CISSP (Domain 7 - Operations Security)

Question 1

Operational Assurance

Answer 1

Achieved by performing daily tasks and evaluating their effectiveness through testing

Question 2

4 Steps to Operational Assurance

PI/PE/AH/TR

Answer 2

• Protect Information
  +CIA
  +Balance (Functional Vs. Secure)
  +Enforce Compliance
• Privileged Entities (Administrators)
• Control Access to Hardware
  +Logical
  +Physical
• Trusted Recovery
  +Bring up security controls first

Question 3

10 Administrative Controls

DC/DD/SD/JR/MV/NK/LP/AL/SC/HF

Answer 3

• Due Care
• Due Diligence
• Separation of duties
• Job rotation
• Mandatory vacations
• Need-to-know
• Least privilege
• Invokes authorization levels
• Management software configuration
• Personnel hiring and firing

Question 4

Service Level Agreement (SLA)

Answer 4

The unit of time a vendor will repair a faulty product

Question 5

Mean Time Between Failure (MTBF)

Answer 5

• Expected lifetime of component

- Used to calculate risk of utility failure

Question 6

Mean Time To Repair (MTTR)

Answer 6

Amount of time to get device back into production

Question 7

Redundant Array of Inexpensive Disks (RAID)

Answer 7

Technology used for redundancy and performance improvement

Question 8

RAID Levels

Answer 8

• *Level 0: Striping, written to all drives, no fault tolerance, high performance
• *Level 1: Mirroring
• Level 2: Data striping over all drives at the bit level
• Level 3 Byte level parity
• Level 4: Byte level parity
• *Level 5: Interleave parity - data and parity over all disks

Question 9

2 Advantages of RAID 5

Answer 9

• If one drive fails you still have access to all the data, reconstruction can occur on new drive
• New drive will be rebuilt with parity data (Based on XOR

Question 10

4 Backup Types

Answer 10

• Full backup
• Incremental backup
• Differential backup
• Copy backup

Question 11

Full Backup

Answer 11

• Archive Bit is reset after backup (all bits)

Question 12

Incremental Backup

Answer 12

• Backs up files that have been modified since last backup

- Archive bit is reset (takes 1 and set to 0)

Question 13

Differential Backup

Answer 13

• Backs up files that have been modified since last full backup
• Archive bit is not reset (makes copies of archive bit)

Question 14

Copy Backup

Answer 14

• Archive bit is not reset

- Use before upgrades/system maintenance

Question 15

Network-Based IDS

Answer 15

• Monitors traffic on a network segment
• Computer or network device with NIC in promiscuous mode
• Sensors communication with central management console

Question 16

Host-base IDS

Answer 16

• Small agent program that resides on individual computers

- Detects suspicious activity on one system, not network segment

Question 17

3 IDS Components with Examples

S/AE/MC

Answer 17

• Sensors: Collect raw data and reports data
• Analysis engine: Analyzes for malicious software, reports
• Management console: Alerted about intrusion

Question 18

Signature Based IDS

Answer 18

Contains a database of signatures that continually have to be updated. Cant identify new attacks

Question 19

Behavior Based IDS

Answer 19

Maintains a profile of normal behavior for a better defense against new attacks. Creates many false positives

Question 20

Pattern Matching (Analysis Engine Method)
(RB/SB/KB)

Answer 20

• Rule-based intrusion detection
• Signature-based intrusion detection
• Knowledge-based intrusion detection

Question 21

Profile Comparison (Analysis Engine Method)
(SB/AB/BB)

Answer 21

• Statistically-based intrusion detection
• Anomaly-based intrusion detection
• Behavior-based intrusion detection

Question 22

5 IDS Response Options

Answer 22

• Page or e-mail administrator
• Log event
• Send reset packets to the attacker’s connections
• Change a firewall or router ACL to block an IP address or range
• Reconfigure router or firewall to block protocol being used for attack

Question 23

5 IDS Issues

Answer 23

• May not be able to process all packets on large networks (missing packets)
• Cant analyze encrypted data
• Switch-based networks make it harder to pick up traffic
• A lot of false alarms
• Not an answer to all security issues

Question 24

Honeypot

Answer 24

Loophole added to system on purpose to trap intruders

Question 25

3 Basic Requirements to Penetration Testing

Answer 25

• Defined goal, clearly documented
• Limited timeline outlined
• Approved by senior management

Question 26

Purpose of configuration management

Answer 26

Identifying, controlling, accounting for and auditing changes made to the baseline TCB