CISSP REVIEW TIPS ANSWERS AND QUESTIONS SET
A+
✔✔Emanations - ✔✔Potentially compromising leakage of electrical or acoustical
signals.
✔✔Fiber Optics - ✔✔Bundles of long strands of pure glass that efficiently transmit light
pulses over long distances. Interception without detection is difficult.
✔✔Fraggle - ✔✔A Denial of Service attack initiated by sending spoofed UDP echo
request to IP broadcast addresses.
✔✔Hijacking - ✔✔Interception of a communication session by an attacker.
✔✔Hub - ✔✔Layer 1 network device that is used to connect network segments
together, but provides no traffic control (a concentrator).
✔✔Injection - ✔✔An attack technique that exploits systems that do not perform input
validation by embedding partial SQL queries inside input.
✔✔Interception - ✔✔Unauthorized access of information (e.g. Tapping, sniffing,
unsecured wireless communication, emanations)
✔✔IP Address Spoofing - ✔✔Forging of an IP address.
✔✔IP Fragmentation - ✔✔An attack that breaks up malicious code into fragments, in an
attempt to elude detection.
✔✔Kerberos - ✔✔A trusted third party authentication protocol
✔✔Incident response - ✔✔Team should consist of: management, IT, legal, human
resources, public relations, security etc.
,✔✔Modification - ✔✔A type of attack involving attempted insertion, deletion or altering
of data.
✔✔Multiplexers - ✔✔A device that sequentially switches multiple analog inputs to the
output.
✔✔Open Mail Relay Servers - ✔✔A mail server that improperly allows inbound SMTP
connections for domains it does not serve.
✔✔Enticement - ✔✔The legal act of luring an intruder, with intend to monitor their
behavior
✔✔Packet Filtering - ✔✔A basic level of network access control that is based upon
information contained in the IP packet header.
✔✔Patch Panels - ✔✔Provides a physical cross connect point for devices.
✔✔Private Branch Exchange (PBX) - ✔✔A telephone exchange for a specific office or
business.
✔✔Phishing - ✔✔A social engineering attack that uses spoofed email or websites to
persuade people to divulge information.
✔✔Physical Tampering - ✔✔Unauthorized access of network devices.
✔✔Proxies - ✔✔Mediates communication between un-trusted hosts on behalf of the
hosts that it protects.
✔✔Repeaters - ✔✔Layer 1 network device that is used to connect network segments
together, but provides no traffic control (a concentrator).
✔✔Radio Frequency Interference (RFI) - ✔✔A disturbance that degrades performance
of electronic devices and electronic communications.
✔✔Rogue Access Points - ✔✔Unauthorized wireless network access device.
✔✔Routers - ✔✔A layer 3 device that used to connect two or more network segments
and regulate traffic.
✔✔Satellite - ✔✔A specialized wireless receiver/ transmitter placed in orbit that
facilitates long distance communication.
✔✔Sequence Attack - ✔✔An attack involving the hijacking of a TCP session by
predicting a sequence number.
,✔✔Shielding - ✔✔Enclosure of electronic communication devices to prevent leakage of
electromagnetic signals.
✔✔Smurf - ✔✔A Denial of Service attack initiated by sending spoofed ICMP echo
request to IP broadcast addresses. (See Fraggle)
✔✔Sniffing - ✔✔Eavesdropping on network communications by a third party.
✔✔Source Routing Exploitation - ✔✔A vulnerability in IP that allows an attacker to
dictate the path of a communication and thereby access an internal network.
✔✔Spam - ✔✔Unsolicited commercial email
✔✔Switches - ✔✔A layer 2 device that used to connect two or more network segments
and regulate traffic.
✔✔SYN Flooding - ✔✔A Denial of Service attack that floods the target system with
connection requests that are not finalized.
✔✔Tapping - ✔✔Eavesdropping on network communications by a third party.
✔✔Tar Pits - ✔✔Mitigation of spamming and other attacks by delaying incoming
connections as long as possible.
✔✔Teardrop - ✔✔A Denial of Service attack that exploits systems that are not able to
handle malicious, overlapping and oversized IP fragments.
✔✔TEMPEST - ✔✔A codename that refers to the study and mitigation of information
disclosure via electromagnetic emanations from electronic equipment.
✔✔Twisted Pair - ✔✔A simple, inexpensive cabling technology consisting of two
conductors that are wound together to decrease interference.
✔✔War Dialing - ✔✔Reconnaissance technique, involving automated, brute force
identification of potentially vulnerable modems.
✔✔Worldwide Interoperability for Microwave Access (WI-MAX ) - ✔✔A specification for
wireless Metropolitan Area Networks (IEEE 802.16) that provides an alternative to the
use of cable and DSL for last mile delivery.
✔✔Accreditation - ✔✔The managerial approval to operate a system based upon
knowledge of risk to operate
, ✔✔1029 - ✔✔18 USC - Fraud and Related Activity in Connection with Access Devices
✔✔Certification - ✔✔The technical and risk assesment of a system within the context of
the operating environment
✔✔Common Criteria - ✔✔The current internationally accepted set of standards and
processes for information security products evaluation and assurance, which joins
function and assurance requirements
✔✔Covert Channel - ✔✔An unintended communication path
✔✔Data Hiding - ✔✔A software design technique for abstraction of a process
✔✔Embedded - ✔✔Hardware or software that is part of a larger system
✔✔NIDS - ✔✔Usually inspect the header, because the data payload is encrypted in
most cases
✔✔Framework - ✔✔Third party processes used to organize the implementation of an
architecture
✔✔Internet Architecture Board - ✔✔Committee for internet design, engineering, and
management, responsible for the architectural oversight of the IETF
✔✔1024-49151 - ✔✔Registered ports as defined by IANA
✔✔ITSEC - ✔✔The past internationally accepted set of standards and processes for
information security products evaluation and assurance, which separates function and
assurance requirements
✔✔6 - ✔✔Semiformally verified design and tested
✔✔Memory Management - ✔✔A program in the operating system responsible for
maintaining the hierarchical storage relocation requirements for processes and data
from RAM to hard drives
✔✔Race Condition - ✔✔Processes carry out their tasks on a shared resource in an
incorrect order
✔✔Multi-Processing - ✔✔To execute more than one instruction at an instant in time
✔✔Multi-Processor - ✔✔More than one processor sharing same memory, also know as
parallel systems
A+
✔✔Emanations - ✔✔Potentially compromising leakage of electrical or acoustical
signals.
✔✔Fiber Optics - ✔✔Bundles of long strands of pure glass that efficiently transmit light
pulses over long distances. Interception without detection is difficult.
✔✔Fraggle - ✔✔A Denial of Service attack initiated by sending spoofed UDP echo
request to IP broadcast addresses.
✔✔Hijacking - ✔✔Interception of a communication session by an attacker.
✔✔Hub - ✔✔Layer 1 network device that is used to connect network segments
together, but provides no traffic control (a concentrator).
✔✔Injection - ✔✔An attack technique that exploits systems that do not perform input
validation by embedding partial SQL queries inside input.
✔✔Interception - ✔✔Unauthorized access of information (e.g. Tapping, sniffing,
unsecured wireless communication, emanations)
✔✔IP Address Spoofing - ✔✔Forging of an IP address.
✔✔IP Fragmentation - ✔✔An attack that breaks up malicious code into fragments, in an
attempt to elude detection.
✔✔Kerberos - ✔✔A trusted third party authentication protocol
✔✔Incident response - ✔✔Team should consist of: management, IT, legal, human
resources, public relations, security etc.
,✔✔Modification - ✔✔A type of attack involving attempted insertion, deletion or altering
of data.
✔✔Multiplexers - ✔✔A device that sequentially switches multiple analog inputs to the
output.
✔✔Open Mail Relay Servers - ✔✔A mail server that improperly allows inbound SMTP
connections for domains it does not serve.
✔✔Enticement - ✔✔The legal act of luring an intruder, with intend to monitor their
behavior
✔✔Packet Filtering - ✔✔A basic level of network access control that is based upon
information contained in the IP packet header.
✔✔Patch Panels - ✔✔Provides a physical cross connect point for devices.
✔✔Private Branch Exchange (PBX) - ✔✔A telephone exchange for a specific office or
business.
✔✔Phishing - ✔✔A social engineering attack that uses spoofed email or websites to
persuade people to divulge information.
✔✔Physical Tampering - ✔✔Unauthorized access of network devices.
✔✔Proxies - ✔✔Mediates communication between un-trusted hosts on behalf of the
hosts that it protects.
✔✔Repeaters - ✔✔Layer 1 network device that is used to connect network segments
together, but provides no traffic control (a concentrator).
✔✔Radio Frequency Interference (RFI) - ✔✔A disturbance that degrades performance
of electronic devices and electronic communications.
✔✔Rogue Access Points - ✔✔Unauthorized wireless network access device.
✔✔Routers - ✔✔A layer 3 device that used to connect two or more network segments
and regulate traffic.
✔✔Satellite - ✔✔A specialized wireless receiver/ transmitter placed in orbit that
facilitates long distance communication.
✔✔Sequence Attack - ✔✔An attack involving the hijacking of a TCP session by
predicting a sequence number.
,✔✔Shielding - ✔✔Enclosure of electronic communication devices to prevent leakage of
electromagnetic signals.
✔✔Smurf - ✔✔A Denial of Service attack initiated by sending spoofed ICMP echo
request to IP broadcast addresses. (See Fraggle)
✔✔Sniffing - ✔✔Eavesdropping on network communications by a third party.
✔✔Source Routing Exploitation - ✔✔A vulnerability in IP that allows an attacker to
dictate the path of a communication and thereby access an internal network.
✔✔Spam - ✔✔Unsolicited commercial email
✔✔Switches - ✔✔A layer 2 device that used to connect two or more network segments
and regulate traffic.
✔✔SYN Flooding - ✔✔A Denial of Service attack that floods the target system with
connection requests that are not finalized.
✔✔Tapping - ✔✔Eavesdropping on network communications by a third party.
✔✔Tar Pits - ✔✔Mitigation of spamming and other attacks by delaying incoming
connections as long as possible.
✔✔Teardrop - ✔✔A Denial of Service attack that exploits systems that are not able to
handle malicious, overlapping and oversized IP fragments.
✔✔TEMPEST - ✔✔A codename that refers to the study and mitigation of information
disclosure via electromagnetic emanations from electronic equipment.
✔✔Twisted Pair - ✔✔A simple, inexpensive cabling technology consisting of two
conductors that are wound together to decrease interference.
✔✔War Dialing - ✔✔Reconnaissance technique, involving automated, brute force
identification of potentially vulnerable modems.
✔✔Worldwide Interoperability for Microwave Access (WI-MAX ) - ✔✔A specification for
wireless Metropolitan Area Networks (IEEE 802.16) that provides an alternative to the
use of cable and DSL for last mile delivery.
✔✔Accreditation - ✔✔The managerial approval to operate a system based upon
knowledge of risk to operate
, ✔✔1029 - ✔✔18 USC - Fraud and Related Activity in Connection with Access Devices
✔✔Certification - ✔✔The technical and risk assesment of a system within the context of
the operating environment
✔✔Common Criteria - ✔✔The current internationally accepted set of standards and
processes for information security products evaluation and assurance, which joins
function and assurance requirements
✔✔Covert Channel - ✔✔An unintended communication path
✔✔Data Hiding - ✔✔A software design technique for abstraction of a process
✔✔Embedded - ✔✔Hardware or software that is part of a larger system
✔✔NIDS - ✔✔Usually inspect the header, because the data payload is encrypted in
most cases
✔✔Framework - ✔✔Third party processes used to organize the implementation of an
architecture
✔✔Internet Architecture Board - ✔✔Committee for internet design, engineering, and
management, responsible for the architectural oversight of the IETF
✔✔1024-49151 - ✔✔Registered ports as defined by IANA
✔✔ITSEC - ✔✔The past internationally accepted set of standards and processes for
information security products evaluation and assurance, which separates function and
assurance requirements
✔✔6 - ✔✔Semiformally verified design and tested
✔✔Memory Management - ✔✔A program in the operating system responsible for
maintaining the hierarchical storage relocation requirements for processes and data
from RAM to hard drives
✔✔Race Condition - ✔✔Processes carry out their tasks on a shared resource in an
incorrect order
✔✔Multi-Processing - ✔✔To execute more than one instruction at an instant in time
✔✔Multi-Processor - ✔✔More than one processor sharing same memory, also know as
parallel systems
