Cissp Set 6

Front 1

What is the Take-Grant Model?

Back 1

uses a directed graph to specify the rights that a subject can transfer to an object or that a subject can take from another object.

Front 2

What is the Bell-LaPadula model?

Back 2

developed to formalize the US DoD multi-level security policy. Deals only with the confidentially of classified material and does no address integrity or availability.

Front 3

The basic tenets of Bell-LaPadula model can be summed up in which way?

Back 3

no read up, no write-down

Front 4

What is meant by the property Strong* Property

Back 4

that reading or writing is permitted at a certain sensitivity level but not at either higher or lower sensitivity.

Front 5

What is the Biba model

Back 5

The first formal integrity model it is lattice based and uses the less than or equal to relation

Front 6

The basic tenets of the Biba model can be summed up in which way?

Back 6

no read-down, no write-up

Front 7

What does the Clark Wilson model require to function?

Back 7

Integrity models

Front 8

What constitutes a triple in the Operational Security domain?

Back 8

Threat, vulnerability and assets

Front 9

What is the difference between a threat and a vulnerability?

Back 9

A vulnerability is a weakness in a system whereas a threat is any potential event that could affect how the system functions

Front 10

What are the major categories of operations security controls

Back 10

preventative, detective and corrective

Front 11

Give an example of a preventative control

Back 11

High walls or dogs

Front 12

Give an example of a detective control

Back 12

Audit trails or access control lists

Front 13

Give an example of a corrective control?

Back 13

backup tapes, redundancy arrays or continuing operations facilities

Front 14

What are administrative controls and what separates them from operational controls?

Back 14

they are installed and manged by administrative personnel to help reduce the threat or impact of violations in a computer system. They are separated because they have more to do with human personnel.

Front 15

What are the three basic levels of privilege?

Back 15

Read, Read/Write, Change

Front 16

What are some things that can destroy data media?

Back 16

temperature liquids, magnetism, smoke and dust

Front 17

What is the difference between auditing and monitoring?

Back 17

auditing occurs at a fixed moment in time whereas monitoring is ongoing

Front 18

What is a clipping level?

Back 18

a baseline of user activity that is considered a routine level of user errors.

Front 19

What is the goal of problem management?

Back 19

reduce the failures to manageable level, prevent occurrence or reoccurrence of a problem, mitigate the negative impact of problems

Front 20

What are three was to thwart traffic analysis attacks?

Back 20

message padding, sending noise, cover channel anaylsis

Front 21

What are two types of data scavenging attacks?

Back 21

keyboard attacks, laboratory attacks

Front 22

What are the phases of system development life cycle?

Back 22

initiation, development/acquisition, implementation, operation/maintenance/disposal

Front 23

What is the waterfall model?

Back 23

a sequential model where inputs from previous phases are incorporated into the next phase

Front 24

What is the spiral model

Back 24

operates under the assumption that the same steps are taken at each phase of the product development lifecycle

Front 25

In the spiral model what does the lower-left quadrant focus on?

Back 25

developing plans that will be reviewed in the upper quadrants of the diagram prior to finalization of the plans.

Front 26

In the detailed COCOMO Model what is the software development effort measured by?

Back 26

external input types, external output types, logical internal file types, external interface file types, external inquiry types

Front 27

Describe the following equation

MM= 2.4 (KDSI)^1.05

Back 27

Man months = 2.4 times the number of thousands of delivered source instructions raised to the 1.05 power

Front 28

Describe the following equation:

TDEV =2.5(MM)^.38

Back 28

Development Schedule in months = 2.5 * man months raised to the power of .38

Front 29

What are the five levels of the Software Capability Maturity Model

Back 29

Initiation, Repeatable, Defined, Managed, Optimizing

Front 30

What is the IDEAL model/

Back 30

the SEI process Improvement model it is an organizational improvement model

Front 31

In OOP what is a message?

Back 31

the communication to an object to carryout some operation

Front 32

In OOP what is a method?

Back 32

the code that defines the actions an object performs i response to a message.

Front 33

In OOP what is a behavior?

Back 33

refers to the results exhibited by tan object upon receipt of a message

Front 34

What is the common object model?

Back 34

supports the exchange of objects between programs

Front 35

What is an expert system?

Back 35

a system that exhibits reasoning similar to that of a human expert to solve a problem.

Front 36

What are four types of databases?

Back 36

hierarchical, mesh, object-oriented, relational

Front 37

What is ODBC

Back 37

A M$ developed standard for supporting access to databases through different applications.

Front 38

What is included in the Business Continuity Plan process

Back 38

Scope and plan initiation, business impact assessment, business continuity plan development

Front 39

What is included in the Disaster Recovery Plan process?

Back 39

DRP processes, Testing the disaster recovery plan, disaster recovery procedures

Front 40

What must always be the first element of a disaster recovery plan?

Back 40

personnel evacuation and safety

Front 41

In the BCP process who approves expenditures, liabilities, and service impacts?

Back 41

policy group

Front 42

In the BCP process who identifies and prioritizes time-critical systems

Back 42

Senior Business Unit Management

Front 43

What are the three goals of a business impact assessment?

Back 43

Criticality prioritization, downtime estimation, resource requirements

Front 44

What are the four steps of a business impact assessment?

Back 44

Gather information, Perform vulnerability assessment, analyze the information, document

Front 45

What is a disaster recovery plan?

Back 45

a comprehensive statement of consistent actions to be taken before, during and after a disruptive event.

Front 46

When speaking of recovery time frame requirements what does a category AAA asset mean?

Back 46

Immediate

Front 47

When speaking of recovery time frame requirements what does a category AA asset mean?

Back 47

Full functional recovery require w/i four hours

Front 48

When speaking of recovery time frame requirements what does a category A asset mean?

Back 48

same day business recovery

Front 49

When speaking of recovery time frame requirements what does a category B asset mean?

Back 49

Max 24 hours downtime

Front 50

When speaking of recovery time frame requirements what does a category C asset mean?

Back 50

24 -72 hours downtime