Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP (MY CISSP) > 08072017_NewHorizons > Flashcards

08072017_NewHorizons Flashcards

1
Q

An ACL is based on an ________

A

OBJECT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which firewall operates at Layer 3 and 4?

A

Stateful Inspection Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Relationship between GOALS and DOCUMENTS

A 
STRATEGIC = POLICIES
TACTICAL = STANDARDS and GUIDELINES
OPERATIONAL = PROCEDURES and BASELINES
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SLE Single Loss Expectancy formula

A

SLE =AV x EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrity and ______ depend on each other

A

CONFIDENTIALITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

PPP replaced ____

A

SLIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ATM is _____ switching. ATM can use both SVC and PVC.

A

CELL, ATM IS CELL SWITCHING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

PRIVACY LAWS

A

ECPA, FERPA, GLBA, HIPAA, Privacy Act 1974

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A ________ can function or operate as subject or objectt

A

PROCESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Frame Relay is a packet switching technology that uses ______.

A

PVC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

3 Access Control functions that happen AFTER an incident

A

Recovery Controls -
Corrective Controls - Return to Normal, Restoration, Escort a threat out building.
Detective Controls - IDS, AV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Spiral Mode is

A

Waterfall Model, considered meta-mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A ________list maintains a row of security attributes for each controlled object. This list is the row of an access control matrix

A

CAPABILITIES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DRP is a component of BCP and focuses on _______ processes

A

Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

3D’s, 2C’s, PR

A 
Deterrent
Directive
Detective
Compensating
Corrective
Preventive
Recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

STRIDE is used for

A

Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The maximum allowed ping packet size is ______bytes… PING OF DEATH must be at least ..

A

65,536

Ping of death must be 65,537

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Name a few SQL aggregate functions

A

SUM, COUNT, MIN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is essential to determine weakness or effectiveness of CONTROLS

A

Monitoring and Measuring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Documentation: Required implementation or use of tools

A

STANDARD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The maximum tolerable downtime (MTD) is equivalent to the …

A

recovery time objective (RTO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DREAD is used to determine ________ of _______

A

Impact of threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

High Level overarching statement of management intentions. Purpose, scope and expectations

A

POLICY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ARP happens at Layer ___

A

3, Network Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Offshoot of impersonation. Uses eavesdropping. This replays captured traffic.

A

REPLAY ATTACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

BCP Project Management

A 
Initiate BCP Project
Define Scope and Plan
Perform BIA
Test 
Maintain the plan
Implement Plan when DR strikes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

This virus modifies their own code as they travel from system to system

A

POLYMORPHIC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Documentation: step by step to implement a system or process

A

PROCEDURES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

_________ access control type limits physical access

A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Firewall that operates at Layer 3, examines data from message header.

A

Static Packet Filtering Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

DREAD - D’s stand for

A

Damage and Discoverability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Bimometric One to One

A

AUTHENTICATION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Residual Risk

A

Risk that remains after controls are in place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

A RISK is..

A

A likelihood of a threat occurring as well potential to damage of assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Attack that targets 2 ROUND ENCRYPTION SUCH AS DOUBLE DES.

A

Meet in the Middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which layer do these occur in? PPTP, L2F, and L2TP

A

Layer 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

STRIDE - E stands for

A

Elevation of Priv

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

STRIDE - T stands for

A

Tampering with Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Access Control that permits an OWNER or CREATOR of an object to control and define accessibility

A

DISCRETIONARY Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

ARO Annual Rate of Occurrence Formula

A

ARO = event number/year. If flood occurs 1 every 10yrs, 10%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

This methodology uses multiple iterations of the waterfall model, it is also considered a meta-mode..

A

Spiral model

42
Q

Goal that is 3-5 years. Establish Security Policies and Ensure ALL users understand responsibilities

43
Q

What Privacy Law protects employees without notifying them?

44
Q

DREAD - E stands for

A

Exploitability

45
Q

Dynamic testing technique that provides many different types of input to software to stress test.

A

FUZZ TESTING

46
Q

Flight Time is

A

time between key presses.

47
Q

Keyword for DETECTIVE ACCESS CONTROL. Examples?

A

Detect or DISCOVER. CCTV, Security Cameras, Audit Trail,

48
Q

Formula for SLE and ALE

A 
SLE = AFV x EF
ALE = SLE x ARO
49
Q

Frame Relay is ____ switching

A

PACKET SWITCHING

50
Q

In a ______ security mode system, there is no requirement that all users have appropriate clearances

51
Q

Goal that is 6-18 months. Example: Implement DR or CRM

52
Q

A condition that leaves the system and assets open to harm

A

Vulnerability

53
Q

Examples of DUE CARE

A

TRAINING, PRUDENT PERSON rule

54
Q

How to prevent a REPLAY ATTACK

A

One-Time authentication and Sequencing Session Identification

55
Q

The Challenge Response Protocol is a _______ _______

A

AUTHENTICATION PROTOCOL

56
Q

Risk Management Frameworks

A

ISACA Risk IT
ISO 31000
COSO Enterprise Risk Management Framework
NIST Risk Management Framework

57
Q

__________access controls DISCOURAGES you from violating a security violation

58
Q

ALE Annual Loss Expectancy formula

A

ALE =SLE x ARO

59
Q

ISAKMP: Internet Security Association and Key Management Protocol (ISAKMP) provides background security support services for ____

60
Q

This ACCESS CONTROL enforces SYSTEM WIDE restrictions

A

NONDISCRECTIONARY

61
Q

What Privacy Law protects individuals of Financial Institutions?

62
Q

3DES effective key length ____ bit

63
Q

_______ is almost always the right answer on the exam

64
Q

I R D MO - CMM. Which stage uses “FORMAL DOCUMENTED SW Development Processes”?

A

DEFINED D= DOCUMENT

65
Q

The primary purpose of change management is to _________ ______ ______ _______.
However, it is true that the overall goal of change management is to ____ _____ ______ _____..

A

PURPOSE: allow management to review all changes
GOAL: prevent unwanted reductions to security

66
Q

Examples of Resolution Attacks

A

DNS Poisoning and DNS Spoofing

67
Q

3 Policy Types

A

ADVISORY
INFORMATIVE
REGULATORY

68
Q

_______ removes virus but does NOT REPAIR

69
Q

Frame Relay operates at Layer __

70
Q

Information Flow Models are designed to

A

Prevent unauthorized, insecure or restricted information flow often between security levels

71
Q

In a ______ attack an attacker fragments traffic in a w ay that data packets cannot be put together

72
Q

_________ access control type covers personnel security, risk management, training

A

Administrative

73
Q

_________ access control type in the form of SW or HW

A

Logical Technical

74
Q

An electronic access control (EAC) lock comprises three elements:

A

1) an electromagnet to keep the door closed,
2) a credential reader to authenticate subjects and to disable the electromagnet, and
3) a door-closed sensor to reenable the electromagnet.

75
Q

___________ access control to STOPS or THWARTS you from doing it

A

PREVENTIVE

76
Q

STRIDE was developed by ________ and is used to asses threats against __________ or ________.

A

Microsoft, Applications or OS’s.

77
Q

an Asset is anything of _____ that could be compromised

78
Q

EF Exposure Factor.

A

% of value loss

79
Q

What Privacy Law protects students?

80
Q

Biometric One to Many

A

IDENTIFICATION

81
Q

BCP focuses on the _______ processes

82
Q

What is used to avoid, mitigate or counteract a security risk?

83
Q

STRIDE -

A 
Spoofing
Tampering Data
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
84
Q

_______ removes virus and repairs damage

85
Q

5 steps to RISK ANALYSIS PROCESS

A

1) Asset Identification - What are assets and what are they worth?
2) Vulnerability Assessment - Where are we lacking?
3) Threat Assessment -What threats will exploit the vulnerability?
4) Risk Assessment- Quantitative and Qualitative.
5) Financial Impact Evaluation

86
Q

ATM use fixed length cells and has the following benefits

A

HIGH THROUGPUT, EFFICIENT

87
Q

This ROLE backs up data and implements access control based on data owners specifications

A

DATA CUSTODIAN

88
Q

2 Peer Auditing techniques

A

Mandatory Vacations

Job Rotation

89
Q

Risk Responses (4). Example for driving a car Risk.

  • Stay home
  • Seat Belt, Airbag
  • Get insurance
  • Decide to start driving
A

Avoidance - Stay home
Mitigation - Seat Belt
Transfer - Insurance
Acceptance - Decide to start driving

90
Q

STRIDE - D stands for

A

Denial of Service

91
Q

Examples of DUE DILIGENCE

A

BACKGROUND CHECK, TEST BACKUPS, RISK ASSESSMENTS

92
Q

RISK FORMULA ______ X ______ X

A

THREATS x VULNERABILITIES or

LIKELINESS x IMPACT

93
Q

ATM is fragmented communication using ____ byte cells.

94
Q

This ROLE will CLASSIFY THE DATA, DETERMINE LEVEL OF ACCESS

A

DATA OWNER

95
Q

ISC 2 Code of Ethics

A

PROTECT Society and Common Good, Public Trust.

ACT Honorably

PROVIDE dlligence to service.

IMPROVE and protect profession

96
Q

Cost / Benefit Formula

A

(ALE1 - ALE2) - CM

97
Q

Practicing activities in DUE CARE is..

A

DUE DILLGENCE

98
Q

STRIDE - S Stands for

A

Spoofing of user identity

99
Q

DREAD rate threat impact, goes beyond HIGH/MEDIUM LOW

A 
Damage
Reproducibility
Exploitability
Affected Users
Discoverability
100
Q

Which ROLE protects information on the daily basis?

101
Q

Documentation: ________ are recommendations and suggestions and are NOT required.

A

GUIDELINES

CISSP (MY CISSP) (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions