Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > 1 - Security Governance Through Principles and Polcies > Flashcards

1 - Security Governance Through Principles and Polcies Flashcards

1
Q

CIA Triad

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Confidentiality

A

Objects are not disclosed to unauthorized subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Integrity

A

Objects retain their veracity and are intentionally modified by authorized subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Availability

A

Authorized subjects are granted uninterrupted access to objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Identification

A

Process to establish an identity and accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Authentication

A

Process of verifying or testing that a claimed identity is valid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

AAA

A

Authentication
Authorization
Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Authorization

A

Activity, access, rights, or privileges are granted to to an authenticated identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Auditing

A

Monitoring subjects to be held accountable for their actions while authenticated on a system
Detecting unauthorized or abnormal activities on a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the importance of Accountability?

A

Security policies can only be enforced if subjects are held accountable for their actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Nonrepudiation

A

Subject of an activity cannot deny that the event occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the three types of security management planning?

A

Strategic - long term
Tactical - mid term
Operational - short term

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the elements of a security policy structure?

A

Policy
Standards/Baseline
Guidelines
Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Layering

A

Use of multiple controls against security threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Abstraction

A

Collection of similar elements into groups or classes that are assigned security controls/restrictions as a collective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Encryption

A

Hiding meaning or intent of a communication

17
Q

Government/Military classifications

A 
Top Secret
Secret
Confidential
Sensitive unclassified
Unclassified
18
Q

Commercial business/private sector classification levels

A

Confidential
Private
Sensitive
Public

19
Q

COBIT (Control Objectiveness for Information and Related Technology) principles

A 
Meeting Stakeholder Needs
Covering the Enterprise end-to-end
Applying a single, integrated framework
Enabling a holistic approach
Separating Governance from management
20
Q

What are the primary security roles?

A 
Senior Manager
Security Professional
Data Owner
Data Custodian
User
Auditor
21
Q

Separation of duties

A

Dividing critical work tasks among individuals so that no one person can compromise security

22
Q

Principle of least privilege

A

Users should be granted the minimum amount of access necessary

23
Q

Job rotation and mandatory vacation

A

Reduce fraud, theft, misuse of information and audit/verify work tasks

24
Q

SLA (Service level agreement)

A

Define levels of performance, expectation, compensation, and consequences

25
Q

SLA (Service level agreement)

A

Define levels of performance, expectation, compensation, and consequences

26
Q

Third-party governance

A

System of oversight that may be mandated by law, regulation, industry standards or licensing requirements

27
Q

Risk analysis key elements

A

Assets, asset valuation, threats, vulnerabilities, exposure, risk, realized risk, safeguards, countermeasures, attaches, breaches

28
Q

Exposure factor

A

Loss that would be experienced if a specific asset were violated

29
Q

SLE (single loss expectancy)

A

Cost associated with a single risk

SLE = AV * EF

30
Q

ARO (Annualized rate of occurrence)

A

Expected frequency which a specific threat or risk will occur

31
Q

ALE (Annualized loss expectancy)

A

Yearly cost of all instances of a single specific threat against an asset
ALE = SLE * ARO

32
Q

Safeguard

A

Tool or measure to reduce risk
(ALE1 - ALE2) - ACS
ALE before safeguard - ALE after safeguard - Annual Cost of safeguard

33
Q

Delphi technique

A

Anonymous feedback and response process to arrive at consensus

34
Q

Total risk and residual risk

A

Total risk is the amount of risk an organization would face if no safeguards were implemented
Residual risk is risk that management has chosen to accept
Control gap is the amount of risk reduced by safeguard

Total risk - control gap = residual risk

CISSP (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions