Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > 1. Security And Risk Management > Flashcards

1. Security And Risk Management Flashcards

1
Q

What is the CIA triad?

A

Confidentiality, Integrity, and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define Confidentiality

A

Only people who need to know, know.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define Integrity

A

Only people who need to access something, can.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define Availability

A

The data is available all the time to people who know about it, and have access to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does AAA stand for?

A

Authentication, Authorization, and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Authentication

A

Proves who you are. Something you; know, do, or are.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define Authorization

A

Actions you can perform after you authenticate your ID.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define Accountability

A

Hold users accountable for their actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Who is ultimately responsible for security?

A

Senior management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define risk assessment

A

Identify assets, threats, and vulnerabilities. General write down of risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define risk analysis

A

Adding number figures for costs of assets that are at risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is OCTAVE?

A

Operationally Critical Threat, Asset and Vulnerability Evaluation.

A risk methodology, where you identify assets and their critically, vulnerabilities, and threats and base a protection strategy off that.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is FRAP?

A

A risk methodology.Facilitated Risk Analysis Process. Qualitative analysis to determine if you should continue with a quantitative analysis. If likelihood is too low, the analysis is forgone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is NIST 800-30?

A

A risk methodology. A risk management made for information technology systems. It has 9 steps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define Qualitative Risk Analysis

A

Subjective analysis to help prioritize probability and impact if risk events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define Quantitative Risk Analysis

A

Providing a $ amount for a single risk event.
More sophisticated in nature, it relies on qualitative analysis to be relevant, but is much more difficult and requires a special subset of skills.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define AV

A

Asset value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define EF

A

Exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define TCO

A

Total cost of ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define SLE

A

Single loss expectancy

SLE = AV x EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define ALE

A

Annual loss expectancy.

ALE = SLE x ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define ARO

A

Annual rate of occurrence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define total risk

A

The risk that exists before any control is implemented.

Total Risk = Threats x vulnerability x Asset Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define residual risk

A

Leftover risk after applying a control.

Residual Risk = Total Risk x Controls Gap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Define Secondary risk

A

When one risk response triggers another risk event.

26
Q

Define Governance

A

Ensures that stakeholder needs, conditions and options are evaluated to determine RISK APPIATITE

27
Q

Define Risk Management

A

Plans, builds, runs and monitors activities in alignment with the direction set by the governance body.

28
Q

What does COBIT stand for?

A

Control Objectives for Information and related Technologies.
It is a governance framework GOAL.

29
Q

What does COSO stand for?

A

Committee of Sponsoring Organizations. It is a governance framework GOAL.

30
Q

What does ITIL stand for?

A

Information Technology Infrastructure Library. It is the defacto standard for the best practices for IT Service Management.

31
Q

What is due diligence?

A

Research. Continually monitoring an organizations practices to ensure they are meeting/exceeding the security requirements.

32
Q

What is due care?

A

Action. Ensuring that “best practices “ are implemented and followed. Follows up due diligence.

33
Q

What is the prudent man rule?

A

Acting responsibly and cautiously as a prudent man would.

34
Q

What is copeable negligence?

A

Essentially; is this your fault?

This is decided based on due care. Have you done the right thing to prevent this?

35
Q

What is the difference between procedures, baselines, standards and guidelines?

A

Procedures, baselines and standards are MANDATORY, guidelines are not mandatory.

Baselines are the bare minimum.

36
Q

What is knowledge transfer?

A

A fancy term for teaching employees about security policies.

37
Q

What is the main international organization ran by the UN, protecting intellectual property?

A

The World Intellectual Property Organization (WIPO).

38
Q

How long do copyrights last?

A

The lifetime of the author plus 70 years, or 75 years for corporations.

39
Q

How long are patents valid?

40
Q

What is Buisness Continuity Planning?

A

Long term over all plan for continuing the organization in case of disruption.

41
Q

What is a disaster recovery plan?

A

Mostly IT focused plan of how to minimize a disasters effects and get the Buisness back up and running.

42
Q

Who can call an event a disaster.

A

Only the BCP Coordinator. But anyone can declare and emergency.

43
Q

What are the three BCP teams?

A

Rescue, recovery and salvage.

44
Q

What are the seven phases of BCP?

A
  1. Project initiation
  2. Buisness impact analysis
  3. Recovery strategy
  4. Plan design and development
  5. Implementation
  6. Testing
  7. Maintenance
45
Q

What is always the #1 priority?

A

Safety and human life

46
Q

What are the phases of BCP step Implementation?

A
  1. Notification/activation- getting word out that something bad has happened.
  2. Recovery/fail over - actions taken by recovery teams to restore IT at an alternative site
  3. Reconstruction/fail back - outlines actions taken to return the system to normal operations.
47
Q

What is a checklist test?

A

Functional manager review of a list for each department

48
Q

What is a structured walkthrough (tabletop) test?

A

All parties sit down at a table and talk through the simulation

49
Q

What is a simulation test?

A

Physically going through a disaster scenario. Continues up to the actual relocation of an offsite facility.

50
Q

What is a parallel test?

A

Systems moved to alternative site, and processing takes place there.

51
Q

What is a full implementation test?

A

Original site shut down. All processing moved to offsite facility.

52
Q

What is a post incident review?

A

A lessons learned meeting. Focus on how to improve. Go over what happened, what should have happened.

Does. It focus on who’s fault it was.

53
Q

What is BIA?

A

Buisness impact analysis. It identifies and prioritizes all Buisness processes based on criticality.

54
Q

What are the BIA metrics to establish?

A
  1. Service level objectives
  2. RPO - recovery point objective
  3. MTD- maximum tolerable downtime
  4. MTBF - mean time between failures
55
Q

What is STRIDE?

A

A threat model.

It is used in assessing threats against applications or operating systems. Developed my Microsoft

56
Q

What does STRIDE stand for?

A 
Spoofing
Tampering
Repudiation
Information disclosure 
Denial of service 
Elevation of privilege
57
Q

What is data ownership?

A

The formal assignment of responsibility to an individual or group.
Often this grants full capabilities and privileges over the object they own.

58
Q

What is the most important and distinctive concept in relation to layered security?

A

Security in series. So that if one fails the next one will stop an intruder.

59
Q

What is data hiding?

A

Preventing data from being discovered or accessed by a subject. Often a key element in security controls as well as in programming.

60
Q

What are the three types of military classified information levels?

A

Confidential
Secret
Top secret

61
Q

What data classification of private sector is used to protect information about individuals?

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions