Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > 1. Security And Risk Management > Flashcards

1. Security And Risk Management Flashcards

(61 cards)

Start Studying
1
Q

What is the CIA triad?

A

Confidentiality, Integrity, and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define Confidentiality

A

Only people who need to know, know.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define Integrity

A

Only people who need to access something, can.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define Availability

A

The data is available all the time to people who know about it, and have access to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does AAA stand for?

A

Authentication, Authorization, and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Authentication

A

Proves who you are. Something you; know, do, or are.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define Authorization

A

Actions you can perform after you authenticate your ID.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define Accountability

A

Hold users accountable for their actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Who is ultimately responsible for security?

A

Senior management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define risk assessment

A

Identify assets, threats, and vulnerabilities. General write down of risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define risk analysis

A

Adding number figures for costs of assets that are at risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is OCTAVE?

A

Operationally Critical Threat, Asset and Vulnerability Evaluation.

A risk methodology, where you identify assets and their critically, vulnerabilities, and threats and base a protection strategy off that.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is FRAP?

A

A risk methodology.Facilitated Risk Analysis Process. Qualitative analysis to determine if you should continue with a quantitative analysis. If likelihood is too low, the analysis is forgone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is NIST 800-30?

A

A risk methodology. A risk management made for information technology systems. It has 9 steps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define Qualitative Risk Analysis

A

Subjective analysis to help prioritize probability and impact if risk events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define Quantitative Risk Analysis

A

Providing a $ amount for a single risk event.
More sophisticated in nature, it relies on qualitative analysis to be relevant, but is much more difficult and requires a special subset of skills.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define AV

A

Asset value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define EF

A

Exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define TCO

A

Total cost of ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define SLE

A

Single loss expectancy

SLE = AV x EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define ALE

A

Annual loss expectancy.

ALE = SLE x ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define ARO

A

Annual rate of occurrence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define total risk

A

The risk that exists before any control is implemented.

Total Risk = Threats x vulnerability x Asset Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define residual risk

A

Leftover risk after applying a control.

Residual Risk = Total Risk x Controls Gap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Define Secondary risk
When one risk response triggers another risk event.
26
Define Governance
Ensures that stakeholder needs, conditions and options are evaluated to determine RISK APPIATITE
27
Define Risk Management
Plans, builds, runs and monitors activities in alignment with the direction set by the governance body.
28
What does COBIT stand for?
Control Objectives for Information and related Technologies. It is a governance framework GOAL.
29
What does COSO stand for?
Committee of Sponsoring Organizations. It is a governance framework GOAL.
30
What does ITIL stand for?
Information Technology Infrastructure Library. It is the defacto standard for the best practices for IT Service Management.
31
What is due diligence?
Research. Continually monitoring an organizations practices to ensure they are meeting/exceeding the security requirements.
32
What is due care?
Action. Ensuring that “best practices “ are implemented and followed. Follows up due diligence.
33
What is the prudent man rule?
Acting responsibly and cautiously as a prudent man would.
34
What is copeable negligence?
Essentially; is this your fault? This is decided based on due care. Have you done the right thing to prevent this?
35
What is the difference between procedures, baselines, standards and guidelines?
Procedures, baselines and standards are MANDATORY, guidelines are not mandatory. Baselines are the bare minimum.
36
What is knowledge transfer?
A fancy term for teaching employees about security policies.
37
What is the main international organization ran by the UN, protecting intellectual property?
The World Intellectual Property Organization (WIPO).
38
How long do copyrights last?
The lifetime of the author plus 70 years, or 75 years for corporations.
39
How long are patents valid?
20 years
40
What is Buisness Continuity Planning?
Long term over all plan for continuing the organization in case of disruption.
41
What is a disaster recovery plan?
Mostly IT focused plan of how to minimize a disasters effects and get the Buisness back up and running.
42
Who can call an event a disaster.
Only the BCP Coordinator. But anyone can declare and emergency.
43
What are the three BCP teams?
Rescue, recovery and salvage.
44
What are the seven phases of BCP?
1. Project initiation 2. Buisness impact analysis 3. Recovery strategy 4. Plan design and development 5. Implementation 6. Testing 7. Maintenance
45
What is always the #1 priority?
Safety and human life
46
What are the phases of BCP step Implementation?
1. Notification/activation- getting word out that something bad has happened. 2. Recovery/fail over - actions taken by recovery teams to restore IT at an alternative site 3. Reconstruction/fail back - outlines actions taken to return the system to normal operations.
47
What is a checklist test?
Functional manager review of a list for each department
48
What is a structured walkthrough (tabletop) test?
All parties sit down at a table and talk through the simulation
49
What is a simulation test?
Physically going through a disaster scenario. Continues up to the actual relocation of an offsite facility.
50
What is a parallel test?
Systems moved to alternative site, and processing takes place there.
51
What is a full implementation test?
Original site shut down. All processing moved to offsite facility.
52
What is a post incident review?
A lessons learned meeting. Focus on how to improve. Go over what happened, what should have happened. Does. It focus on who’s fault it was.
53
What is BIA?
Buisness impact analysis. It identifies and prioritizes all Buisness processes based on criticality.
54
What are the BIA metrics to establish?
1. Service level objectives 2. RPO - recovery point objective 3. MTD- maximum tolerable downtime 4. MTBF - mean time between failures
55
What is STRIDE?
A threat model. | It is used in assessing threats against applications or operating systems. Developed my Microsoft
56
What does STRIDE stand for?
``` Spoofing Tampering Repudiation Information disclosure Denial of service Elevation of privilege ```
57
What is data ownership?
The formal assignment of responsibility to an individual or group. Often this grants full capabilities and privileges over the object they own.
58
What is the most important and distinctive concept in relation to layered security?
Security in series. So that if one fails the next one will stop an intruder.
59
What is data hiding?
Preventing data from being discovered or accessed by a subject. Often a key element in security controls as well as in programming.
60
What are the three types of military classified information levels?
Confidential Secret Top secret
61
What data classification of private sector is used to protect information about individuals?
Private

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions