Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCSP 2021 > CCSP - All in one deck > Flashcards

CCSP - All in one deck Flashcards

1
Q

Annualized loss expectancy (ALE)

A

The value derived by multiplying the single loss expectancy (SLE) by annualized rate of occurrence (ARO).

ALE = SLE & ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Annualized rate of occurrence

A

An estimated number of the times a threat will successfully exploit a given vulnerability over the course of a single year.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

business continuity management

A

a process that is designed to identify risk, threats, and vulnerabilities, that could disrupt or impact services, with the intent on determining mitigating strategies and response process should they occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

business impact analysis (BIA)

A

A structured methodology to identify and evaluate the possible risk and threats that operations or services could be impacted by

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

cloud application

A

An application that is never installed on a local server or desktop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cloud Application Management for Platforms (CAMP)

A

Within a PaaS implementation CAMP serves as the frameworks and specification for managing services; the model for describing and documenting the components that comprise the platform; and the language for describing the overall platform and its components and services, as well as metadata about it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

cloud backup

A

the process of using a cloud-based back-up system with files and data being sent over the network to a public or private cloud provider for back-up.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

cloud back-up service provider

A

A public or private cloud services organization that offers backup services to either the public or organization clients either on a free basis or using various costing models based on data or systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

cloud back-up solutions

A

services that run within a public or private cloud offering backup solutions, either through client-based software that does automatic or scheduled backups or through manual backups initiated by a user system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

cloud computing

A

a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computer resources that can be rapidly provisioned and released with minimal management effort or service provider interaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Cloud computing reseller

A

An organization that sells and offers cloud services and possible cloud support services to various organizations and works as middleman between the cloud customer and cloud provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Cloud Controls Matrix

A

A formally published guide by the Cloud Security Alliance that enables cloud customers to evaluate a prospective cloud provider in regard to its security posture. The CCM allows cloud providers to structure its security approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Cloud data portability

A

The ability to move data between cloud providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Cloud database

A

a database that is installed in a cloud environment and accessed via the network to the Internet by a user or application. Because the database is being installed in a cloud environment elasticity, scalability and high availability can be achieved and maximized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

cloud enablement

A

The creation of a public cloud environment through the offering of services or infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

cloud management

A

the oversight and operations management of a cloud environment by the cloud service provider whether it is a public or private cloud environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

cloud migration

A

the process of moving services, systems, applications, on dat from a traditionaldata center hosting model into a cloud environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Cloud OS

A

An operating system in a PaaS implementation and signify the implementation within a cloud environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cloud provider

A

A service provider that makes makes storage or software applications available via the internet or provide networks to customers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cloud provisioning

A

the process of allocating cloud resources from the cloud provider to the cloud customers based on specific requests and requirements of the customer as far as the number of virtual machines and their specific computing resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Cloud Security Alliance

A

The most prominent and well-known organization to raise awareness of best practices for security within a cloud environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cloud server hosting

A

The hosting and location of servers within a virtualized cloud environment, rather than the virtual or physical hosting that’s done in a traditional data center.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Cloud service broker

A

a partner that servers as an intermediary between a cloud service customer and a cloud service provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Cloud testing

A

The testing of systems, services, or applications by leveraging cloud platforms and resources to simulate the size and scale of real-world traffic and users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Common Criteria

A

set of international security standards based on ISO/IEC 15408

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Community Cloud

A

A cloud infrastructure provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns. It may be owned, managed , and operated by one or more of the organizations in the community or some combination of these and it may exist off premises.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Container

A

A software packaged that contains all the code, configurations, and libraries needed for an application to operate, packaged inside a single unit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Cross-site scripting (XSS)

A

Security vulnerability found with web applications where an attacker can inject client-side scripts into web pages that are then viewed and executed by other users. The goal of XSS from an attacker’s perspective is to bypass the security controls of an application such as an access control with a same origin policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data at rest (DAR)

A

Data that resides on a system in a persistent storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Data dispersion

A

cloud storage where data is spread across data centers or wide geographic areas for redundancy and speed. The degree of dispersion is typically based on the needs of the application and the level of service procured by the cloud customer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

data in transit

A

data that flows over a networked connection either through public unsecured networks or internal protected corporate networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

data in use

A

data within a system or application that is currently being processed or in use. Either by the application or in memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

direct identifers

A

information that specifically applies to a unique individual (name, address, email, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Distributed resource scheduler

A

a utility from VMware that balances computing demands and available resources within the virtualized environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Dynamic application security testing (DAST)

A

testing of an application while it is in an operational state with currently running systems, applications, and networks

36
Q

dynamic optimization

A

The process of moving and reallocating virtual machines and resources within a cluster environment to maintain optimal performance with balanced and distributed resource utilization.

37
Q

Eucalyptus

A

Free and open source software for utilizing Aws to build public and private cloud offerings. Elastic Utility Computer architecture for linking your programs to useful systems

38
Q

Federal Rules of civil procedures

A

set of rules and procedures that govern civil legal proceedings in the US federal courts to provide uniformity and efficiency in resolving legal matters and proceedings.

39
Q

Federal rules of evidence

A

Set of rules that apply to US federal courts for collecting evidence in a uniform and official manner.

40
Q

FIPS 140-2

A

Security standard published by the US federal government that pertains to the accreditations of cryptographic modules.

41
Q

Hashing

A

taking data of arbitrary type, length, or size and using a mathematic function to map the data to a value that is of a fixed size. Hashing can be applied to virtually any type of data object.

42
Q

Host Intrusion Detection System (HIDS)

A

host-based intrusion detection system that monitors the internal resources of a system for malicious attempts.

43
Q

Hypervisor

A

virtual machine manager that allows and enables multiple virtual hosts to reside on the same physical host.

44
Q

Identity Provider (IdP)

A

A system responsible for determining the authenticity of a user or system providing assurance to a service that the identity is valid and known and possibly providing additional information about the identity of the user system to the service provider requesting it.

45
Q

IDS

A

device, appliance, or software that monitors servers systems or networks for malicious activities.

46
Q

Information rights management (IRM)

A

a subset of digital rights management that is focused on protecting sensitive information from unauthorized exposure or use.

47
Q

Intrusion prevention system

A

network-based appliance or software that examines network traffic for know exploits or attempts to use exploits and actively stops them or blocks attempts.

48
Q

Mean time between failures

A

a measure, of what the average time between failures is for hardware component to determine its reliability.

49
Q

measured service

A

Cloud services that are delivered and billed for in a metered way.

50
Q

mobile cloud storage

A

cloud based storage that enables the user to access their data from any network location and across multiple devices.

51
Q

mobile device management (MDM)

A

term for a suite of policies, technologies, and infrastructure that enables an organization to mange and secure mobile devices that are granted access to its data cross a homogenous environment.

Software typically installed on mobile devices that allow for security configurations and policies to be enabled.

52
Q

mulittenancy

A

having multiple customers and applications running within the same environment but in a way that they are isolated from each other and not visible to each other while still sharing the same resources.

53
Q

network security group

A

set of rules that can be applied to network resources for processing and handling of network traffic.

Rules include: filter traffic based on direction of traffic flow, source address, destination address, ports of both source and destination and the protocols being used.

54
Q

Network intrusion detection system

A

network-based device placed at strategic places on a network to monitor and analyze all network traffic traversing the subnet and comparing it against signatures for known vulnerabilities and attacks.

55
Q

NIST 800-53

A

Security and Privacy Controls for Federal Information Systems and Organizations - security controls for all systems under US federal government

56
Q

nonrepudiation

A

the ability to confirm the origin or authenticity of data to a high degree of certainty.

57
Q

object storage

A

storage method used with IaaS where data elements are managed as objects rather than in hierarchical storage with a file system and directory structure

58
Q

Open Group Architecture Framework

A

An open enterprise architecture model that is intended to be a high-level approach that design teams can use to optimize success, efficiency, and returns throughout a system life cycle.

59
Q

Operational level agreement (OLA)

A

AN official ITIL term that relates to a specialized service level agreement 9SLA) pertaining to internal parties of an organization.

60
Q

Privacy level agreement

A

Declaration published by the cloud service provider documenting its approach to data privacy. The PLA is implemented by the cloud service provider.

61
Q

Recovery point objective (RPO)

A

duration of time in the past that an organization is willing to revert to in order to restore lost data or services following an interruption

62
Q

recovery time objective (PTO)

A

defined maximum time duration for which an organization can accept the loss of data or services following an interruption.

63
Q

relying party

A

a system or application that provides access to secure data through the use of an identity provider.

64
Q

Representational State Transfer (REST)

A

A system for designing and implementing network applications by utilizing a stateless, cacheable, client-server protocol via HTTP

65
Q

Resource pooling

A

Aggregation and allocation of resources from the cloud provider to serve the cloud customers

66
Q

Reversibility

A

Ability of a cloud customer to recover all data and applications from a cloud provider and completely remove all data from the cloud provider’s enviroment.

67
Q

Runtime application self-protection (RASP)

A

Security technology and systems integrated into a system or application that enables it to detect and prevent attacks in real-time.

68
Q

Sandboxing

A

segregation and isolation of information or processes from others within the same system or application, typically for security concerns.

69
Q

Sherwood applied business security architecture (SABSA)

A

proven methodology for developing business-driven, risk and opportunity-focused security architectures at both enterprise and solution levels that traceably support business objectives.

Widely used for information assurance architectures and risk management frameworks as well as to align and seamlessly integrate security and risk management into IT architecture methods and frameworks. SABSA is composed of a series of integrated frameworks, models, methods, and process and can be independently or as a holistic integrated enterprise solution.

70
Q

Simple object access protocol (SOAP)

A

messaging protocol that is operating system agnostic and used to communicate with other systems through HTTP and XML.

71
Q

Single Loss Expentancy

A

The monetary value assigned to the occurrence of a single instance of risk or exploit to an IT service, application or system.

72
Q

Service Oriented Architecture (SOA)

A

a system of providing IT applications and data service to other components through communication protocols over a network independent of any particular technology, system, provider, or implementation.

73
Q

Software Defined Networking (SDN)

A

approach to separate the network configurations for the control plane and the data plane. This allows an abstraction for network administrators to configure and control those aspects of the network important to modern systems and applications without having to get involved with the actual mechanisms for forwarding network traffic.

74
Q

SQL injection

A

a method used by malicious actors to insert SQL statements into a dat-driven application in various input fields attempting to get the application to access arbitrary code and return the results to the attacker.

This could include attempts to access a full database or protect data within it or to modify or delete data.

75
Q

static application security testing (SAST)

A

Security testing of applications by analysis of source code , binaries, and configurations. This is done by testers who have in-depth knowledge of systems and applications and is performed in a non-running state environment.

76
Q

Tokenization

A

process of replacing and substituting secure or sensitive data in a data set with an abstract or opaque value that has no use outside of the application.

77
Q

Trust zones

A

a security concept of separating systems and data into different levels or zones and applying security methods and practices to each zone based on the requirements of that particular group of systems.

78
Q

underpinning contract (UC)

A

a contract negotiated and agreed upon between an organization and an external service provider or vendor.

79
Q

vertical cloud computing

A

the optimization of cloud computing resources for a particular stack or vertical such as a specific type of application or system or by a particular industry or sector need.

80
Q

virtual host or virtual machine

A

computing environment that is a software implementation running on a host system versus a physical hardware environment.

81
Q

VM based rootkit (VMBR)

A

type of root kit hat is installed in a virtualized environment between the underlying host system and the virtual machine. it is then executed and used when the virtual machine is started. a VM based root kit is very difficult to detect in an environment but also very difficult to successfully implement.

82
Q

Volume storage

A

a more typical or standard file system used with Iaas that provides a virtual partition or hard disk to a virtual machine and can be used as a traditional drive would be.

83
Q

web application firewall (WAF)

A

An appliance or software plugin that parses and filters HTTP traffic from a bowser or client and applies a set of rules before the traffic is allowed to proceed to the actual application server.

84
Q

XML apliance

A

An appliance that is implemented within a network to secure and manage XML traffic. TI is particularly used within a cloud environment to help integrate cloud-based systems with those still residing in traditional data centers.

85
Q

XML external entity

A

occurs when a developer has in their code a reference to data on the application side, such as a database key, the directory structure of the application, configuration information about the hosting system or any other formation that pertains to the workings of the application that should not be exposed to users or the network.

CCSP 2021 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions