Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP (MY CISSP) > 080082017_NewHorizons > Flashcards

080082017_NewHorizons Flashcards

1
Q

3D 2C PR

A

Directive , Detective ,Deterrent,Corrective , Compensate Preventive, Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Risk response

A

Reduce or Mitigate

Reject or Ignore

Assign or Transfer

Accept

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NIST SP 800-34 used for…

A

Business Continuity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

NIST SP 800-34, 7 categories

A

Develop Policy

BIA

Identify Preventive Controls

Develop Recovery Strategies

Develop IT Contingency Plan

Plan for Testing

Plan for Maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

NIST SP 800-34,

7 categories

A 
<p>Develop Policy 
BIA
Identify Preventive Controls
Develop Recovery Strategies
Develop IT Contingency Plan
Plan for Testing
Plan for Maintenance</p>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

<p>DR Testing that "tests alternate facility WITHOUT taking main site offline"</p>

A

<p>Parallel Testing</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

<p>DR Testing that mimics an actual business disruption by SHUTTING DOWN the original site and testing operations at the alternate site</p>

A

<p>Full Interruption Testing</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

<p>DR Testing: Planners and testers walk through the BCP to validate logical workflow of events</p>

A

<p>Walkthrough Testing</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

<p>How often to review BCP</p>

A

<p>Yearly, update when evaluated, update for dept. changes</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

<p>BCP exercise where staff role play from a conference room</p>

A

<p>Tabletop</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

<p>IAAS, PAAS, SAAS examples</p>

A

<p>IAAS - Compute, Storage

SAAS - Email, Security

PAAS - Compute, OS, DB, All-In-One</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Consider doing these 3 things when evaluating a third party for security integration

A

<p>On-site walkthrough

Document Exchange and Review

Process/Policy Review</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ISO 27001

A

FRAMEWORK: information security management system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CMMI (2002)

A

Initial -Chaotic, Dependent on individual success

Repeatable - Can repeat process,Project Management,

Defined - Documentation of standards to be consistent

Managed - Quantitative

Optimize - Continuous improvement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CMMI - i stands for

A

Initial - Chaotic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CMMI - d stands for

A

Defined - Consistent, documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CMMI - o stands for

A

Optimize - Continuous improvement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which Role classifies data?

A

Data Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Two types of classification levels

A

Commercial

Military

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Military Classification levels

A

Top Secret -Gave Damage
Secret - Serious Damage
Confidential - Damage
Unclassified - No damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Commercial Classification levels

A

Confidential

Private

Public

22
Q

NIST SP 800-27

A

Engineering Principles

23
Q

NIST SP 800-14

A

Principle and Practices of Security

24
Q

NIST standards used for design..

A

800-27 - Engineering

800-14 - Practices of Security

25
Q

TCB Trusted Computing Base

A

Hardware

Software

Firmware

26
Q

CPU Modes (2)

A

Supervisor/Kernel State: FULL rights

User/Application State: Non-Priv rights.

27
Q

TCB is mentioned in what publication

A

Dod Standard 5200.28, Orange Book

28
Q

Multitasking

A

Divide Tasks Among Programs

29
Q

What separates TCB with the rest of the system

A

Security Perimeter

30
Q

What is Supervisor/Kernel state

A

This is part of TCB and allows FULL rights to the OS

31
Q

Multiprocessing allows programs to be divided amount multiple ________ cpu’s

A

Physical

32
Q

Nonvolatile Memory

A

HD

33
Q

Primary Storage is

A

RAM

34
Q

Secondary Storage is

A

HD

35
Q

What is TPM?

A

Trusted Platform Module TPM

36
Q

Trust Platform Module TPM has what characteristics?

A

RSA burned in hw

Stores Cryptographic Keys

User must supply with PW or Physical Token

37
Q

Lattice

A

“Higher” and “Lower” levels

Bell Lapadula and Biba

38
Q

Bell Lapadula

A

Confidentiality - Practices NEED TO KNOW

Star - No Write Down
Simple - No Read Up

39
Q

Biba

A

Integrity - Note: Biba and Clark are for Integrity

Star - No Write Up
Simple - No Read Up

40
Q

Clark

A

Integrity - Biba and Clark address Integrity

Uses ACCESS CONTROL SIMPLE

Procedures:
CDI Constrained Data Item, UDI Unconstrained
TP Transformation Procedures
Integrity Verification

41
Q

Graham-Denning

A

Create and Delete objects and subjects

42
Q

Brewer-Nash

A

Addresses Conflict of Interest

Chinese Wall

Requires:

  • Identify Subjects
  • One or More data sets
  • Conflict Class Definitions for data sets
43
Q

Discretionary Access Control

A

Control of their OWN data and can create different access levels

Permission List DACL

44
Q

Mandatory Access Control

A

Only access based on OBJECT classification

Labels

45
Q

Role Based Access Control

A

Instead of adding users add ROLES to access. Similar to SECURITY GROUPS in Windows

46
Q

Rule Based Access Control

A

Sys Admin grants access based on rules.. Example of this is a Firewall

47
Q

TCSEC created in what year

A

1983

48
Q

TCSEC Divisions - Baseline Security, from Rainbow Library

A

A -= Verified
B - Mandatory
C - Discretionary
D - Minimal

A1- Highest - Verified Protection

B3 - Security Domains

B2 - Structured Protection

B1 - Labeled Security Protection

C2 - Controlled Access

C1 - Discretionary protection

D1 - Did NOT MEET requirements

49
Q

ITSec

A

European framework

50
Q

Common Criteria, 7 areas

A

ISO - International

EAL1 - Functionality

EAL2 - Structurally

EAL3 - Methodically Tested and Checked

EAL4 - Methodically Designed, Reviewed

EAL5 - Semi-Formally

EAL6

51
Q

A Reference Monitor in the OS is also called the ______ kernel.

A

Security

CISSP (MY CISSP) (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions