Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISC2 Certified Cybersecurity > Domain 1 > Flashcards

Domain 1 Flashcards

Security Principles

1
Q

A chief information security officer (CISO) at a large organization documented a policy that establishes the acceptable use of cloud environments for all staff. This is an example of a _____ control.

A

Management/Administrative control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which region enacted comprehensive legislation addressing personal privacy in 2016?

A

European Union

(In 2016, the European Union passed comprehensive legislation addressing personal privacy, deeming it an individual human right)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the purpose of implementing security controls in the risk management process?

A

To mitigate the risk to an acceptable level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

If a pickpocket is a threat, what would be their attack vector?

A

Their technique and approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What term is used to refer to information that, when combined with other pieces of data, significantly narrows the possibility of association with more individuals?

A

Personally Identifiable Information (PII)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How do companies that offer identity theft insurance manage their own financial risk?

A

By calculating premium payments against potential payouts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What potential risk can occur when a remote worker’s laptop is left unattended or unlocked?

A

Accidental introduction of unauthorized software with malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Multifactor authentication involves using two or more instances of different authentication factors.

Which of the following are considered a widely accepted factor for authentication?

A

Something you are, something you know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

While taking the certification exam for this certification, you notice another candidate for the certification cheating.

What should you do?

A

Report the candidate to ISC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In the United States, which act governs the privacy of medical information?

A

HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an “asset” in the context of risk management terminology?

A

Something in need of protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Who is responsible for determining risk tolerance in an organization?

A

Executive management and board of directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What action is suggested to mitigate the risk associated with a threat?

A

Evaluate the likelihood of the event and take appropriate actions to mitigate the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which regulation grants data protection and control to individuals within the EU, regardless of citizenship?

A

General Data Protection Regulation (GDPR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What role might security professionals play in risk assessment at a system level?

A

Assisting in risk assessment at a system level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Who is responsible for identifying risks within an organization?

A

Employees at all levels of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Procedures are

A

the detailed steps to complete a task that support
departmental or organizational policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

They are put in place by organizational governance, such as executive management, to provide guidance in all activities to ensure that the organization supports industry standards and regulations

A

Policies are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

often used by governance teams to provide a framework to introduce policies and proceduresin support of regulations

A

Standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

commonly issued in the form of laws, usually from
government (not to be confused with governance) and typically carry financial penalties for non-compliance

A

Regulations are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Bot

A

Malicious code that acts like a remotely controlled “robot” for an attacker, with other Trojan and worm capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Criticality

A

A measure of the degree to which an organization depends on the information or information system for the success of a mission or of a business function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data Integrity

A

The property that data has not been altered in an unauthorized manner. Data integrity covers data in storage, during processing and while in transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

General Data Protection Regulation (GDPR)

A

In 2016, the European Union passed comprehensive legislation that addresses personal privacy, deeming it an individual human right

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Integrity

A

The property of information whereby it is recorded, used and maintained in a way that ensures its completeness, accuracy, internal consistency and usefulness for a stated purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

International Organization of Standards (ISO)

A

The ISO develops voluntary international standards in collaboration with its partners in international standardization, the International Electro-technical Commission (IEC) and the International Telecommunication Union (ITU), particularly in the field of information and communication technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Internet Engineering Task Force (IETF)

A

The internet standards organization, made up of network designers, operators, vendors and researchers, that defines protocol standards (e.g., IP, TCP, DNS) through a process of collaboration and consensus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Multi-Factor Authentication

A

Using two or more distinct instances of the three factors of authentication (something you know, something you have, something you are) for identity verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

National Institutes of Standards and Technology (NIST)

A

The NIST is part of the U.S. Department of Commerce and addresses the measurement infrastructure within science and technology efforts within the U.S. federal government. NIST sets standards in a number of areas, including information security within the Computer Security Resource Center of the Computer Security Divisions

29
Q

Non-repudiation

A

The inability to deny taking an action such as creating information, approving information and sending or receiving a message.

30
Q

Personally Identifiable Information (PII)

A

The National Institute of Standards and Technology (NIST) defines Personally Identifiable Information (PII) as any data that can distinguish or trace an individual’s identity, including common identifiers like name and Social Security number, as well as other information linked to an individual such as biometric records, medical, educational, financial, and employment information.

31
Q

Controls implemented through a tangible mechanism. Examples include walls, fences, guards, locks, etc. In modern organizations, many ____ control systems are linked to technical/logical systems, such as badge readers connected to door locks

A

Physical controls

32
Q

Protected Health Information (PHI)

A

Information regarding health status, the provision of healthcare or payment for healthcare as defined in HIPAA (Health Insurance Portability and Accountability Act)

33
Q

Qualitative Risk Analysis

A

A method for risk analysis that is based on the assignment of a descriptor such as low, medium or high

34
Q

Quantitative Risk Analysis

A

A method for risk analysis where numerical values are assigned to both impact and likelihood based on statistical probabilities and monetarized valuation of loss or gain

35
Q

Risk Acceptance

A

Determining that the potential benefits of a business function outweigh the possible risk impact/likelihood and performing that business function with no other action

36
Q

Risk Assessment

A

The process of identifying and analyzing risks to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals and other organizations. The analysis performed as part of risk management which incorporates threat and vulnerability analyses and considers mitigations provided by security controls planned or in place.

37
Q

Risk Avoidance

A

Determining that the impact and/or likelihood of a specific risk is too great to be offset by the potential benefits and not performing a certain business function because of that determination.

38
Q

Risk Management

A

The process of identifying, evaluating and controlling threats, including all the phases of risk context (or frame), risk assessment, risk treatment and risk monitoring.

39
Q

Risk Management Framework

A

A structured approach used to oversee and manage risk for an enterprise

40
Q

Risk Mitigation

A

Putting security controls in place to reduce the possible impact and/or likelihood of a specific risk

41
Q

Risk Tolerance

A

The level of risk an entity is willing to assume in order to achieve a potential desired result. Risk threshold, risk appetite and acceptable risk are also terms used synonymously with risk tolerance

42
Q

Risk Transference

A

Paying an external party to accept the financial impact of a given risk

43
Q

Risk Treatment

A

The determination of the best way to address an identified risk

44
Q

Sensitivity

A

A measure of the importance assigned to information by its owner, for the purpose of denoting its need for protection

45
Q

Single-Factor Authentication

A

Use of just one of the three available factors (something you know, something you have, something you are) to carry out the authentication process being requested

46
Q

System Integrity

A

The quality that a system has when it performs its intended function in an unimpaired manner, free from unauthorized manipulation of the system, whether intentional or accidental

47
Q

Technical Controls

A

Security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software or firmware components of the system

48
Q

Threat Vector

A

The means by which a threat actor carries out their objectives

49
Q

Token

A

A physical object a user possesses and controls that is used to authenticate the user’s identity

50
Q

Institute of Electrical and Electronics Engineers

A

IEEE is a professional organization that sets standards for telecommunications, computer engineering and similar disciplines.

51
Q

What is the primary purpose of the ISC2 Code of Ethics?

A

Ensuring the safety and welfare of society and the common good

52
Q

What type of authentication process is used at the bank with an ATM card?

A

Two-factor authentication

53
Q

Kristal is the security administrator for a large online service provider. Kristal learns that the company is harvesting the personal data of its customers and sharing the data with local governments where the company operates, without the knowledge of the users, to allow the governments to persecute users on the basis of their political and philosophical beliefs.

The published user agreement states that the company will not share personal user data with any entities without the users’ explicit permission.

According to the ISC2 Code of Ethics, to whom does Kristal ultimately owe a duty in this situation?

A

The users

54
Q

In e-commerce and electronic transactions, what does non-repudiation protect against?

A

Falsely denying transactions

55
Q

What type of cyber attack often targets the availability of data?

A

Ransomware attacks

56
Q

What is meant by non-repudiation?

A

If a user does something, they can’t later claim that they didn’t do it

57
Q

What does knowledge-based authentication involve?

A

Differentiating between authorized and unauthorized users using a passphrase or secret code

58
Q

What is the purpose of using a risk matrix?

A

To prioritize risks based on likelihood and impact

59
Q

What measures would a trauma center be most likely to take to ensure zero tolerance for power failure?

A

Redundancy in emergency power supplies, battery backup, and generators

60
Q

Which of the following is NOT one of the four typical ways of managing risk?

A

Conflate

61
Q

When a company chooses to ignore a risk and proceed with a risky activity, which treatment is being applied by default?

A

Acceptance

62
Q

What is risk tolerance often likened to?

A

Risk appetite

63
Q

Siobhan is deciding whether to make a purchase online; the vendor wants Siobhan to create a new user account and is requesting Siobhan’s full name, home address, credit card number, phone number, email address, the ability to send marketing messages to Siobhan, and permission to share this data with other vendors.

Siobhan decides that the item for sale is not worth the value of Siobhan’s personal information, and decides to not make the purchase.

What kind of risk management approach did Siobhan make?

A

Avoidance

64
Q

What is done with the result of the risk assessment process?

A

It is presented as a report or presentation to the management

65
Q

What is an example of a physical control?

A

Walls, fences, guards, locks

66
Q

Software security practitioners seek to maintain the CIA of systems and software based on business needs.

Which aspect of the CIA is focused on guaranteeing that authorized subjects are granted uninterrupted access to objects in a timely fashion?

A

Availability

67
Q

A chief information security officer (CISO) at a large organization documented a policy that establishes the acceptable use of cloud environments for all staff.

This is an example of a: __________.

A

Management/Administrative control

68
Q

What is the correct sequence of the elements in governance, starting from the highest level?

A

Regulations, standards, policies, procedures

69
Q

Guillermo is the system administrator for a midsized retail organization. Guillermo has been tasked with writing a document that describes, step-by-step, how to securely install the operating system on a new laptop.

This document is an example of a ________.

A

Procedure

ISC2 Certified Cybersecurity (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions