Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 2 - IS Governance and Risk Management > Flashcards

Chapter 2 - IS Governance and Risk Management Flashcards

1
Q

What are the 3 components that make up the AIC triad?

A

Availability, integrity, and confidentiality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

This type of protection ensures reliability and timely access to data and resources to authorized individuals.

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is upheld when the assurance of the accuracy and reliability of information and systems is provided and any unauthorized modification is prevented?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Strict access controls, intrusion detection, and hashing can combat what types of threats?

A

Attackers (through a logic bomb, virus, or back door) or mistakes by users compromising the integrity of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What ensures that the necessary level of secrecy is enforced at each junction of data processing and prevents unauthorized disclosure?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What should prevail when data resides on systems and devices within the network, as it is transmitted, and once it reaches its destination?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is shoulder surfing?

A

When a person looks over another person’s shoulder and watches their keystrokes or views data as it appears on a computer screen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is social engineering?

A

When one person tricks another person into sharing confidential information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Clustering, load balancing, and a fail-over configuration are examples of which component of the AIC triad?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Hashing, Change Control, Access Control, and software digital signing are examples of which component of the AIC triad?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Encryption for data at rest, encryption for data in transit, and access control are examples of which component of the AIC triad?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a lack of a countermeasure or a weakness in a countermeasure that is in place?

A

A vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a threat?

A

Any potential danger that is associated with the exploitation of a vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the entity that takes advantage of a vulnerability referred to?

A

Threat agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is risk?

A

The likelihood of a threat agent exploiting a vulnerability and the corresponding business impact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is exposure?

A

An instance of being exposed to losses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a countermeasure that is put into place to mitigate (reduce) the potential risk?

A

A control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Control can also be referred to as what 2 other terms?

A

Countermeasure and safeguard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A threat agent gives rise to what?

A

A threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A threat exploits what?

A

A vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A vulnerability leads to what?

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk can damage what?

A

An asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Assets cause what?

A

Exposure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Exposure can be countermeasure by what?

A

A safeguard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A safeguard directly affects what?

A

A threat agent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What 3 main flavors do control come in?

A

1) Administrative
2) Technical
3) Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are some examples of administrative controls?

A

Security documentation, risk management, personnel security, and training.

28
Q

Technical controls are also referred to as what?

A

Logical controls

29
Q

What are some examples of technical controls?

A

Firewalls, IDS, encryption, identification and authentication mechanisms.

30
Q

What are some examples of physical controls?

A

Security guards, locks, fencing, and lighting.

31
Q

What is defense-in-depth?

A

The coordinated use of multiple security controls in a layered approach. A multilayered defense system minimizes the probability of successful penetration and compromise.

32
Q

What are the 6 different functionalities of security controls?

A

Preventative, detective, corrective, deterrent, recovery, and compensating.

33
Q

What is a deterrent?

A

Intended to discourage a potential attacker.

34
Q

What is the preventative control functionality?

A

Intended to avoid an incident from occurring.

35
Q

What is the corrective control functionality?

A

Fixes components or systems after an incident has occurred.

36
Q

What control functionality is intended to bring the environment back to regular operations?

A

Recovery

37
Q

What control functionality helps identify an incident’s activities and potentially an intruder?

A

Detective

38
Q

Which control functionality are controls that provide an alternative measure of control?

A

Compensating

39
Q

What control types are preventative in nature?

A

Administrative, physical, and technical

40
Q

What is security through obscurity?

A

Assuming that your enemies are not as smart as you are and that they cannot figure out something that you feel is very tricky.

41
Q

What is the British Standard 7799 or BS7799?

A

Outlines how an information security management system should be built and maintained.

42
Q

Who took on the task of expanding and standardizing the BS7799?

A

ISO (International Organization for Standardization) and the IEC (International Electrotechnical Commission)

43
Q

What is the ISO/IEC 27000 series?

A

Serves as industry best practices for the management of security controls in a holistic manner within organizations around the world.

44
Q

ISO follows a certain iterative process that is commonly used in business process quality control programs. What is this process called?

A

PDCA - Plan, Do, Check, Act

45
Q

What is an enterprise architecture?

A

Encompasses the essential and unifying components of an organization. It expresses the enterprise structure (form) and behavior (function).

46
Q

What is the difference between a framework and an actual architecture?

A

The framework is a guideline on how to build an architecture that best fits a company’s needs.

47
Q

What does the enterprise architecture attempt to accomplish?

A

Providing an understanding of the entity holistically.

48
Q

Which architecture framework uses a two-dimensional model that uses six basic communication interrogatives (What, How, Where, Who, When, and Why) intersecting with different viewpoints (Planner, Owner, Designer, Builder, Implementer, and Worker) to give a holistic understanding of the enterprise?

A

The Zachman framework.

49
Q

Which enterprise architecture framework has its origins in the U.S. Department of Defense?

A

The Open Group Architecture Framework (TOGAF)

50
Q

TOGAF is a framework that can be used to develop what architecture types?

A

1) Business Architecture
2) Data Architecture
3) Applications Architecture
4) Technology Architecture

51
Q

What is the Architecture Development Method or ADM?

A

This method is an interactive and cyclic process that allows requirements to be continuously reviewed and the individual architectures updated as needed.

52
Q

What are 2 military-oriented Architecture Frameworks?

A

1) Department of Defense Architecture Framework (DoDAF)

2) British Ministry of Defense Architecture Framework (MODAF)

53
Q

What is an enterprise security architecture?

A

A subset of an enterprise architecture and defines the information security strategy that consists of layers of solutions, processes, and procedures and the way they are linked across an enterprise strategically, tactically, and operationally.

54
Q

What security architecture is a layered model with its first layer defining business requirements from a security perspective?

A

Sherwood Applied Business Security Architecture (SABSA)

55
Q

For an enterprise security architecture to be successful in its development and implementation, what 4 items must be understood and followed?

A

1) Strategic Alignment
2) Process Enhancement
3) Business Enablement
4) Security Effectiveness

56
Q

What does strategic alignment mean?

A

The business drivers and the regulatory and legal requirements are being met by the security enterprise architecture.

57
Q

What 3 business systems must work together in a concerted effort to prevent deficiencies and imbalances in the organization?

A

Business, IT, and Security

58
Q

What is the difference between ISMS and a Security Enterprise Architecture?

A

The ISMS outlines the controls that need to be put into place and provides direction on how those controls should be managed throughout their lifecycle. The Enterprise Security Architecture illustrates how these components are to be integrated into the different layers of the current business environment.

59
Q

What means that the core business processes are integrated into the security operating model - they are standards-based and follow a risk tolerance criteria?

A

Business enablement

60
Q

What is process enhancement?

A

Improving processes to increase productivity.

61
Q

Business enablement means “we can do new stuff”, what does process enhancement mean?

A

“We can do stuff better”

62
Q

What is the difference between enterprise architectures and system architectures?

A

A system architecture addresses the structure of software and computing components while the enterprise architecture addresses the structure of the organization.

63
Q

What’s a good analogy when comparing system and enterprise architecture?

A

The solar system. The enterprise view is looking at the entire solar system while the system view is looking at the individual planets.

64
Q

What is CobiT?

A

Control Objectives for Information and related Technology. It is a framework and set of control objectives developed by the Information Systems Audit and Control Association and the IT Governance Institute.

65
Q

CobiT is broken down into what 4 domains?

A

1) Plan and Organize
2) Acquire and Implement
3) Deliver and Support
4) Monitor and Evaluate

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions