires of a power source or operating electrical equipment?
What is An application-level proxy?
is one that knows the details about a specific application, like HTTP, which allows a connection to a web site from a web browser.
What does a A trusted system address?
is one that meets its intended security requirements. It involves sufficiency and effectiveness, not necessarily efficiency, in enforcing a security policy. Put succinctly, trusted systems have (1) policy, (2) mechanism, and (3) assurance.
What is the full backup method?
is primarily run when time and tape space permits, and is used for the system archive or baselined tape sets.
What is the security kernel
is responsible for enforcing a security policy. It is a strict implementation of a reference monitor mechanism.
Multicast
is similar to broadcasting, except that multicasting means sending to a specific group, whereas broadcasting implies sending to everybody, whether they want the traffic or not.
What is the Delphi technique?
is simply an anonymous feedback-and-response process used to arrive at a consensus. Such a consensus gives the responsible parties the opportunity to properly evaluate risks and implement solutions
What is a synchronous token?
is synchronized with an authentication server and generates synchronous one-time passwords.
What is the main drawback of RAID 1? and for that matter RAID 10?
is that for the required disk space, the RAID overhead will double the amount of capacity you actually have to purchase. For example, if you needed to store 300GB of data you would have to purchase 600GB of capacity.
the common applications of cryptography to secure email
is the S/MIME protocol. Another popular email security tool is Phil Zimmerman's Pretty Good Privacy (PGP).
Multithreading
is the ability of a program or an operating system process to manage its use by more than one user at a time and to even manage multiple requests by the same user without having to have multiple copies of the programming running in the computer.
What is an Exposure Factor?
is the amount of damage that the risk poses to the asset, expressed as a percentage of the asset's value?
what is encryption?
is the art and science of hiding the meaning or intent of a communication from unintended recipients.
What is the The difference between total risk and residual risk and how is it calculated?
is the controls gap, which is the amount of risk that is reduced by implementing safeguards. To calculate residual risk, use the following formula: total risk - controls gap = residual risk
What is Actual Cash Value (ACV)?
is the default valuation clause property insurance. It is also known as depreciated value. It involves estimating the amount to be subtracted, which reflects the building s age, wear, and tear
WHat is federated identity in information technology?
is the means of linking a person's electronic identity and attributes, stored across multiple distinct identity management systems.
What is due care?
is the notion of preserving and protecting assets and interests for a given organization as exercised through a formalized security structure comprising baselines, guidelines, policies, procedures, and rules
The data owner
is the person who has ultimate organizational responsibility for data. The owner is typically the CEO, president, or a department head. Data owners identify the classification of data and ensure that it is labeled properly
what is a computer bus?
is the primary communication channel on a computer system the communication between the CPU, memory, and input output devices such as the keyboard mouse display etc occur via the bus
What is A cross certification?
is the process undertaken by CAs to establish a trust relationship in which they rely upon each other's digital certificates and public keys as if they had issued them themselves.
WHat is the goal of BCP planners?
is to implement a combination of policies, procedures, and processes such that a potentially disruptive event has as little impact on the business as possible
What is The final step of the Business Impact Analysis?
is to prioritize the allocation of business continuity resources to the various risks that you identified and assessed in the preceding tasks of the BIA.
What is a Foreign Key?
is used to enforce relationships between two tables, also known as referential integrity . Referential integrity ensures that if one table contains a foreign key, it corresponds to a still-existing primary key in the other table in the relationship.
What is The spiral model?
it allows developers to repeat iterations of another life cycle model such as the waterfall model to produce a number of fully tested prototypes.
How does anomaly analysis add to an IDS capability?
it allows it to recognize and react to send increases in traffic volume or activity multiple failed login attempts logons or program activity outside the normal working hours or failure in messages.
what is a hybrid environment?
it combines both hierarchal in compartmentalized concept so that each hierarchal Level will make contain subdivisions that are isolated from the rest of the security domain.
what is the hypervisor?
it controls access between virtual guests and host hardware
What is a circuit-level proxy firewall?
it creates a virtual circuit, or a point-to-point connection between a client and a server, they don't know all of the details about a specific application that's being proxied on certain criteria that are met or not met to be accepted, or the traffic could be denied, or the traffic could be discarded.
What is a datagram?
it is a data object or a packet in the Network layer
what is a darknet?
it is a portion of allocated IP address is within the network that not used.
What is the The Goguen-Meseguer model?
it is an integrity model based on predetermining the set or domain—a list of objects that a subject can access.
Why is it difficult to stop spam?
it is because the source of messages are usually spoofed.
What is an access aggregation attack??
it is collecting multiple pieces of non sensitive information and combining or aggregating them to learn sensitive information. It's like a Reconnaissance attack grabbing IP addresses, open ports, etc.
What is a conceptual security triple?
it is model that encompasses three concepts assets, risk, and vulnerability and their interdependent relationship within a structured, formalized organization.
The SD3+ design is what?
it is secured by default securing appointment in communication there are two goals in mind with this process. To reduce the number of security security-related design and coding defects. And reduce the severity of any remaining defects.
What is task base access control?
it is similar to roll base access control but instead of being assigned to one or roles as each user is assigned an array of tasks.
for a company to have a resource qualify as a trade secret
it must provide the company with some type of competitive value or advantage
what is sandboxing?
it provides a security boundary for applications and prevents the application from interacting with other applications
what's in accidents aggregation attack?
it refers to collection of multiple pieces of nonsensitive information and combining them to learn sensitive information. In other words a person or group may be able to collect multiple facts about a system then using facts launch attack.
The whole idea behind a one-way hash is that?
it should be just that - one-way. In other words, an attacker should not be able to figure out your password from the hashed version of that password in any mathematically feasible way (or within any reasonable length of time).
What is NIST 800-53?
it uses the following control categories: technical. management, and operational
what is a dedicated mode?
it's a mode of operation means that the system contains objects of one classification level onl
interns of common criteria terms what is the security target?
it's the documentation describing the TOE including the security requirements in operational environment.
Once your BCP team completes the four stages of preparing to create a business continuity plan, what is the last step?
it's time to dive into the heart of the work—the business impact assessment (BIA)
what are Primary and Candidate Keys
keys can uniquely identify records in a table
Which access control allows security controls for complexed environments. It is a complex access control model based on the interaction between any combination of objects and subjects
lattice based access control
Encryption occurs at which layer of the OSI Model?
layer 6 presentation
The object-relational and object-oriented models do what?
manage complex data such as required for computer-aided design and imaging.
Computer Security Act (CSA) of 1987?
mandates baseline security requirements for all federal agencies. Gave the National Institute of Standards and Technology (NIST) responsibility for developing standards and guidelines for federal computer systems
What is DHCP snooping
means that DHCP servers can assign IP addresses to only selected systems which are identified by their MAC addresses
What is Mutual authentication?
means that it is happening in both directions instead of just the user having to authenticate to the server the server also has to authenticate to the user
In the provisions and processes phase,of the BCP
mechanisms and procedures that will mitigate the risks are designed.
To fully evaluate risks and subsequently take the proper precautions you must
must analyze the following: assets, asset valuation, threats, vulnerability, exposure, risk, realized risk, safeguards, countermeasures, attacks, and breaches
What are the legal and regulatory requirements that face business continuity planners?
must exercise due diligence that shareholders' interests are protected prior to disasters. Some industries are also subject to federal, state, and local regulations that mandate specific BCP procedures. Businesses have contractual obligations to their clients that must be met, before and after a disaster.
what is Non-volatile memory?
non-volatile storage is computer memory that can retrieve stored information even after having been power cycled turned off and back Examples of non-volatile memory include read-only memory, flash memory, ferroelectric RAM most types of magnetic computer storage devices hard disk drives, floppy disks, and magnetic tape, optical discs
What is Masquerading
occurs when a person presents him- or herself as another user, typically to gain access to unauthorized information or processes.
three main methods used to exchange secret keys securely are:
offline distribution, public key encryption, and the Diffie-Hellman key exchange algorithm
key of the same length as the message where each bit or character from the plaintext is encrypted by a modular addition
one-time pad (OTP) is a type of encryption that is impossible to crack if used correctly. Each bit from the plaintext is encrypted by a modular addition with a bit or character from a secret random key
If the continuity is broken, then business processes have stopped what happens next?
organization is in disaster mode; thus, disaster recovery planning (DRP) takes over.
The Computer Security Act does what?
outlines steps the government must take to protect its own systems from attack
NIST SP 800-18
outlines the responsibilities and expected behavior of individuals and state the consequences of not complying with the rules or AUP? Called the "Rules of Behavior"
What do Business and mission owners own?
own the processes and ensure the systems provide value to the organization
__________ are responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of the IT systems and data they own
owners are responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of the IT systems and data they own
What is used in the first generation of firewalls and does not keep track of the state of a connection?
packet filtering
What type of firewall examines all of the fields in the headers in the packet. It might look at the source IP address field in the IP header or look at the destination port number field in a TCP header to decide whether or not traffic should be allowed to go through.
packet-filtering firewall
What is source routing?
packets hold the forwarding information so that they can find their way to the destination themselves without bridges and routers dictating their paths
What rule states that when an agreement between parties is put into written form, the written document is assumed to contain all the terms of the agreement and no verbal agreements may modify the written agreement?
parol evidence
what is always a potential attack if awireless network is not otherwise using some other form of authentication typically access via 802.1 X?
password guessing
What is Intrusion Detection?
patterns of analysis and recognition
What is a full backup?
performed the archive bit will be cleared indicating that the files were backup. This allows backup programs to do an incremental or differential backup that only backs up the changes to the filesystem since the last time the bit was cleared
what is the arithmetic logic unit or called ALU?
performs the mathematical calculation it computes it is fed instructions by the control unit which acts as a traffic cop sitting instructions to the ALU
What is a database-related SQL structured query language terminology that allows a relation to contain multiple rows with the same primary key; the multiple instances are distinguished by their security levels. It occurs because of mandatory policy.
polyinstantiation
The Full Backup Method is what?
primarily run when time and tape space permits, and is used for the system archive or baselined tape sets
What is the final step in the BIA
prioritize the allocation of business continuity resources to the various identified risks and assessed in the preceding tasks of the BIA
the four steps of the business continuity planning process are:
project scope and planning, business impact assessment, continuity planning, and approval and implementation.
the four steps of the business continuity planning process is?
project scope and planning, business impact assessment, continuity planning, and approval and implementation. Each task contributes to the overall goal of ensuring that business operations continue uninterrupted in the face of an emergency situation.
BCP process involves the follwing steps_________
project scope and planning, business impact assessment, continuity planning, and approval and implementation
Business continuity planning (BCP) involves four distinct phases they are what?
project scope and planning, business impact assessment, continuity planning, and approval and implementation.
The Computer Fraud and Abuse Act as amended does what?
protects computers used by the government or in interstate commerce from a variety of abuses.
what is Virtual Storage?
provided by the operating system where it uses a combination of RAM and disk storage to simulate a much larger address space than is actually present
The Federal Sentencing Guidelines released in 1991 provided?
provided punishment guidelines to help federal judges interpret computer crime laws.The guidelines formalized the p rudent man rule , which requires senior executives to take personal responsibility for ensuring the due care that ordinary, prudent individuals would exercise in the same situation.
What is an elliptic curve algorithm?
provides more security than other algorithms when both are used with keys of the same length
What is The Internet Security Association and Key Management Protocol ISAKMP?
provides background security support services for IPSec, including managing security associations
What is Mesh Toplogy secure?
provides redundant connections to systems, allowing multiple segment failures without seriously affecting connectivity.
What is system high?
provides the most granular or distinctive control over resources and users because it enforces clearances, requires need to know, and allows the processing of only single sensitivity levels
What is an Occupant emergency plan?
provides the response procedures for occupants of a facility in the event of a situation posing a potential threat to the health and safety of personnel, the environment, or property
what is virtual memory?
provides virtual address mapping between applications and hardware memory.
What is a private cloud?
provisioned for exclusive use by comprising multiple consumers. It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
what are false vulnerabilities or apparent loopholes intentionally implantnted in a system in attempt to temp hackers
pseudo flaws
What is an algorithm for generating a sequence of numbers whose properties approximate the properties of sequences of random numbers. The PRNG-generated sequence is not truly random, because it is completely determined by a relatively small set of initial values, called the PRNG's seed which may include truly random values.
pseudorandom number generator
public-key certificate binds a _________key value?
public key value
______binds a subject name to a public key value?
public-key certificate binds a subject name to a public key value
what is purging?
purging is used to sufficiently clean Remnants of data on a magnetic storage drive so that it can be reused in unsecure environment
What should be included in the criticality survey?
purpose clearly stated, management approval, what services and systems are critical to keep business organized.
Remember: data for being purged is the responsibility of the data owner not the custodian
qualitative risk analysis approach pinpoints major areas of risk - it gives simple subjective results not objective
What is Scoping
refers to reviewing baseline security controls and selecting only those controls that apply to the IT system you're trying to protect.
What is NIST SP 800-53
regulation discusses security control baselines as a list of security controls. It stresses that a single set of security controls does not apply to all situations, but any organization can select a set of baseline security controls and tailor it to its needs
WHat are the The Federal Sentencing Guidelines ?
released in 1991 formalized the prudent man rule, which requires senior executives to take personal responsibility for ensuring the due care that ordinary, prudent individuals would exercise in the same situation?
Remember: Contingency planning requirements should be considered at every phase of SDLC, but most importantly when a new IT system is being conceived.
remember : In the initiation phase of the SDLC, system requirements are identified and matched to their related operational processes, allowing determination of the system's appropriate recovery priority.
remember this: A vulnerability is a weakness in a system that can be exploited by a threat
remember this MD5 is a one-way hash function producing a 128-bit message digest from the input message, through 4 rounds of transformation. MD5 is specified as an Internet Standard RFC1 12
COBIT. Control Objectives for Information and Related Technology COBIT is a security concept infrastructure used to organize the complex security solutions of companies.
remember this Threat modeling is the security process where potential threats are identified, categorized, and analyzed.
remember this:IPSec operational mode encrypts the entire data packet in Tunnel Mode
remember this, In the UTP category rating, the tighter the wind or the tighter the cables are twisted togethe :the higher the rating and its resistance against interference and crosstalk will be.
remember this: Interpreters translate one command at a time during execution, as opposed to compilers and assemblers where source code for the whole application is transformed to executable code before being executed.
remember this: A translator is a generic term for the others. translates source code one command at a time for execution on a computer?
remember this: a general term is described as the process of independently assessing a system against a standard of comparison, such as evaluation criteria is defined as a benchmark, standard is known as an evaluation criteria
remember this: Criteria are the "standards" against which security evaluation is carried out. They define several degrees of rigour for the testing and the levels of assurance that each confers. They also define the formal requirements needed for a product (or system) to meet each Assurance level.
remember this : with a dedicated mode all subjects must possess the clearance equal or two greater than the label the objects.
remember this: In System high mode of operation the system contains objects of mixed labels also must possess a clearance equal to the systems eyes object.
Remember this: HTTP is not a secure channel, L2TP is encapsulated but not encrypted, SSL/SSH/IPSEc are encrypted and encapsulated
remember this: In tunnel mode, even the IP Header is encrypted. In transport mode, the IP header is intact
remember this: An intranet is an Internet-like logical network that uses a firm's internal, physical network infrastructure.
remember this: Network Architecture refers to the communications products and services, which ensure that the various components of a network such as devices, protocols, and access methods work together.
remember this: packet filtering gateways offer minimum security but at a very low cost, and can be an appropriate choice for a low-risk environment.
remember this: Packet filtering firewalls use routers with packet filtering rules to grant or deny access based on source address, destination address, and port.
Remember this: Avoid combining policies, standards, baselines, guidelines, and procedures in a single document. Each of these structures must exist as a separate entity because each performs a different specialized function
remember this: The goal of a business continuity program is to ensure that recovery time objectives are shorter than maximum tolerable downtime measures.
Remember this: The act of measuring and evaluating security metrics is the practice of assessing the completeness and effectiveness of the security program. This should also include measuring it against common security guidelines and tracking the success of its controls.
remember this: The security role of data custodian is responsible for the tasks of implementing the prescribed protection defined by the security policy and senior management.
remember this:best reason for separating the test and development environments is To control the stability of the test environment.
remember this: The test environment must be controlled and stable in order to ensure that development projects are tested in a realistic environment which, as far as possible, mirrors the live environment.
remember this: The MAC address is 48 bits long, 24 of which identify the vendor, as provided by the IEEE. The other 24 bits are provided by the vendor.
remember this: a detailed examination and testing of the security features of an IT system/ product ensure they meet evaluation criteria is Evaluation
remember this-a disadvantage of a statistical anomaly-based intrusion detection system may falsely detect a non-attack event that had caused a momentary anomaly in the system.
remember this: a factor related to Access Control cover the integrity, confidentiality, and availability components of information system security.
