Cissp Security Architechture, Brp & Bcp

Front 1

Atomic refers to what in a database management system?

What TCP/IP model corresponds with the OSI Network Layer?

Back 1

Every row/column position is always exactly 1 data value.

Internet Layer.

Front 2

Is Coaxial or UTP more resistant to EMI?

TCP and UDP port numbers are how many bits

Back 2

Coaxial.

16 bit.

Front 3

Why is RAID level 1 more costly then the other RAID levels?

Should the DMZ be placed in front of or behind the first Internet Firewal?

Back 3

Because it requires a one for one disk ratio.

Behind the first internet firewall.

Front 4

A Token ring uses what type of wireing?

Discribe a Differential Backup?

Back 4

CAT 4 UDP

A Differential Backup builds up changes as it writes to the full backup.

Front 5

A hardware RAID is ussually what?

What layer of the TCP/IP Protocol model offers error free dilivery and packet sequencing?

Back 5

Platform - interdependant.

Transport Layer.

Front 6

What remote access authenticatin system is the most robust?

What layer of the OSI does IPSEC operate on?

Back 6

TACACS+.

Network Layer.

Front 7

Name the four network classes?

Back 7

0-127 = Class A
128-191 = Class B
192-223 = Class C
224-239 = Class D

Front 8

Link the folling ISO standards?

802.2
802.3
802.5
802.11

Back 8

802.2 = Locigal link
802.3 = Ethernet CSMA/CC
802.5 = Token Ring
802.11 = Wireless

Front 9

Buffer Overflow and Bountry condition errors are subsets of what?

Why is Inferred considered more secure?

Back 9

Input Validation errors.

Requires direct line of site.

Front 10

What is the purpose of a message digest in within a digital signature?

What is the preferred way to put out a electrical fire?

Back 10

Detect message changes.

CO2..

Front 11

What Security Model intruduces the idea of mutual exlcusivity?

The Brewer and Nash model is designed to prevent what?

The Brewer and Nash model uses what type of security policy?

Back 11

Brewer and Nash.

Conflicts of interest.

Chinese Wall Security Policy.

Front 12

What Security Model looks like a spread sheet?

The Information Flow Model is a veriation of what security Model?

The Access Control Model address's what two areas on the CISSP?

Back 12

Information Flow Model.

The Access Control Model.

Confidentiality and Integrity.

Front 13

What three integrity issues does the Clark Wilson security Model address?

Back 13

Unauthorized Modifications.

Authorized people making unauthorized changes.

Internal & External Consistancy.

Seperation of Duties.

Front 14

Clark Wilson Model is known for what?

Clark Wilson Model is also known as the Commercial Integraty model? T OR F

Back 14

Well Formed Transactions.

True..

Front 15

Microsoft uses what type of Security Model?

What Security Model combines all three integrity goals?

Back 15

A combination of the Biba and Bell Lapadula model called the Lipner security model.

Clark Wilson Security Model..

Front 16

The Biba Security Model uses what mathmatical dual for confidentiality?

The Biba Security model allows a person to read and write in what way?

Back 16

Access Tuples: Object and Subjects.

Read Up and Write Down.

Front 17

The Biba Security model is based upon what?

Biba Security Model address's what leg of the CISSP triadd?

Back 17

Hierarchiacal Lattice.

Integrity.

Front 18

What does the sample security property in the Bell Lapadula address?

What Access Control model uses a directed graph to specify rights that can be transfered from subject to object?

Back 18

No Read up No Write down.

The Take Grant Model.

Front 19

What the Orange book based of off?

What Security Model is known for Read Down Write UP

Back 19

The Bell Lapadula Security Model.

The Bell Lapadula Security Model.

Front 20

What leg of the CISSP does the Bell Lapadula address?

What Orange Book Security Rating is concerned with Covert Channels?

Back 20

Confidenciality.

B-2

Front 21

Which TCSEC defines manditory Protections?

Copy Write laws protect what?

Back 21

B..

Expression of Ideas and licenses.

Front 22

What constitutional ammendment governs expression of ideas?

Back 22

1st amendment

Front 23

What US Code covers mulicous mischief?

What US Code Covers Wire-tape, Sniffing and looking for passwords?

Back 23

US Code 18, Section 1362

US Code 18 2510-2521

Front 24

The Tear Drop Attack does what?

What is the Length of MD5?

Back 24

Modifies the packet length and fragmentation.

128 bits.

Front 25

IPv6 is composed of how many bits?

What service runs on port 25?

Back 25

128 bits.

SMTP.

Front 26

what layer of the OSI do Routing protocols work on?

Name two Routing Protocols

Back 26

Layer three - network layer

RIP and VRRP

Front 27

What service rely's on UDP?

What services rely on TCP?

Back 27

DNS.

FTP, Telnet, SMTP

Front 28

How is Standby lighting activated?

Back 28

Suspicous Activity.

Front 29

Name three Stratiges that CPTED relys on?

What is CPTED

Back 29

1. Territorality
2. Servalance
3. Access Control

Crime Prevention Thru Environmental Design.

Front 30

Name three components of Good Security Architechture?

Back 30

1. Holistic.
2. Strategic.
3. Allows for multiple implimentations.

Front 31

How many Common Criteria evaluation levels are there?

How many TCSEC evaluations levels are there and what are they?

Back 31

One thru Seven.

Seven

Front 32

What are the Seven TCSEC evaluation levels?

Back 32

D = fails evaluation.
C1 = Discretionary Security Profile.
C2 = Discretionary Access Profile.
B1 = Manditory Labeled Security Profile.
B2 = Manditory Structured Profile.
B3 = Manditory Security Domains.
A = Verified Design.

Front 33

What evaluation methods do the Europeans use?

What is the rating levels

Back 33

ITSEC.

E-0 thur E-6

Front 34

What US organizations helped creat the Common Critera?

TCSEC Covers what part of the CISSP triadd?

Back 34

NIST and NSA.

Confidentiality.

Front 35

What does TNI mean?

What part of the CISSP triadd does TNI address?

Back 35

Trusted Network Interrelation.

Confidentiality, Integraty, Availability.

Front 36

What does ITSEC stand for?

What nations uses ITSEC?

Back 36

Information Technology Security Evaluation Criteria.

European Nations

Front 37

What ISO governs the Common Criteria?

What does TCSEC stand for?

What eval system does the Orange book use?

Back 37

ISO 25408.

Trusted Computer System Evaluation Criteria.

TCSEC.

Front 38

When a system is running in the supervised state can a program run a nonpriviledged instruction?

Does the supervised state require a username and password?

Back 38

Yes.

Yes.

Front 39

What is BESAL - 2 used for and who uses it?

What type of Enterprise Architechture provides a Holistic model of the Enterprise?

Back 39

BESAL -2 is a financial risk assessment tool used by the Group of 8.

Zachmann

Front 40

What does ISO 17799, and 27001 govern?

Back 40

Best practices for a security program.

Front 41

Name five types of drills?

Back 41

Checklist = distributing plan to managers for Comments.

Structured Walk Thru = All managers gather and discuss final plans.

Simulation test = all parties gather for a practice exercise.

Parrel test = testing of alternet sites.

Full Interruption test = most intrusive.

Front 42

What systems should be brought back on line first?

When should the Disaster Recovery Plan be activiated?

Back 42

Least Critical.

After a Damage Assessment has been completed.

Front 43

What is a HOT site?

What is a Warm site?

Back 43

Complete replica of your site.

Partially configured, best for companies that have unusual hardware requirements.

Front 44

What is a Cold site?

What is a Redundant Site?

Back 44

Only provides the most basic requirements - electric, coms, AC, Wireing.

A complete duplicate of the orginal site.

Front 45

What determines the type of backup facility a site requires?

What is another word for disk Mirroring?

Back 45

Business Impact Anlysis.

Disk Shadowing.