CISSP Practice Test 1 250
RADIUS
X is a common AAA technology used to provide services for dial-up, wireless
networks, network devices, and a range of other systems. OAuth is an authentication
protocol used to allow applications to act on a user's behalf without sharing the
password, and is used for many web applications. While both XTACACS and
TACACS+ provide the functionality Sally is looking for, both are Cisco proprietary
protocols.
Inference
In an X attack, the attacker uses several pieces of generic nonsensitive information
to determine a specific sensitive value.
*Take rule
The X allows a subject to take the rights belonging to another object. If Alice has
take rights on Bob, she can give herself the same permissions that Bob already
possesses.
A brute-force attack
X attacks try every possible password. In this attack, the password is changing by
one letter at each attempt, which indicates that it is a brute-force attack. A dictionary
attack would use dictionary words for the attack, whereas a man-in-the-middle or
pass-the-hash attack would most likely not be visible in an authentication log except
as a successful login.
*Isolation
X requires that transactions operate separately from each other. Atomicity ensures
that if any part of a database transaction fails, the entire transaction must be rolled
back as if it never occurred. Consistency ensures that all transactions are consistent
with the logical rules of the database, such as having a primary key. Durability
requires that once a transaction is committed to the database it must be preserved.
*Worm
X have built-in propagation mechanisms that do not require user interaction, such as
scanning for systems containing known vulnerabilities and then exploiting those
vulnerabilities to gain access. Viruses and Trojan horses typically require user
interaction to spread. Logic bombs do not spread from system to system but lie in
wait until certain conditions are met, triggering the delivery of their payload.
*Teardrop
In a X attack, the attacker fragments traffic in such a way that the system is unable to
reassemble them. Modern systems are not vulnerable to this attack if they run
current operating systems, but the concept of this attack illustrates the danger of
relying upon users following protocol specifications instead of performing proper
exception handling.
SYN, SYN/ACK, ACK
The TCP three-way handshake consists of initial contact via a SYN, or synchronize
flagged packet, which receives a response with a SYN/ACK, or synchronize and
acknowledge flagged packet, which is acknowledged by the original sender with an
ACK, or acknowledge packet. RST is used in TCP to reset a connection, PSH is
used to send data immediately, and FIN is used to end a connection.
*Assuming control of a nonregistered BYOD mobile device
MDM products do not have the capability of assuming control of a device not
currently managed by the organization. This would be equivalent to hacking into a
device owned by someone else and might constitute a crime.
,Identity as a Service
X provides an identity platform as a third-party service. This can provide benefits,
including integration with cloud services and removing overhead for maintenance of
traditional on-premise identity systems, but can also create risk due to third-party
control of identity services and reliance on an offsite identity infrastructure.
*Advance and protect the profession
Gina's actions harm the CISSP certification and information security community by
undermining the integrity of the examination process. While Gina also is acting
dishonestly, the harm to the profession is more of a direct violation of the code of
ethics
ALE
The annualized loss expectancy is the amount of damage that the organization
expects to occur each year as the result of a given risk.
Whitelisting
The X approach to application control allows users to install only those software
packages specifically approved by administrators.. This would be an appropriate
approach in a scenario where application installation needs to be tightly controlled.
Denial of service
This is a clear example of a X attack—denying legitimate users authorized access to
the system through the use of overwhelming traffic. It goes beyond a reconnaissance
attack because the attacker is affecting the system, but it is not a compromise
because the attacker did not attempt to gain access to the system. There is no
reason to believe that a malicious insider was involved.
Company ID
The X is likely unique for each row in the table, making it the best choice for a
primary key. There may be multiple companies that share the same name or ZIP
code. Similarly, a single sales representative likely serves more than one company,
making those fields unsuitable for use as a unique identifier.
PII Personally Identifiable Information
X includes data that can be used to distinguish or trace that person's identity, and
also includes information like their medical, educational, financial, and employment
information. PHI is personal health information, EDI is electronic data interchange,
and proprietary data is used to maintain an organization's competitive advantage.
129.53.44.124
129.53.44.124 is a valid public IP address and a legitimate destination for traffic
leaving Bob's network. 12.8.195.15 is a public address on Bob's network and should
not be a destination address on a packet leaving the network. 10.8.15.9 and
192.168.109.55 are both private IP addresses that should not be routed to the
Internet.
*64
Binary keyspaces contain a number of keys equal to 2 raised to the power of the
number of bits. Two to the sixth power is 64, so a 6-bit keyspace contains 64
possible keys. The number of viable keys is usually smaller in most algorithms due
to the presence of parity bits and other algorithmic overhead or security issues that
restrict the use of some key values.
*The built-in erase commands are not completely effective on some SSDs.
Research has shown that traditional methods of sanitizing files on SSDs were not
reliable. SSDs remap data sectors as part of wear leveling, and erase commands
are not consistently effective across multiple SSD brands. Zero fills can be
performed on SSDs but may not be effective, much like erase commands.
, Degaussing doesn't work on SSDs because they are flash media, rather than
magnetic media. SSDs don't have data remanence issues, but that doesn't create
the need to destroy them.
Encrypting the files
Encrypting the files reduces the probability that the data will be successfully stolen,
so it is an example of risk mitigation. Deleting the files would be risk avoidance.
Purchasing insurance would be risk transference. Taking no action would be risk
acceptance.
Sampling should be conducted randomly.
X to avoid human bias. Choosing a timeframe may miss historic issues or only
account for the current administrator's processes. Sampling is an effective process if
it is done on a truly random sample of sufficient size to provide effective coverage of
the userbase.
*Notice, choice, onward transfer, security, data integrity, access, enforcement
The European Data Protection Directive's seven primary tenets are
Notice
Choice
Onward transfer
Security
Data integrity
Access
Enforcement
White box
In a X test, the attacker has access to full implementation details of the system,
including source code, prior to beginning the test. In gray-box testing, the attacker
has partial knowledge. In black-box testing, the attacker has no knowledge of the
system and tests it from a user perspective. Blue boxes are a phone hacking tool
and are not used in software testing.
*Application log
The file clearly shows HTTP requests, as evidenced by the many GET commands.
Therefore, this is an example of an application log from an HTTP server.
*A blue box
A blue box was used to generate the 2600 Hz tones that trunking systems required.
White boxes included a dual-tone, multifrequency generator to control phone
systems. Black boxes were designed to steal long-distance service by manipulating
line voltages, and red boxes simulated the tones of coins being deposited into
payphones.
Social engineering
X exploits humans to allow attacks to succeed. Since help desk employees are
specifically tasked with being helpful, they may be targeted by attackers posing as
legitimate employees. Trojans are a type of malware, whereas phishing is a targeted
attack via electronic communication methods intended to capture passwords or other
RADIUS
X is a common AAA technology used to provide services for dial-up, wireless
networks, network devices, and a range of other systems. OAuth is an authentication
protocol used to allow applications to act on a user's behalf without sharing the
password, and is used for many web applications. While both XTACACS and
TACACS+ provide the functionality Sally is looking for, both are Cisco proprietary
protocols.
Inference
In an X attack, the attacker uses several pieces of generic nonsensitive information
to determine a specific sensitive value.
*Take rule
The X allows a subject to take the rights belonging to another object. If Alice has
take rights on Bob, she can give herself the same permissions that Bob already
possesses.
A brute-force attack
X attacks try every possible password. In this attack, the password is changing by
one letter at each attempt, which indicates that it is a brute-force attack. A dictionary
attack would use dictionary words for the attack, whereas a man-in-the-middle or
pass-the-hash attack would most likely not be visible in an authentication log except
as a successful login.
*Isolation
X requires that transactions operate separately from each other. Atomicity ensures
that if any part of a database transaction fails, the entire transaction must be rolled
back as if it never occurred. Consistency ensures that all transactions are consistent
with the logical rules of the database, such as having a primary key. Durability
requires that once a transaction is committed to the database it must be preserved.
*Worm
X have built-in propagation mechanisms that do not require user interaction, such as
scanning for systems containing known vulnerabilities and then exploiting those
vulnerabilities to gain access. Viruses and Trojan horses typically require user
interaction to spread. Logic bombs do not spread from system to system but lie in
wait until certain conditions are met, triggering the delivery of their payload.
*Teardrop
In a X attack, the attacker fragments traffic in such a way that the system is unable to
reassemble them. Modern systems are not vulnerable to this attack if they run
current operating systems, but the concept of this attack illustrates the danger of
relying upon users following protocol specifications instead of performing proper
exception handling.
SYN, SYN/ACK, ACK
The TCP three-way handshake consists of initial contact via a SYN, or synchronize
flagged packet, which receives a response with a SYN/ACK, or synchronize and
acknowledge flagged packet, which is acknowledged by the original sender with an
ACK, or acknowledge packet. RST is used in TCP to reset a connection, PSH is
used to send data immediately, and FIN is used to end a connection.