The Internet Security Glossary RFC2828 defines aggregation as a circumstance in which a collection of information items is required to be classified at a higher security level than any of the individual items that comprise it.
remember this: digital envelope for a recipient is a combination of encrypted data and its encryption key in an encrypted form that has been prepared for use of the recipient.
remember this: Some sites choose not to implement Trivial File Transfer Protocol TFTP due to the inherent security risks. TFTP is a UDP-based file transfer program that provides no security.
remember this:It is recommended to use a passphrase. A passphrase is more resistant to attacks. The passphrase is converted into a virtual password by the system. Often time the passphrase will exceed the maximum length supported by the system and it must be trucated into a Virtual Password.
remember this: When a station communicates on the network for the first time, the Reverse Address Resolution Protocol RARP finds the Internet Protocol (IP) address that matches with a known Ethernet address
remember this:the RARP protocol sends out a packet, which includes its MAC address and a request to be informed of the IP address that should be assigned to that MAC address.
The Federal Information Security Management Act (FISMA)
requires that federal agencies implement an information security program that covers the agency's operations. FISMA also requires that government agencies include the activities of contractors in their security management programs.
what is a click wrap agreement?
requires users to click on a button during the installation process to accept the terms of the agreement.
What is the responsibility of the data owner when it comes to protecting data
responsible for classifying, labeling, and protecting data
The termination procedure should include what? witnesses, return of company property, disabling network access, an exit interview, and an escort from the property.
return of company property, disabling network access, an exit interview, and an escort from the property.
Your DMZ is located ?
right behind your first Internet facing firewall
explain the ring model?
ring zero the kernel, ring one other OS components that do not fit in ring zero, device drivers ring two, ring three user applications
__________is the process by which upper management is provided with details to make decisions about which risks are to be mitigated, which should be transferred, and which should be accepted
risk analysis
The process of identifying factors that could damage or disclose data, evaluating those factors in light of data value and countermeasure cost, and implementing cost-effective solutions for mitigating risk is what?
risk management process
implementing cost-effective solutions for mitigating or reducing risk is known as?
risk management.
What is parol evidence?
rule states that when an agreement between parties is put into written form, the written document is assumed to contain all the terms of the agreement and no verbal agreements may modify the written agreement.
What provides a security boundary for applications and prevents the application from interacting with other applications?
sandboxing
A BCP project typically has four components: scope determination, the Business Impact Assessment, the Business Continuity Plan, and implementation
scope determination, the Business Impact Assessment, the Business Continuity Plan, and implementation
Symmetric-key encryption uses (select all that apply):
secret keys, one key for encryption, another for decryption, shared keys
what is a security domain?
security domain is a list of objects that is allowed to access more broadly defined domains are groups of subjects in objects with a similar security requirements.
what is the documentation describing the TOE including the security requirements and operational environment?
security target
remember this :Threat modeling can be performed as a proactive measure during design and development or as a reactive measure once a product has been deployed. Key concepts include assets/attackers/software, STRIDE, diagramming, reduction/decomposing, and DREAD
security-minded acquisitions. Integrating cyber security risk management with acquisition strategies and practices is a means to ensure a more robust and successful security strategy in organizations of all sizes.
What A data object called in the Transport layer
segment
What refers to any information that isn't public or unclassified
sensitive
What are some of the considerations when you are conducting Business Impact Assessment and the Cloud?
service organization control SOC report
What is COSO?
set of internal corporate controls to help reduce fraud developed by the Committee of Sponsoring Organizations of the Tread Way commission
What is a noninvasive attack smart cards are vulnerable to?
side channel attack. Side channel attacks are passive attacks to gather information about smart cards such as an encryption key
Examples of ___________attacks are fault generation, differential power analysis, electromagnetic analysis, timing, and software attacks
side-channel attacks
What is a Cyclic Redundancy Check?
similar to a Hash total to act as a redundancy tool
Kerberos uses what type of authentication method?
single-factor or multi-factor authentication method
What is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP Broadcast address?
smurf attack
Northbridge and Southbridge what are they?
some computer designs use two buses
What is it called when packets hold the forwarding information so that they can find their way to the destination themselves without bridges and routers dictating their paths?
source routing
What is a The meet in the middle attack?
specifically targets encryption algorithms that use two rounds of encryption, such as Double DES
What is a capability table ?
specifies the access rights a certain subject possesses pertaining to specific objects?
not write information to an object at a lower sensitivity level (no write down). This is also known as the Confinement Property.
star Security Property
What are bounds?
state or define the area within which a process is confined.
An abstraction is what?
states that a detailed understanding of lower system levels is not a necessary requirement for working at higher levels.
What is Differential backups?
store all files that have been modified since the time of the most recent full backup; they affect only those files that have the archive bit turned on, enabled, or set to 1.
cipher feedback mode CFB uses what type of cipher?
streaming cipher
What is the The best way to protect the confi dentiality of data whether it's a rest, in transit or storage?
strong encryption protocols
Blowfish what is it?
symmetric block cipher with variable-length key (32 to 448 bits) designed in 1993 by Bruce Schneier as an unpatented, license-free, royalty-free replacement for DES or IDEA.
Block ciphers is a type of what?
symmetric-key encryption algorithm that transforms a fixed-size block of plaintext unencrypted text data into a block of ciphertext encrypted text-data of the same length. They are appropriate for software implementations and can operate internally as a stream
which contains the rules that govern the interactions between subjects and objects and permissions subjects can grant to one another
take Grant protection model
remember this: access control method prevents information from leaking DOWN to a lower level of security while preventing users from accessing information at a higher level area than their own clearance is the Bell La-Padula Model
testing uses a set of test cases that focus on control structure of the procedural design is Unit testing is the testing of an individual program or module.
You should understand the distinction between business continuity planning and disaster recovery planning.
that BCP comes first, and if the BCP efforts fail, DRP steps in to fi ll the gap.
What are problems with RAID Level 0?
that it actually provide no fault tolerance of the disk system rather than increasing it. The entire data volume is unusable if one drive in the set fails
Describe the process used to develop a continuity strategy
the BCP team determines which risks will be mitigated. In the provisions and processes phase, mechanisms and procedures that will mitigate the risks are designed that is approved by Senior Management
Remember:The Digital Signature Standard uses the SHA-1 and SHA-2 message digest functions along with one of three encryption algorithms:
the Digital Signature Algorithm DSA; the Rivest, Shamir, Adleman RSA algorithm; or the Elliptic Curve DSA ECDSA algorithm
that act provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties apply when the individual knows that the information will benefit a foreign government
the Economic Espionage Act of 1996
Protection profiles and security targets are elements of what?
the ISO International Standard 15408 "Evaluation Criteria for Information Technology Security", also commonly known as the Common Criteria (CC).
Commercial data is often classified within four criteria to protect information what are they
the age of the information, it's useful life, and any regulatory requirements.
performs the mathematical calculation it computes it is fed instructions by the control unit which acts as a traffic cop sending instructions
the arithmetic logic unit
Once your BCP team completes the four stages of preparing to create a business continuity plan what is the next step?
the business impact assessment (BIA)
What are Security Targets?
the claims of security from the vendor that are built into a Target of Evaluation
if the BCP team consults with fire experts and determines that a building fire would cause 70 percent of the building to be destroyed what is the exposure factor?
the exposure factor of the building to fi re is 70 percent.
A static packet-filtering does what ?
the firewall filters traffic by examining data from a message header.
Once an intrusion into your organization's information system has been detected, what is the first steps you need to take?
the first action that needs to be performed is determining to what extent systems and data may be compromised if they really are, and then take action.
what have five requirements. They must allow input of any length, provide fi xed-length output, make it relatively easy to compute the hash function for any input, provide one-way functionality, and be collision free
the fundamental requirements of a hash function
What is the primary goal of change management? Maintaining Documentation Keeping users informed Allowing rollback of failed changes Preventing Security Compromises
the goal of change management is to ensure that any change does not lead to reduced compromised security.
what controls access between virtual guests and host hardware?
the hypervisor
how to perform the business organization analysis?
the individuals responsible leading the BCP process determine which departments and individuals have a stake in the business continuity plan. This analysis is used as the foundation for BCP team selection and, after validation by the BCP team, is used to guide the next stages of BCP development.
What is a replay attack?
the malicious individual intercepts an encrypted message between two parties often a request for authentication and then later replays the captured message to open a new session.
An ACL specifies a list of users subjects who are allowed access to each object
the matrix is a way of analyzing the access control needed by a population of subjects to a population of objects. This access control can be applied using rules, ACL's, capability tables, etc.
What is calculated and included in a digital signature to prove that the message has not been altered since the time it was created by the sender?
the message digest
What contains hardware including the CPU, memory slots, firmware, and peripheral slots such as peripheral component interconnect slots
the motherboard
What uses a key of the same length as the message where each bit or character from the plaintext is encrypted by a modular addition?
the one-time pad (OTP). Each bit or character from the plaintext is encrypted by a modular addition with a bit or character from a secret random key (or pad) of the same length as the plaintext
Risk analysis is what?
the process by which risk management is achieved and includes analyzing an environment for risks, evaluating each risk as to its likelihood of occurring and the cost of the resulting damage, assessing the cost of various countermeasures for each risk, and creating a cost/benefit report for safeguards to present to upper management.
The mechanisms and procedures that will mitigate the risks are designed occur at what phase of the BCP?
the provisions and processes phase
What us one of the major problems underlying symmetric encryption algorithms?
the secure distribution of the secret keys required to operate the algorithms.
What is Categorize, Select, Implement, Assess, Authorize, and Monitor
the six steps of the risk management framework
following frameworks are Categorize, Select, Implement, Assess, Authorize, and Monitor which are what?
the six steps of the risk management framework
what is regression testing?
the software testing level tests software after updates, modifications, or any patches
What are identification of priorities, risk identification, likelihood assessment, impact assessment, and resource prioritization?
the steps of the business impact assessment process
With Discretionary Access Control there are limitations--what are they?
the subject has authority, within certain limitations, to specify what objects can be accessible.
What is a top-down approach?
the top down approach means that the initiation, support, and direction come from top management; work their way through middle management; and then reach staff members
What is a hierarchical environment?
the various classification labels are assigned in an ordered structure from low security to medium security to high security.
What are the two ways of transferring files,
there are two basic ways: FTPS and SFTP.
what is a compartmentalized enviornment?
there is no relationship between one security domain and another. each domain represents a separate isolated compartment to gain access to an object the subject must have specific clearance for its security domain.
what is a maintenance hook?
they are a type of a backdoor there a shortcut installed by the system designers and programmers to allow developers to bypass normal system checks during development.
what is a zero knowledge team?
they know nothing about the Target site except the publicly available information such as the domain name and company address.
Database administrators take steps to encrypt sensitive data stored on the database server (data at rest) would do what?
they would implement strong authentication and authorization controls to prevent unauthorized entities from accessing the database
What is is the system of oversight that may be mandated by law, regulation, industry standards, or licensing requirements
third-party governance of security
What phase of the business impact assessment identifies the likelihood that each risk will occur?
this assessment is usually expressed in terms of an annualized rate of occurrence (ARO) that reflects the number of times a business expects to experience a given disaster each year.
what is in advanced persistent threat?
this refers to a group of attackers who are working together or highly motivated, skilled and patient --they have advanced knowledge and a wide variety of skills to detect and exploit vulnerabilities.
These can originate from numerous sources, including IT, humans, and nature which should be performed as a team effort to provide the widest range of perspectives to you reduce your system's vulnerability? What is this process called?
threat evaluation
What is an exposure factor, the single loss expectancy, and the annualized loss expectancy
three specific metrics when looking Impact Assessments
What is True name identity theft
to a situation where someone obtains key pieces of personal information such as a credentials, or Social Security number, and then uses that information to impersonate someone else?
The star Security Property states that a subject may not write information
to an object at a lower sensitivity level (no write down). This is also known as the Confinement Property.
What is a Vital function?
to those that can be performed manually but only for a brief period of time; this is associated with lower costs of disruption than critical functions
What is a web vulnerability scanner?
tool to find a Cross-site scripting attack
The ____________of the Bell-LaPadula model states that the classification of a subject or object does not change while it is being referenced.
tranquility principle
What is a modem?
translates data from digital form and then back to digital for communication over analog lines.
To achieve added security over DES, 3DES must use at least______________
two cryptographic keys
Confidentiality assures that the information is not disclosed to___________________
unauthorized persons or processes.
What is Triple DES?
used 56-bit keys but newer implementations use 112-bit or 168-bit keys. Larger keys provide a higher level of security. Microsoft OneNote and System Center Confi guration Manager use 3DES to protect some content and passwords.
What does packet filtering do?
used in the first generation of firewalls and does not keep track of the state of a connecti
What are Foreign Keys
used to enforce referential integrity constraints between tables that participate in a relationship
Cross site scripting can be mitigated and is only effective when what is involved?
user interaction
DNS is what kind of model?
uses a hierarchical model to organize data, with root name servers representing the top-level domains and authority distributed hierarchically to child servers.
What is Base+Offset addressing ?
uses a value stored in one of the CPU's registers as the base location from which to begin counting. The CPU then adds the offset supplied with the instruction to the value and retrieves the operand from that computed memory location
RAID-5 what is it?
uses disk striping with parity-provides balance between performance & availability- requites 3 physical disks
what is a closed system?
uses proprietary hardware or software
What is an Encrypted Virus?
uses simple encryption to encipher their computer code. Each virus is encrypted with a different key so that even with a key to one virus, another instance of the same virus cannot be scanned
What is the criteria for the best programming?
uses the most cohesive modules possible, because different modules need to pass data and communicate, Also, the lower the coupling, the better the software design, because it promotes module independence. The more independent a component is, the less complex the application is and the easier it is to modify and troubleshoot.
How can Single Sign On be implemented?
using scripts that replay the users multiple log-ins against authentication servers to verify a user's identity and to permit access to system services
WHat is a False Reject or Type I Error?
valid user is rejected by the system
what is unique about virus writers and what do they not commonly used in their code?
validation routines
What does an IDSs watch for ?
violations of confidentiality, integrity, and availability. Attacks from external connections , viruses, malicious code, trusted internal subjects performing unauthorized activities, and unauthorized access attempts from trusted locations.
What periodically synchronizes itself with all of the identity stores individual network directories to ensure the most up-to-date information is being used by all applications and identity management components within the enterprise.
virtual directory
what do not commonly include validation routines in their code?
virus writers
where are critical business records will be stored and the procedures for making and storing backup copies of those records?
vital records program
What is Multics- Multiplexed Information and Computing Service?
was an influential early time-sharing operating system. The project was started in 1964 in Cambridge, Massachusetts. The last known natively running Multics installation was shut down on October 30, 2000, at the Canadian Department of National Defence in Halifax, Nova Scotia, Canada
What is the The International Data Encryption Algorithm IDEA?
was developed in response to complaints about the insufficient key length of the DES algorithm. Like DES, IDEA operates on 64-bit blocks of plain text/ciphertext
What would be the tool to find a Cross-site scripting attack?
web vulnerability scanner
what is a pseudo flaw?
what are false vulnerabilities or apparent loopholes intentionally implantnted in a system in attempt to temp hackers
What is purging?
what is a more intense form of clearing that prepares media for reuse in less secure environments. It provides a level of assurance that the original data is not recoverable using any known methods.
What is a smurf attack?
when an attacker spoofs an ICMP broadcast packet and sends to the network. the broadcast is sent to all victims on a network where the victim is located.
What is a Shrink Wrap License agreement?
when the user opens a software package
What is a vital records program?
where are critical business records will be stored and the procedures for making and storing backup copies of those records
The disaster recovery plan kicks in when?
where the business continuity plan leaves off.
Covert Timing Channel
which one process modulates its system resource for example, CPU cycles, which is interpreted by a second process as some type of communication.
What is the Anti‐Counterfeiting Trade Agreement?
which proposes a framework for international enforcement of intellectual property protections. As of February 2015, the treaty awaited ratification by the European Union member states, the United States, and five other nations.
Patents protect the intellectual property rights of inventors. They provide a period of _________
years during which the inventor is granted exclusive rights to use the invention (whether directly or via licensing agreements). At the end of the patent exclusivity period, the invention is in the public domain available for anyone to use.
how do you ensure that logs have accurate time stands and that these timestamps and a consistent throughout the environment?
you can do this through network time protocol NTP which is a server that synchronizes it to a trusted time source such as a public network time protocol server
If physical and infrastructure support is lost, such as after a catastrophe, regular activity (including deploying updates, performing scans, or tightening controls) is not possible what do you do?
you must simply wait until the emergency or condition expires and things return to normal
after identifying valuable assets and potential threats what is the next step?
you perform a vulnerability analysis.
What is it when an entity knows nothing about the Target site except the publicly available information such as the domain name and company address?
zero knowledge team
