Cissp - Domain 2 - Application Security

Front 1

Seven phases of the system lifecycle.

Back 1

Project initiation, functional design, system design and specification, software development, installation, maintenance, revision

Front 2

Three common software development lifecycle models.

Back 2

Waterfall, modified waterfall, spiral

Front 3

Software development lifecycle model that allows for iteration back to the previous phase of development.

Back 3

Waterfall

Front 4

Software development lifecycle model that incorporates verification and validation into the waterfall model.

Back 4

Modified waterfall

Front 5

Software development lifecycle model that uses iterations of the entire process gradually refining the finished product.

Back 5

Spiral

Front 6

Five phases of the capability maturity model (CMM).

Back 6

level 1 - initiating, level 2 - repeatable, level 3 - defined, level 4 - managed, level 5 - optimized

Front 7

Five phases of the IDEAL model.

Back 7

level 1 - initiating, level 2 - diagnosing, level 3 - establishing, level 4 - acting, level 5 - learning

Front 8

Five generations of programming languages.

Back 8

1st generation - machine language, 2nd generation - assembly language, 3rd generation - C, 4th generation - SQL, 5th generation - visual studio

Front 9

Two types of high level languages.

Back 9

Interpreted, compiled

Front 10

Four components of an object oriented environment.

Back 10

Attributes, methods, classes, instances

Front 11

The number of rows in s table.

Back 11

Cardinality

Front 12

The number of columns in a table.

Back 12

Degree

Front 13

Any combination of attributes that uniquely identifies the rows in a table.

Back 13

Candidate key

Front 14

The candidate key selected by the database administrator to identify the rows of the table.

Back 14

Primary key

Front 15

Keys used to reference other tables in the same database.

Back 15

Foreign key

Front 16

Process used to ensure that the attributes in the table are dependent only on the primary key.

Back 16

Normalization

Front 17

Control that ensures that two processes don't modify the data at the same time.

Back 17

Concurrency

Front 18

Control that ensures that they foreign key values actually correspond to an entry in the referenced table.

Back 18

Referential integrity

Front 19

Control that ensures that groups of related statements either succeed or fail as a group.

Back 19

Transaction

Front 20

All transactions must meet four standard criteria.

Back 20

Atomic, consistent, isolated, durable (ACID)

Front 21

Three types of database attacks.

Back 21

Aggregation, inference, SQL injection

Front 22

Systems that attempt to use a series of rules to mimic the behavior of a human expert in decision making.

Back 22

Expert systems

Front 23

A common type of artificial intelligence system used to predict future events based on a large history of past events.

Back 23

Neural network

Front 24

Seven types of viruses.

Back 24

File infector, companion, boot sector, multipartite, stealth, polymorphic, encrypting

Front 25

Viruses that attach themselves to a file and spread when the file is executed.

Back 25

File infector

Front 26

Viruses that use file names similar to legitimate operating system file names but with different extensions to hide on the system and force execution.

Back 26

Companion

Front 27

Viruses that infect the part of the hard drive used by the operating system at boot time.

Back 27

Boot sector

Front 28

Viruses that combine attributes of file infector and boot sector viruses.

Back 28

Multipartite

Front 29

Viruses that use various techniques to hide their activity from antivirus software.

Back 29

Stealth

Front 30

Viruses that change from system to system in an attempt to avoid signature detection systems.

Back 30

Polymorphic

Front 31

Viruses that use cryptographic techniques to hide themselves from signature detection systems.

Back 31

Encrypting

Front 32

Similar to viruses and use many of the same infection vectors but spread from system to system without user intervention.

Back 32

Worms

Front 33

Malware that disguises itself as a legitimate program to trick the user into executing them but then perform malicious activity in the background,

Back 33

Trojan horse

Front 34

Malware that waits for a certain event to occur, then delivers its payload.

Back 34

Logic bomb

Front 35

Attacks that attempt to prevent the legitimate use of a system by disabling it in some way.

Back 35

Denial of service

Front 36

Attack that attempts to overflow the systems ability to handle the three way TCP handshake by initiating bit not completing a large number of handshakes.

Back 36

SYN flood

Front 37

Attack that uses overlapping fragments to confuse the TCP/IP stack of older OSs

Back 37

Teardrop

Front 38

Attack that leverages a large network of compromised systems to flood a target with requests.

Back 38

Distributed denial of service

Front 39

An attack which uses spoofed ICMP echo requests to trick a large number of remote systems into flooding a taegeted system with ICMP echo reply packets

Back 39

Smurf

Front 40

Attack that sends specially crafted packets with identical source and destination IP address/port pairs causing some operating systems to crash.

Back 40

Land

Front 41

Systems specifically designed to attract attackers in an attempt to study their activity and/or deflect them from attacking high value targets.

Back 41

Honeypot

Front 42

Networks of honeypots, commonly made up of varied operating systems and patch levels.

Back 42

Honeynets

Front 43

Monitored IP subnets that should have no legitimate activity and have no hosts authorized in the IP address range,

Back 43

Darknet