Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SEC+ > Chap 1 > Flashcards

Chap 1 Flashcards

1
Q

What is information security?

A

Protection of data resources from unauthorized access, attack, theft or damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the CIA Triad?

A

Properties of securing information:
- Confidentiality
- Integrity
- Availability
* Non-Repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Confidentiality?

A

Certain information should only be known to certain people.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is integrity?

A

When data is stored and transferred as intended and that any modification is authorized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Availability?

A

Information is accessible to those authorized to view or modify it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Non-repudiation?

A

A subject cannot deny doing something such as creating, modifying or sending a resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the five functions of Cybersecurity task according to NIST?

A
  • Identify
  • Protect
  • Detect
  • Respond
  • Recover
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Identify as a cybersecurity task function?

A

To develop security policies and capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is protect as a function of cybersecurity task?

A

Procure/develop, install, operate and decommission IT hardware and software assets with security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is “detect” as a function of Cybersecurity task?

A

To perform ongoing, proactive monitoring to ensure that controls are effective and capable of protecting against new threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is “Respond” as a function if cybersecurity task?

A

To identify, analyze, contain, and eradicate threats to systems and data security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is “recover” as a function of cybersecurity task.

A

To implement cybersecurity resilience to remote systems and data if other controls are unable to prevent attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a security policy?

A

A security policy is a formalized statement that defines how security will be implemented within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a CSO/CISO

A

Chief Security Officer/ Chief Information Security Officer is the overall authority for internal security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an ISSO

A

Information Systems Security Officer is a dedicated security admin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who as external responsibility for security (due care/liability)?

A

The owner/ director

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

All employees share some measure of responsibility. T/F?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a SOC?

A

A Security Operations Center is where critical information assets are monitored and protected across other business functions such as finance, operations, sales/marking and so on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is DevSecOps?

A

Development Security Operations is a form of development security operations that bridges the gap between developers and system administrators.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a CIRT/CSIRT/CERT?

A

Cyber incident response team, Computer security incident response team, or computer emergency response team is a single point of contact for notification of a security incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a security control?

A

Something designed to make a system or data asset the properties of confidentiality, integrity, availability and non-repudiation.

22
Q

What are the categories of security controls?

A
  • Technical
  • Operational
  • Managerial
23
Q

What is a technical security control?

A

Control implemented as a system (hardware ,software, or firmware).

24
Q

What is an Operational security control?

A

Control implemented primarily by people rather than systems.

25
Q

What is a managerial security control?

A

Control that gives oversight of the information system.

26
Q

What are the security control function types?

A
  • Preventive
  • Detective
  • Corrective
27
Q

What type of security control is Preventive?

A

The control acts to eliminate or reduce the likelihood that an attack can succeed.

ACL (Access Control List) is an example of this.

28
Q

What type of security control is Detective?

A

The control may not prevent or deter access, but it will identify and record any attempted or successful intrusion.

29
Q

What type of security control is Corrective?

A

The control acts to eliminate or reduce the impact of an intrusion event and typically used after the attack.

30
Q

What are other types security functions can be classified as?

A
  • Physical
  • Deterrent
  • Compensating
31
Q

What type of security control is physical?

A

Controls such as alarms, gateways,locks, lighting, security cameras, and guards that deter and detect access to premises and hardware.

32
Q

What type of security control is Deterrent?

A

Control may not physically or logically prevent access, but psychologically discourages an attacker from attempting to an intrusion (i.e. warning signs).

33
Q

What type of security control is Compensating?

A

Control serves as a substitute for a principle control, as recommended by a security standard and affords the same level of protection.

34
Q

What is a CSF?

A

Cybersecurity framework is a list of activities and objectives undertaken to mitigate risk and allows an org to create an objective statement of current capabilities and prioritize investments to achieve a target level.

35
Q

RMF vs CSF

A

Risk Management Framework pre dates the CSF and the CSF forces on practical cybersecurity of businesses while RMF is more prescriptive and principally for federal agents.

36
Q

What is ISO?

A

International Organization of Standards

37
Q

What is ISO 27001,27002, 27017, 27018 and 27701 focus on?

A

27001: Info Sec Management
27002: Classifies Sec Controls
27017 & 27018: Cloud Security
27701: Personal data and Privacy

38
Q

What is ISO 31k?

A

Overall framework for enterprise risk management (ERM) which includes financial, customer service, competition and legal liability.

39
Q

What is CSA?

A

Could Security Alliance produces various resources to assist cloud service providers (CSP) in setting up and delivering secure cloud platforms.

40
Q

What is SSAE?

A

Statements on Standards for Attestation Engagements are audit specifications developed by the American Institute of Certified Public Accountants (AICPA)

41
Q

What levels of reporting are in SSAE No.18?

A

Service Organization Control (SOC2) and SOC3

42
Q

What is the CIS?

A

Center for Internet Security is a not-for-profit org and used to perform an overall evaluation of security posture.

43
Q

Codes that run on the client should not be trusted. T/F?

A

True

43
Q

What is OWASP?

A

Open Web Application Security Project is a not-for-profit, online community that publishes several secure application development resources such as the Top 10 most critical security application risks.

44
Q

What is Due Diligence in reference to Regulation, standards and legislation?

A

legal term meaning that responsible persons have not been negligent in discharging their duties.

45
Q

What does SOX mandate?

A

Sarbanes-Oxley ACT mandates the implementation of risk assessments, internal controls, and audit procedures.

46
Q

What is GDPR?

A

General Data Protection Regulation is a fairness and right to privacy regulation in Europe.

47
Q

What complicates compliance?

A

Laws derive from different sources.

48
Q

What is GLBA?

A

Gramm-Leach-Bliley Act is for financial services, and the Health Insurance Portability and Accountability Act (HIPPA).

49
Q

What is the PCI DSS?

A

Payment Card Industry Data Security Standard and defines the safe handling and storage of financial information.

SEC+ (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions