Al's Cissp Flashcards
An Electrical provider must maintain documentation of their electronic security perimeter in precisely the way set forth in the North American Energy Reliability Corporation (NERC) Critical Infrastructure Protection documents, particularly CIP-005-1, or face significantly daily fines. What is this an example of?
Standards
Baselines
Practices
Policies
Standards
A Standard is non-negotiable. It must be followed to the fullest extent. A Baseline is a minimum configuration that is required across all of an organization’s technology.
Which of the following terms refers to a security hole that could result in an attack on a system?
Risk
Exposure
Threat
Vulnerability
Vulnerability
A ‘vulnerability’ refers to a security hole that can potentially be tapped, resulting in an attack. It is not that an attack has been made, just that the possibility exists. If an attacker uses a vulnerability then it is said to have been “exploited.”
Before Joan can begin work at her new job, she must undergo a Criminal Background Check and participate in Security Awareness Training. What type of control are these preventative measures?
Technical Controls
Administrative Controls
Physical Controls
Resident Control
Administrative Controls
Administrative controls are preventative in nature and include background checks, drug testing, security training on the Human Resources side, and also include policies, procedures, and data classification.
After risks are mitigated, what is the amount of risk remaining called?
Annualized Loss Expectancy
Single Loss Expectancy
Residual Risk
Exposure Factor
Residual Risk
After a Risk Analysis is performed, controls may be implemented. The risk that remains and is not mitigated by the controls is called Residual Risk.
Which of the following has the highest potential to be a security hazard to a company that has well-defined security procedures.
An employee who performs critical duties is fired.
The Information Security Officer falls ill.
Grid power is lost for 3 hours
A web server containing employee performance data crashes.
An employee who performs critical duties is fired.
Among these choices, the greatest risk is from an employee performing critical duties being fired. He may be in a position to compromise the security if he is disgruntled and wants to ‘get back’. The other situations will be handled well since the company has a well-defined security procedures in place.
Senior management plans to implement a security policy that outlines what can and cannot be done with employees’ e-mail for monitoring purposes and to address privacy issues. What would such a security policy be called?
Advisory
Issue-specific
System-specific
Organizational
Issue-specific
Issue-specific policies are also called functional implementing policies. They address specific issues that management feels needs more explanation and attention.
Which of the following denotes the magnitude of potential losses due to a threat?
Risk
Exposure
Vulnerability
Loss
Exposure
Exposure is the magnitude of losses a potential vulnerability may cost an entity, if exploited by an agent of threat.
Which of the following contains general approaches that also provide the necessary flexibility in the event of unforeseen circumstances?
Policies
Standards
Procedures
Guidelines
Guidelines
Guidelines are general approaches and provide the necessary flexibility to handle emergencies. Guidelines may also be certain recommended approaches / actions to handle certain scenarios.
Non-enforced password management on servers and workstations would be defined as a:
Risk
Threat Agent
Vulnerability
Threat
Vulnerability
A vulnerability is a S/W, hardware, or procedural weakness that could be easily exploited by an attacker. Non-enforced password management on servers and workstations is a vulnerability.
Information such as data that is critical to a company needs to be properly identified and classified. In general, what are the guidelines to classify data?
Classify all data irrespective of format (digital, audio, video) excluding paper.
Classify only data that is digital in nature and exists on the company servers.
Classify all data irrespective of the format it exists in (paper, digital, audio, video)
Classify only data that is digital in nature and exists on the company servers, desktops and all computers in the company.
Classify all data irrespective of the format it exists in (paper, digital, audio, video)
It might appear that one only needs to classify “digital data”. However, all data needs to be classified, irrespective of the format in which it exists.
In a secure network, personnel play a key role in the maintenance and promotion of security procedures. Which of the following roles is responsible for ensuring that the company complies with software license agreements?
Product-line manager
Process owner
Solution provider
Data analyst
Product-line manager
Product-line managers are responsible for ensuring that license agreements are complied with. They are also responsible for translating business objectives and specifications for the developer of a product or solution.
Once risk assessment of a company is performed, threats and vulnerabilities are identified and the total / residual risk is determined. Which of the following is not one of the ways in which risk is handled?
Risk Inference
Risk Mitigation
Risk Acceptance
Risk Avoidance
Risk Inference
Risk Inference is not a valid way to handle Risk. Risks are usually dealt with in four ways - risk mitigation, risk avoidance, risk transference and risk acceptance.
Which of the following statements is not true with respect to the relationships between threat, vulnerability, exposure, countermeasure and risk?
A threat agent takes advantage of a vulnerability.
The probability of a fire causing damage is a risk.
A countermeasure can mitigate a vulnerability.
A vulnerability can expose a system to possible damage
A countermeasure can mitigate a vulnerability.
A countermeasure usually mitigates a risk and not a vulnerability. A vulnerability is just the potential possibility that a risk may occur.
The AIC triad is made up of three main principles of information security: availability, integrity and confidentiality. Which of the following threats can compromise data integrity?
Viruses
Social engineering
Viruses
Data integrity is compromised when it is modified by an unauthorized person or program and the accuracy of the data is no longer certain. Since a virus is able to alter system files and data, it can compromise data integrity.
Which of the following norms governs how banks can protect themselves and prevent themselves from overextending / becoming insolvent?
Basel II
International Banking Act
The Bank for International Settlements came up with a system by which banks could prevent themselves from overextending / becoming insolvent. This is known as Basel II Accord. Information security is a key part of the guidelines.
Key stroke logging, shoulder surfing, and social engineering are methods for thwarting which of the information security principles?
Confidentiality
Integrity
The confidentiality of data is breached when unauthorized parties access it. Confidentiality breaches may be intentional by methods such as shoulder surfing or social engineering to gather passwords, or unintentional such as by failing to encrypt data while it is at rest or in transit.
Data on a server has been compromised due to a hack into the system. A forensic investigator needs to copy the data on a hard disk on the server. Which of these will be the first step to be performed as part of the process?
Ensure that a bit-level copy is performed sector by sector, using a specialized tool.
Ensure that the new media into which the hard disk is being copied is properly purged.
Ensure that the new media into which the hard disk is being copied is properly purged.
Among the given choices, the first step to be performed is to purge the new media completely before copying the hard disk contents. There have been instances where the media has contained prior information and was considered inadmissible in courts.
Company Z’s systems are infected due to a virus attack through the network systems of company Q. If company Z sues company Q, this would be termed as:
Downstream liability
Upstream liability
This is termed as downstream liability. It is an important reason for companies to take proper precautions and protect their networks and systems.
An attack occurred on a computer network system and some data was compromised. If the company proceeds to court and initiates action against the attacker, which of the following people can testify and present their opinion of the case?
The security officer
An expert witness
An expert witness
In a court of law, the opinion rule applies. As a result, witnesses may only state facts pertaining to an issue and not their opinion. Only expert witnesses, who are considered subject matter experts, may testify and present an opinion of the issue.
Although the terms event and incident are often used interchangeably, they are different. Which of the following statements is incorrect in this context?
An incident may have a positive or a negative impact on the company.
An event is a negative occurrence that can be observed, verified and documented.
An incident may have a positive or a negative impact on the company.
An event is a negative occurrence that can be observed / verified / documented whereas an incident is a series of events that negatively affects the company. Virus, insider and terrorist attacks are incidents.
Which of the following is a benefit of job rotation?
Fraud Prevention
Job Rotation
Build skill redundancy
Cross training
All of the options
All of the choices listed are benefits of job rotation. Job rotation reduces the risk of fraud by reducing the risk of collusion between two individuals. Rotating individuals out of jobs helps build skill redundancy and cross training.
Reducing or eliminating risk is accomplished by implementing which of the following?
Countermeasures
A risk management policy
Countermeasures are safeguards that are put in place to reduce or remove a potential risk. Countermeasures include virus scanning software, firewalls, mantraps, and badge readers.
A hacker hacked into a system to access confidential data in an unauthorized manner. In order to prevent being tracked, he manually changed the IP address on the packets to show a different IP address than the actual one. This is called:
IP masking
IP spoofing
IP spoofing
This is called IP spoofing. Attackers spoof their IP addresses so that it becomes difficult, if not impossible for the victim to track them down.
A credit card company has revamped its internal team structure. Earlier, an informal structure existed, but the new structure now houses an information security department. Ideally, to whom should this department report?
CIO
CISO
CEO
The CEO
A credit card company has high security needs. Ideally, in such an organization the information security department should report to the CEO directly. This minimizes message filtering and enhances communication. This also sends out a strong signal that the company values information security.
As part of the business impact analysis, individual threats are identified and loss criteria are applied. Which of the following is an incorrect criterion while considering business impact due to a potential disaster?
Decrease in operational expenses.
Loss of reputation
Decrease in operational expenses. When a disaster strikes, the operational expenses will most likely increase rather than decrease. All the other choices are correct and need to be included as part of loss criteria.
