CISSP

Annual Loss Expectancy

Cardinality

Degree (Database)

NIST 800-42

4 Stages of Pen Testing

Something that can happen to a system

Weakness or hole in security

RAID 0

RAID 1

RAID 5

What class abuse? Unauthorized access by circumventing access controls/masquerading

What class abuse? Unauthorized use of network resources for non-business purpose.

What class abuse? Eavesdropping, tapping, interception of files.

What class abuse? DOS and service disruptions.

What class abuse? Network intrusion, spoofing, etc

What class abuse? Probing

SMURF attack protocol?

Fraggle attack protocol?

LAND attack protocol / flag?

What layer has FTP, Telnet, TFTP, SMTP, HTTP, SNMP?

What layer has JPEG, TIFF, MID?

What layer has NSF, SQL, RADIUS, RPC?

What layer has TCP, UDP, SSL, SSH-2, NetBios?

What layer has IP, IPSEC, ICMP, BGP, OSPF, RIP, BOOTP, DHCP?

What layer has L2F, PPTP, L2TP, PPP, SLIP, ARP, RARP,SNAP, CHAP, LCP, Frame Relay, Ethernet, FDDI, etc?

Telnet port?

FTP ports?

TFTP port?

SMTP port?

SSH port/protocol?

DNS port/protocol?

DHCP port/protocol?

HTTP port/protocol?

POP port/protocol?

Standard LDAP port/protocol?

Encrypted LDAP port/protocol?

Packet filtering firewall generation?

Application Level Firewall / Proxy Server generation?

Stateful Inspection firewall generation?

Dynamic Packet Filtering firewall generation?

Kernel Proxy Firewall generation?

T1 Speed (Mbps)

T3 Speed (Mbps

Network numbers value begin at 1 and end at 127?

Network numbers value begin at 128 and end at 191?

Network numbers value begin at 192 and end at 223?

Max 100Base-TX length in meters?

CIDR for unsubnetted network?

DES key length? (bits)

DES encryption rounds?

How many DES modes?

Based on Rjindael Block Cipher?

AES key lengths?

AES - symmetric or assymetric?

DES - symmetric or assymetric?

RSA - symmetric or asymmetric?

Diffie Hellman - symmetric or asymmetric?

El-Gamal - symmetric or asymmetric?

X.509 Standard common abbreviation?

What is encrypted in IPSEC Transport mode?

What is encrypted in IPSEC Tunnel mode?

MAC Mode: All users can access all data, clearance for all info, need to know for all data

MAC Mode: All users can access some data, clearance for all info, need to know for SOME data?

MAC Mode: All users can access some data, clearance for all info, need approval, need to knowfor SOME data, use of labels?

MAC Mode: All users access some data (based on need to know, approval, clearance), Clearance for accessed data, need to know SOME?

EAL: Inadequate assurance

EAL: Functionally tested

EAL: Structurally tested

EAL: Methodically tested and checked

EAL: Methodically designed, tested and reviewed

EAL: Semi-formally designed and tested

EAL: Semi-formally verified design and tested

EAL: Formally verified design and tested

EAL: Product to be tested (acronym)

EAL: Security properties of TOE

Access control: Uses graph to specify rights subjects can transfer to /take from other subjects, uses STATE and STATE TRANSITION

Access control: No read up, no write down, confidentiality model

Access control: No read down, no write up, integrity model

Access control: Integrity model, enforces segregation, requires auditing, limits access to objects through program

Access control: Chinese Wall model, used for lawyers offices for instance

Baseline of normal activity, used to ignore normal user errors

Two types of covert channels?

Initiating, Repeatable, Defined, Managed, Controlled are phases of what?

Conception, Initiation, Development, Implementation, Testing, Maintenance are phases of what?

Communication to object to perform an action

Code that defines an action an object performs in response to a message

results exhibited by an object in response to a message

collection of methods that defines the behavior of objects

Forwarding request to another object

test