Bucket List 1 Flashcards
1
Q
What are some types of key escrow?
A
Dual knowledge, split key, dual key
2
Q
What is OCSP?
A
Online certificate status protocol
3
Q
What is the access controls NIST policy?
A
800-192
4
Q
What is Public/private key, slow, subject to mitm, can provide CI/A
A
Asymmetric Encryption
5
Q
What does a detective security control do?
A
Aids in discovery
6
Q
What is a CA with PKI?
A
Certificate Authority, trusted third party, root authority
7
Q
What is an unauthorized wireless router?
A
Rogue AP
8
Q
Name the wireless authentication types and their encryption standards
A
WEP+RC4, WPA1+TKIP, WPA2+AES-CCMP
9
Q
How do you secure DNS?
A
DNSSEC
10
Q
Integrity, detects changes, non-reversible
A
Hashing
11
Q
What is often the biggest threat?
A
Disgruntled employee, personnel
12
Q
What is a non-water fire suppression chemical?
A
FM-200
13
Q
What is the certificate standard
A
X.509v3
14
Q
Who creates data, is accountable for the data?
A
Data owner
15
Q
What is the credential management NIST policy?
A
800-63
16
Q
In risk, what is AV?
A
Asset value
17
Q
What is the formula for a single loss?
A
AV * EF, asset value times exposure factor
18
Q
What security control will stop an event?
A
Preventative
19
Q
What does AUP stand for?
A
Acceptable use policy
20
Q
What does JOA stand for?
A
Joint operating agreement
21
Q
In risk, what is ALE?
A
Annual loss expectancy
22
Q
What is multiple defenses called
A
Defense in depth
23
Q
What type of testing is external and potentially harmful
A
penetration testing
24
Q
What are the SNMP passwords and what are they called?
A
Public/Private and community strings
25
How far will an ethernet cable successfully carry data?
100M
26
What is the difference between due care and due diligence.
Due care are actions and approaches that are owed to the customer.
Due diligence is a research and study to ensure due care is properly being taken.
27
What is an RA with PKI?
Recovery agent, someone who can get the keys.
Registration authority, someone who registers certs on your behalf.
28
What is EER in encryption?
Asymmetric Encryption, El-Gamal, ECC, RSA,
29
What are four written aspects of governance
Policy, Procedures, Guidelines, Standards
30
What is the security controls NIST policy?
800-53
31
What are the ways to handle risk?
Avoid, Mitigate, Accept, Transfer, Ignore
32
What is used to aid encryption in IPSEC
CTR / counter mode
33
Who maintains the infrastructure of the data and is responsible, but not accountable, for the data?
Data Custodian
34
What is the training NIST policy?
800-50
35
What does MOU stand for?
Memorandum of understanding
36
What are the best practices of governance?
Guidelines
37
What security control reduces likelihood?
Deterrent
38
What does ARP bind?
IP to MAC
39
What NIST policy is Managing Information Security Risk?
800-39
40
What is X.509v3
Certificate standard
41
What does EULA stand for?
End user license agreement
42
What is the name of the act discussing dual use items
Wassenaar
43
Way to protect Asymmetric Encryption?
Initialization Vector
44
Name some data classification types.
PII, PHI (or HIPAA), PCI, PIPEDA, GLBA, FERPA, FISMA
45
Static, secret key, same, super fast, problem is key distribution
Symmetric Encryption
46
What type of testing is internal and safe?
vulnerability testing
47
What are some threat modeling frameworks?
STRIDE, VAST
48
What does DNS bind?
IP to Hostname
49
Which NIST policy is for applying the risk management framework?
800-37
50
What is the repeatable actions portion of governance
Procedures
51
What is a way to backup encryption keys?
Key escrow
52
What is the categorization NIST policy?
800-60
53
What is the formula for the losses expected to occur in a given year?
ALE = SLE * ARO
54
How often should you renew, in general?
Annually
55
What are the security control frameworks?
CRICI - COBIT, RMF (NIST), ISO27001, CSA Star, ITIL
56
What are the types of SOC reports and what do they show?
Type 1 - Point in time, type 2 - over time. Type 2 shows effectiveness of process.
57
What is the standard for logging?
Syslog
58
What security control is part of a mandate?
Directive
59
What is usually the last step in a process?
Lessons learned, documentation, follow up
60
What is the wifi standard?
802.11
61
What is an attempt to look like a good wifi network, while being malicious?
Evil twin
62
What is ARO?
Annual rate of occurance, how many times a year a loss will happen.
63
What does a recovery security control do?
Helps you get your data back after the fact
64
What is the patch management NIST policy?
800-40
65
How do you prevent the disgruntled employee?
Thorough background check
66
32BRAIDS-SC
Symmetric Encryption, Triple DES, 2Fish, Blowfish, RC4, AES, IDEA, DES, Serpet, Safer, Cast
67
How do you protect hashes
Salt
68
MD5, SHA
Hash Algorithsm
69
What is the name of a wifi network?
SSID
70
Which SOC report is public?
SOC 3
71
What is the security testing NIST policy?
800-115
72
Name the parts of ALE = SLE * ARO
Annual loss expectancy, single loss expectancy, annual rate of occurance
73
What security control is covered by reacting immediately to a situation?
Corrective
74
What does NDA stand for?
Non disclosure agreement
75
What is the directory services standard?
X.500
76
What is DEERI in encryption?
Key exchanges, Diffie-Helman, ECC, ElGamal, RSA, IKE
77
What are the specific mandates of governance?
Policy
78
In risk, what is SLE?
Single loss expectancy
79
In risk, what is EF?
Exposure factor
80
What should you always follow?
Policy and procedure
81
What is encryption collision called?
Key clustering
82
Which SOC report is more focused on IT
SOC 2
83
What does a directive security control do?
Follows a mandate
84
What does the wassenaar act pertain to
dual use items / tech such as encryption and its export
85
Which SOC report is financial in nature?
SOC 1
86
What does a compensating security control do?
Helps to mitigate existing risk
87
Length of SHA 1
160 bit
88
what does NCA stand for?
Non compete agreement
89
What is an RA with PKI?
Registration authority, broker of keys
90
What are the Risk Frameworks
NIIC - NIST, ISO, ISACA, COSOF
91
What does a deterrent security control do?
Reduces likelihood
92
What does a corrective security control do?
Helps you react to the situation immediately
93
What is X.500
Directory Services
94
What is Pharming
DNS Hacking
95
How do you separate a network?
VLANs
96
What does a certificate contain
The digital signature of the CA
97
What is the media sanitization NIST policy
800-88
98
What manages certs and keys
PKI
99
What security control will get data back?
Recovery
100
What is the logging NIST policy?
800-92
101
What is the forensics NIST policy?
800-86
102
What does SLA stand for?
Service level agreement
103
What is a CRL with PKI?
Certificate revocation list
104
What security control helps mitigate a vulnerability?
Compensating
105
What is the order of "request for" when getting new contracts?
RFI > RFQ > RFP
106
What security control will help you discover a breach?
Detective
107
What is NIST 800-37?
Applying Risk Management Framework (Federal)
108
What is NIST 800-39?
Managing Information Security Risk
