Candi's Csslp Domain 1

Front 1

Trst

Back 1

Test

Front 2

Test

Back 2

Test

Front 3

Test

Back 3

Test

Front 4

Adding security here gets you the biggest bang for the buck.

Back 4

Weakest link

Front 5

What is it called when any aspect of the system fails causes the entire system to fail? Secure systems do not have any of these.

Back 5

Single point of failure

Front 6

What is the level of confidence that the SW is free from vulnerabilities?

Back 6

SW Assurance

Front 7

What is a use case, structured like a legal case, that demonstrates the claim of SW Assurance?

Back 7

Assurance Case

Front 8

Using the principle of keeping things simple is related to what type of mechanism?

Back 8

Economy of mechanism

Front 9

What is the formula for SLE?

Back 9

SLE = asset value * exposure factor

Front 10

What information flow model preserves confidentiality and seeks to avoid conflict of interest by creating security domains?

Back 10

Brewer-Nash model (Chinese Wall)

Front 11

What key element of Trusted Computing can hold an encryption key that is only accessible via a special chip?

Back 11

TPM (Trusted Platform Module)

Front 12

The primary reason for incorporating security into the SW development lifecycle is to protect what?

Back 12

The corporate brand and reputation

Front 13

What authentication type is using something one knows?

Back 13

Knowledge based

Front 14

What authentication type is using something one has?

Back 14

Ownership based

Front 15

What authentication type is using something one is?

Back 15

Character based

Front 16

What framework can be used to develop a risk based security architecture by determining security requirements after analyzing the business initiatives?

Back 16

SABSA (Sherwood Applied Business Security Architecture)

Front 17

Implementing IPSec to assure the confidentiality of data when it is transmitted is an example of which, risk mitigation or risk avoidance?

Back 17

Risk mitigation

Front 18

The process of removing private information from sensitive data sets is referred to as what?

Back 18

Anonymization

Front 19

What is the time period to get the interrupted service running again and what is the time to recover before the business fails?

Back 19

MTD (max tolerable downtime) is time before business fails and RTO (recovery point objective) is the time by which operations need restored