*Assuming control of a nonregistered BYOD mobile device
MDM products do not have the capability of assuming control of a device not
currently managed by the organization. This would be equivalent to hacking into a
device owned by someone else and might constitute a crime.
,Identity as a Service
X provides an identity platform as a third-party service. This can provide benefits,
including integration with cloud services and removing overhead for maintenance of
traditional on-premise identity systems, but can also create risk due to third-party
control of identity services and reliance on an offsite identity infrastructure.
*Advance and protect the profession
Gina's actions harm the CISSP certification and information security community by
undermining the integrity of the examination process. While Gina also is acting
dishonestly, the harm to the profession is more of a direct violation of the code of
ethics
ALE
The annualized loss expectancy is the amount of damage that the organization
expects to occur each year as the result of a given risk.
Whitelisting
The X approach to application control allows users to install only those software
packages specifically approved by administrators.. This would be an appropriate
approach in a scenario where application installation needs to be tightly controlled.
Denial of service
This is a clear example of a X attack—denying legitimate users authorized access to
the system through the use of overwhelming traffic. It goes beyond a reconnaissance
attack because the attacker is affecting the system, but it is not a compromise
because the attacker did not attempt to gain access to the system. There is no
reason to believe that a malicious insider was involved.
Company ID
The X is likely unique for each row in the table, making it the best choice for a
primary key. There may be multiple companies that share the same name or ZIP
code. Similarly, a single sales representative likely serves more than one company,
making those fields unsuitable for use as a unique identifier.
PII Personally Identifiable Information
X includes data that can be used to distinguish or trace that person's identity, and
also includes information like their medical, educational, financial, and employment
information. PHI is personal health information, EDI is electronic data interchange,
and proprietary data is used to maintain an organization's competitive advantage.
129.53.44.124
129.53.44.124 is a valid public IP address and a legitimate destination for traffic
leaving Bob's network. 12.8.195.15 is a public address on Bob's network and should
not be a destination address on a packet leaving the network. 10.8.15.9 and
192.168.109.55 are both private IP addresses that should not be routed to the
Internet.
*64
Binary keyspaces contain a number of keys equal to 2 raised to the power of the
number of bits. Two to the sixth power is 64, so a 6-bit keyspace contains 64
possible keys. The number of viable keys is usually smaller in most algorithms due
to the presence of parity bits and other algorithmic overhead or security issues that
restrict the use of some key values.
*The built-in erase commands are not completely effective on some SSDs.
Research has shown that traditional methods of sanitizing files on SSDs were not
reliable. SSDs remap data sectors as part of wear leveling, and erase commands
are not consistently effective across multiple SSD brands. Zero fills can be
performed on SSDs but may not be effective, much like erase commands.
, Degaussing doesn't work on SSDs because they are flash media, rather than
magnetic media. SSDs don't have data remanence issues, but that doesn't create
the need to destroy them.
Encrypting the files
Encrypting the files reduces the probability that the data will be successfully stolen,
so it is an example of risk mitigation. Deleting the files would be risk avoidance.
Purchasing insurance would be risk transference. Taking no action would be risk
acceptance.
Sampling should be conducted randomly.
X to avoid human bias. Choosing a timeframe may miss historic issues or only
account for the current administrator's processes. Sampling is an effective process if
it is done on a truly random sample of sufficient size to provide effective coverage of
the userbase.
*Notice, choice, onward transfer, security, data integrity, access, enforcement
The European Data Protection Directive's seven primary tenets are
Notice
Choice
Onward transfer
Security
Data integrity
Access
Enforcement
White box
In a X test, the attacker has access to full implementation details of the system,
including source code, prior to beginning the test. In gray-box testing, the attacker
has partial knowledge. In black-box testing, the attacker has no knowledge of the
system and tests it from a user perspective. Blue boxes are a phone hacking tool
and are not used in software testing.
*Application log
The file clearly shows HTTP requests, as evidenced by the many GET commands.
Therefore, this is an example of an application log from an HTTP server.
*A blue box
A blue box was used to generate the 2600 Hz tones that trunking systems required.
White boxes included a dual-tone, multifrequency generator to control phone
systems. Black boxes were designed to steal long-distance service by manipulating
line voltages, and red boxes simulated the tones of coins being deposited into
payphones.
Social engineering
X exploits humans to allow attacks to succeed. Since help desk employees are
specifically tasked with being helpful, they may be targeted by attackers posing as
legitimate employees. Trojans are a type of malware, whereas phishing is a targeted
attack via electronic communication methods intended to capture passwords or other
