Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISM Cert > 3. Information Security Program Development & Management > Flashcards

3. Information Security Program Development & Management Flashcards

1
Q

Name the two common Enterprise Architecture Framework

A

The Open Group Architecture Framework (TOGAF) and the Zachman Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the key elements of TOGAF

A

Business-driven, life-cycle management framework for enterprise architecture

Multiple phases starting with Preliminary, Vision Business Architecture, Technology Architecture, Oppurtunites and solutions, migration planning, governance, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is unique about Zachman Framwork

A

Similar to office building architecture. Starts with high-level and then increasingly detail.

Does not convey the relationship between IT Systems. Data Flow diagrams are used instead.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the components of ISACA’s Risk-IT Framework

A

Risk Governance - includes integrating with organizations ERM

Risk Evaluation

Risk Response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

T or F a vulnerability ranking is influenced by probability of that threat will be realized and the asset value

A

False - a vulnerability ranking should depend on whether the threat will actually bring about harm to the asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

T or F that Asset Value is always the replacement value

A

False - usually but now always

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the financial loss that results from the realization of a threat expressed in percentage of the assets totals value

A

Exposure Factor (EF)

Most threats do not completely eliminate the asset value but instead reduce it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SLE represents what?

A

Single loss expectancy is the value when the threat is realized one time.

AV X EF - SLE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the term for the estimate of the number of times that a threat will occur per year

A

Annual Rate of Occurrence

1 in 10 is 10%
1 in 50 is 2%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ALE is ?

A

Annualized loss expectancy

SLE X ARO = ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is some Risk Analysis Standards

A

NIST 800-30
ISO/IEC 27005

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who is the best person (s) to make a decision on risk treatment

A

Security steering commitee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

T or F being compliant is the same as being secure

A

False
Compliance is a checkbox starting point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is another name for span port

A

Network Tap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the 3 types of controls

A

Physical
Technical
Administrative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are some examples of Preventative Controls

A

Login Screens
Keycard screens
Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are some examples of Detective Controls

A

Video Surveillance
Event Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some examples of Deterrent Controls

A

Guard Dogs
Warning Signs
Visible Video Surveillance

Note: Deterrent controls only work if they are known by potential vioalator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are some examples of corrective controls

A

any act of improving an process when found defective

20
Q

An example of a compensating control

A

Guest Sign in register when there is no stronger detective control such as surveillance

21
Q

An example of a recovery control

A

use of a tool to remove malware or backup software to recover lost or corrupted files

22
Q

What is the purpose of Security Governance

A

Provide management with visibility and control of security program

23
Q

What is a key difference between IPS and Firewalls from an inspection standpoint?

A

IPS inspect full packet while firewalls inspect headers

24
Q

What should be developed first:
Procedures
Standards
Processes
or Policies

A

Policies since they govern behavior in an organization and should be developed first. Then process and procedures that align with policies can be developed. Standards which specific how policies can be implemented can be developed in conjunction

25
Q

What is CISA Cert recognized for

A

Certified Information System Auditor

Experience in Information System Audit and information system protection

26
Q

What is CGEIT

A

Certified in the Governance of Enterprise IT

27
Q

What is CRISC

A

Certified in Risk and Information System control and focused on Risk Management

28
Q

What is CISSP

A

Certified Information System Security Professional is a well known general purpose security cert

29
Q

What is the most effective way to confirm overall compliance with security policies

A

Interview process owners and examine business records

30
Q

What is the primary reason why one-time passwords sent via SMS do not provide physical possession of a trusted device

A

Not as secure as they used to be with the cellular carrier website, and services such as Google Voice.

31
Q

What is CASB specifically designed for?

A

Provide visibility and control into the use of cloud-based services

32
Q

Is the ideal VMP based on scanning first and then patching or ?

A

Best VMP is when system and device patching and hardening are proactively performed according to established SLA’s and security scanning is a QA function

33
Q

What would be a important security related consideration to be included in advance planning for the SSO Portal

A

SAML Integration with applications

the point of SSO is to make authentication to a large number of application and SAML will be required

34
Q

How often does an organization have to verify status of a service provider for PCI DSS

A

annually

Status only no need to audit or verify compliance.

35
Q

How many personnel is needed to cover a 24x7x365 shop with vacation and sick time factored in.

A

12

36
Q

Is it acceptable to allows users to “Test out” of SAT?

A

Yes

37
Q

What is the best method for keeping a program aligned with long term strategy

A

Track and report on milestones

Controls Gap or Risk Analysis is too narrow

IT Steering committee is not the body the security leader is accountable to.

38
Q

Is it an option for a third party to send logs to the larger client if they have deficient log storage and even visability.

A

Yes. known as intrusive monitoring and is an acceptable business practice

39
Q

For PCI-DSS in relation to POS do you need to examine all systems for hardening to be compliant

A

No. You can perform a reasonable sample

40
Q

What is adaptive MFA

A

Using specific critical business or not requiring MFA from known locations

41
Q

If an organization is considering an acquisition of a security tool such as a SIEM what parties will provide functional requirements

A

Security Governance to ensure it meets objective

Security Operation s

IT Operations

Internal Audit

42
Q

Does a SIEM provide any remediation of events

A

No. Correlates events and produces alerts for personnel to investigate and take action

43
Q

What does the term “Identity is the new perimeter”

A

Due to IaaS, SaaS, PaaS, etc firewalls are no longer able to protect resources so tech such as MFA and Biometrics are essential

44
Q

What is the best way a CISO estimate the resources required to support security operations

A

Consult with Industry Analyst and experts to get the best initial estimate.

45
Q
A

CISM Cert (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions