Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Bucket List 1 > Flashcards

Bucket List 1 Flashcards

1
Q

What are some types of key escrow?

A

Dual knowledge, split key, dual key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is OCSP?

A

Online certificate status protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the access controls NIST policy?

A

800-192

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Public/private key, slow, subject to mitm, can provide CI/A

A

Asymmetric Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does a detective security control do?

A

Aids in discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a CA with PKI?

A

Certificate Authority, trusted third party, root authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is an unauthorized wireless router?

A

Rogue AP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Name the wireless authentication types and their encryption standards

A

WEP+RC4, WPA1+TKIP, WPA2+AES-CCMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you secure DNS?

A

DNSSEC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Integrity, detects changes, non-reversible

A

Hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is often the biggest threat?

A

Disgruntled employee, personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a non-water fire suppression chemical?

A

FM-200

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the certificate standard

A

X.509v3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Who creates data, is accountable for the data?

A

Data owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the credential management NIST policy?

A

800-63

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In risk, what is AV?

A

Asset value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the formula for a single loss?

A

AV * EF, asset value times exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What security control will stop an event?

A

Preventative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does AUP stand for?

A

Acceptable use policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does JOA stand for?

A

Joint operating agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In risk, what is ALE?

A

Annual loss expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is multiple defenses called

A

Defense in depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What type of testing is external and potentially harmful

A

penetration testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the SNMP passwords and what are they called?

A

Public/Private and community strings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How far will an ethernet cable successfully carry data?

A

100M

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the difference between due care and due diligence.

A

Due care are actions and approaches that are owed to the customer.

Due diligence is a research and study to ensure due care is properly being taken.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is an RA with PKI?

A

Recovery agent, someone who can get the keys.

Registration authority, someone who registers certs on your behalf.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is EER in encryption?

A

Asymmetric Encryption, El-Gamal, ECC, RSA,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are four written aspects of governance

A

Policy, Procedures, Guidelines, Standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the security controls NIST policy?

A

800-53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the ways to handle risk?

A

Avoid, Mitigate, Accept, Transfer, Ignore

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is used to aid encryption in IPSEC

A

CTR / counter mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Who maintains the infrastructure of the data and is responsible, but not accountable, for the data?

A

Data Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the training NIST policy?

A

800-50

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What does MOU stand for?

A

Memorandum of understanding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the best practices of governance?

A

Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What security control reduces likelihood?

A

Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What does ARP bind?

A

IP to MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What NIST policy is Managing Information Security Risk?

A

800-39

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is X.509v3

A

Certificate standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does EULA stand for?

A

End user license agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the name of the act discussing dual use items

A

Wassenaar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Way to protect Asymmetric Encryption?

A

Initialization Vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Name some data classification types.

A

PII, PHI (or HIPAA), PCI, PIPEDA, GLBA, FERPA, FISMA

45
Q

Static, secret key, same, super fast, problem is key distribution

A

Symmetric Encryption

46
Q

What type of testing is internal and safe?

A

vulnerability testing

47
Q

What are some threat modeling frameworks?

A

STRIDE, VAST

48
Q

What does DNS bind?

A

IP to Hostname

49
Q

Which NIST policy is for applying the risk management framework?

A

800-37

50
Q

What is the repeatable actions portion of governance

A

Procedures

51
Q

What is a way to backup encryption keys?

A

Key escrow

52
Q

What is the categorization NIST policy?

A

800-60

53
Q

What is the formula for the losses expected to occur in a given year?

A

ALE = SLE * ARO

54
Q

How often should you renew, in general?

A

Annually

55
Q

What are the security control frameworks?

A

CRICI - COBIT, RMF (NIST), ISO27001, CSA Star, ITIL

56
Q

What are the types of SOC reports and what do they show?

A

Type 1 - Point in time, type 2 - over time. Type 2 shows effectiveness of process.

57
Q

What is the standard for logging?

A

Syslog

58
Q

What security control is part of a mandate?

A

Directive

59
Q

What is usually the last step in a process?

A

Lessons learned, documentation, follow up

60
Q

What is the wifi standard?

A

802.11

61
Q

What is an attempt to look like a good wifi network, while being malicious?

A

Evil twin

62
Q

What is ARO?

A

Annual rate of occurance, how many times a year a loss will happen.

63
Q

What does a recovery security control do?

A

Helps you get your data back after the fact

64
Q

What is the patch management NIST policy?

A

800-40

65
Q

How do you prevent the disgruntled employee?

A

Thorough background check

66
Q

32BRAIDS-SC

A

Symmetric Encryption, Triple DES, 2Fish, Blowfish, RC4, AES, IDEA, DES, Serpet, Safer, Cast

67
Q

How do you protect hashes

A

Salt

68
Q

MD5, SHA

A

Hash Algorithsm

69
Q

What is the name of a wifi network?

A

SSID

70
Q

Which SOC report is public?

A

SOC 3

71
Q

What is the security testing NIST policy?

A

800-115

72
Q

Name the parts of ALE = SLE * ARO

A

Annual loss expectancy, single loss expectancy, annual rate of occurance

73
Q

What security control is covered by reacting immediately to a situation?

A

Corrective

74
Q

What does NDA stand for?

A

Non disclosure agreement

75
Q

What is the directory services standard?

A

X.500

76
Q

What is DEERI in encryption?

A

Key exchanges, Diffie-Helman, ECC, ElGamal, RSA, IKE

77
Q

What are the specific mandates of governance?

A

Policy

78
Q

In risk, what is SLE?

A

Single loss expectancy

79
Q

In risk, what is EF?

A

Exposure factor

80
Q

What should you always follow?

A

Policy and procedure

81
Q

What is encryption collision called?

A

Key clustering

82
Q

Which SOC report is more focused on IT

A

SOC 2

83
Q

What does a directive security control do?

A

Follows a mandate

84
Q

What does the wassenaar act pertain to

A

dual use items / tech such as encryption and its export

85
Q

Which SOC report is financial in nature?

A

SOC 1

86
Q

What does a compensating security control do?

A

Helps to mitigate existing risk

87
Q

Length of SHA 1

A

160 bit

88
Q

what does NCA stand for?

A

Non compete agreement

89
Q

What is an RA with PKI?

A

Registration authority, broker of keys

90
Q

What are the Risk Frameworks

A

NIIC - NIST, ISO, ISACA, COSOF

91
Q

What does a deterrent security control do?

A

Reduces likelihood

92
Q

What does a corrective security control do?

A

Helps you react to the situation immediately

93
Q

What is X.500

A

Directory Services

94
Q

What is Pharming

A

DNS Hacking

95
Q

How do you separate a network?

A

VLANs

96
Q

What does a certificate contain

A

The digital signature of the CA

97
Q

What is the media sanitization NIST policy

A

800-88

98
Q

What manages certs and keys

A

PKI

99
Q

What security control will get data back?

A

Recovery

100
Q

What is the logging NIST policy?

A

800-92

101
Q

What is the forensics NIST policy?

A

800-86

102
Q

What does SLA stand for?

A

Service level agreement

103
Q

What is a CRL with PKI?

A

Certificate revocation list

104
Q

What security control helps mitigate a vulnerability?

A

Compensating

105
Q

What is the order of “request for” when getting new contracts?

A

RFI > RFQ > RFP

106
Q

What security control will help you discover a breach?

A

Detective

107
Q

What is NIST 800-37?

A

Applying Risk Management Framework (Federal)

108
Q

What is NIST 800-39?

A

Managing Information Security Risk

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions