Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 1 > Flashcards

Chapter 1 Flashcards

1
Q

{BLANK} ensures that the subject of an activity or who caused an event cannot deny that the event occurred.

A

Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Think - AAA Services

{BLANK} is the security concept that data is authentic or genuine and originates from its alleged source.

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Think - CIA Triad

{BLANK} is the concept of the measures used to ensure the protection of the secrecy of data, objects, or resources.

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

{BLANK} is establishing a plan, policy, and process to protect the interest of an organization.

A

Due Diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

{BLANK} is knowing what should be done and planning for it.

A

Due Diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A {BLANK} defines a minimum level of security that every system throughout the organization must meet.

A

Baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

{BLANK} is reviewing log files to check for compliance and violations in order to hold subjects accountable for their action especially violations of organizational security policy.

A

Accounting (aka Accountability)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

AAA Services is a core security mechanism of all security environments. What are the five elements of AAA services?

A
  • Identification
  • Authenticication
  • Authorization
  • Auditing
  • Accounting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

An {BLANK} is responsible for reviewing and verifying that the security policy is properly implemented and the derived security solutions are adequate.

A

Auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the five key concepts of the decomposition process?

A
  • Trust Boundaries
  • Dataflow Paths
  • Input Points
  • Privileged Operations
  • Detailed about Security and Approach
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

{BLANK} is the collection of practices related to supporting, evaluating, defining, and directing the security efforts of an organization.

A

Security Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Think - CIA Triad

{BLANK} means authorized subjects are granted timely and uninterrupted access to objects.

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

{BLANK} is preventing data from being discovered or accessed by a subject by positioning the data in a logical storage compartment that is not accessible or seen by the subject.

A

Data Hiding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A {BLANK} is the line intersection between any two areas, subnets, or environments that have different security requirements or needs.

A

Security Boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

{BLANK} is practicing the individual activities that maintain the due diligence effort.

A

Due Care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

{BLANK} is doing the right action at the right time.

A

Due Care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A {BLANK} offers recommendations on how standards and baselines are implemented and serves as an operational guide for both security professional and users.

A

Guideline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

{BLANK}, also known as laying, is the use of multiple controls in a series.

A

Defense in Depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the common security roles present in a typical secured environment?

A
  • Senior Manager
  • Security Professional
  • Assest Owner
  • Custodian
  • User
  • Auditor
20
Q

{BLANK} is the system of external entity oversight that may be mandated by law, regulation, industry standards, contractual obligation, or licensing requirements.

A

Third-Party Governance

21
Q

{BLANK} is a risk-centric approach that aims at selecting or developing countermeasures in relation to the value of the assets to be protected.

A

PASTA
(Process for Attack Simulation and Threat Analysis)

22
Q

{BLANK} is the process of reading the exchanged materials and verifying them against standards and expectations.

A

Documentation Review

23
Q

What does the acronym STRIDE stand for?

A
  • Spoofing
  • Tampering
  • Repudiation
  • Information Disclosure
  • Denial of Service (DoS)
  • Elevation of Privilege
24
Q

{BLANK} define compulsory requirements for the homogenous use of hardware, software, technology and security controls.

A

Standards

25
Q

A {BLANK} or {BLANK} is a detailed, step-by-step how-to document that describes that exact actions necessary to implement a specific security mechanism, control, or solution.

A

Procedure; Standard Operating Procedure

25
Q

{BLANK} are typically viewed as the primary goals and objectives of a security infrastructure.

A

CIA Triad

26
Q

The {BLANK} (end user or operator)

A

User

27
Q

Think - AAA Services

{BLANK} is recording a log of the events and activities related to the systen and subjects.

A

Auditing

28
Q

Think - AAA Services

{BLANK} is defining the permissions (i.e., allow/grant and/or deny) of a resource and object access for a specific identity or subject.

A

Authorization

29
Q

The {BLANK} role is assigned to the user who is responsible for the tasks of implementing the prescribed protection defined by the security policy and senior management.

A

Custodian

30
Q

Think - AAA Services

{BLANK} is proving that you are that claimed identity.

A

Authentication

31
Q

Think - AAA Services

{BLANK} is claiming to be an identity when attempting to access a secured area or system.

A

Identification

32
Q

The {BLANK} role is assigned to the person who is responsible for classifying information for placement and proctection within the security solution.

A

Asset Owner

33
Q

The {BLANK} information security (InfoSec) officer or computer incident repsonse team (CIRT) role is assigned to a trained and experienced network, systems, and security engineer who is responsible for following the directives mandated by senior management.

A

Security Professional

34
Q

The organizational owner, {BLANK}, role is assigned to the person who is ultimately responsible for the security maintained by an organization and who should be most concerned about the protection of its assets.

A

Senior Manager

35
Q

{BLANK} is the concept of protecting the reliability and correctness of data.

A

Integrity

36
Q

{BLANK} is use for efficiency. Similar elements are put into groups, classes, or roles that are assigned security controls, restrictions, or permissions as a collective.

A

Abstraction

37
Q

{BLANK} is a documented set of best IT security practices crafted by ISACA. It prescribes goals and requirements for security controls and encourages the mapping of IT security ideals to business objectives.

A

COBIT
(Control Objectives for Information and Related Technology)

38
Q

COBIT is based on six key principles for governance and management of enterprose IT:

A
  • Provide Stakeholder Value
  • Holistic Approach
  • Dynamic Governance System
  • Governance Distinct from Management
  • Tailored to Enterprose Needs
  • End-toEnd Governace System
39
Q

Think - STRIDE

An attack with the goal of gaining access to a target system through the use of a falsified identity. When an attacker spoofs their identitiy as a vaild or authorized entity, they are often able to bypass filters and blockades against unauthorized access.

A

Spoofing

40
Q

Think - STRIDE

Any action resulting in unauthorized changes or manipulation of data whether in transit or in storage.

A

Tampering

41
Q

Think - STRIDE

The ability of an user or attacker to deny having performed an action or activity by maintaining plausible deniability. Repudiation attacks can also result in innocent third parties being blamed for security entities.

A

Repudiation

42
Q

Think - STRIDE

An attack that attempts to prevent authorized use of a resource. This can be done through flaw exploitation connection overloading or traffic flooding.

A

Denial of Service (DoS)

43
Q

Think -STRIDE

An attack where a linited user account is transformed into an account with greater priveleges, powers, and access.

A

Elevation of Privilege

44
Q

Think - STRIDE

The revelation or distribution of provate, confidential, or controlled information to external or unauthorized entities.

A

Information Disclosure

CISSP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions