Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Preparation > Domain 1 > Flashcards

Domain 1 Flashcards

1
Q

What should be the primary focus for Web services?

A

Availability
Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How can we protect the Integrity?

A

We can protect Integrity by utilizing:
1) Cryptography
2) Checksum (CRC)
3) Hashing (for instance; MD5 SHA1 or SHA2)
4) Digital Signature (prevent from Non-repudiation)
5) Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do we maintain the availability?

A

We can maintain and protect the Availability by implementing and deploying:
1) Installing Intrusion Prevention System (IPS)
Intrusion Detection System (IDS)
2) Regularly performing Patch Management
3) Predict and prepare for Redundancy (power, traffic route, hardware, staff)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the basic types of ways for identification and authentication?

A

Typical authentication methods involve identifying the following -
1) something you know (Username, Password, PIN)
2) something you have(Access cards, Access Tokens, Security Keys etc)
3) something you are (combination of physical or behavioural, for example fingerprint, retina scan, voice recognition, facial recognition)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the examples of Physical security?

A

security guard, access cards, biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the examples of Logical security?

A

IPS
IDS
User Access Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the biggest data protection law and privacy law for all individuals in the EU and EEA?

A

GDPR - General Data Protection Regulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How much is the fine for violating the GDPR Law?

A

-20 million Euros or 4% of the annual profit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does it mean by Data Owner?

A

Data owners are Individuals or entities responsible for managing, securing, and controlling specific data within an organization, including defining access, security, and usage policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does it mean by Data Custodian?

A

Data Custodians are mainly responsible for physically storing, maintaining, and protecting data, including storage, backup, security, maintenance, retention, disposal, and access management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the retention policy?

A

Typically these are the set of guidelines governing the retention, storage, and disposal of data, specifying data classification, retention periods, data destruction, compliance requirements, and responsibilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do we perform data destruction?

A

There are several ways to perform data destruction such as;
1) Overwriting: Multiple passes of data overwrites.
2) Degaussing: Magnetic field erasure for magnetic media.
3) Physical Destruction: Shredding, drilling, or burning.
4) Purging - Permanently removing data from a storage system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does ABAC stand for?

A

ABAC stands for Attribute-Based Access Control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is privilege creep?

A

When people get more access than they need to do their duties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the best way to prevent privilege creep?

A

The most effective ways to prevent it will be implementing least privilege and performing regular reviews.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is MFA?

A

MFA stands for Multi-factor Authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is SFA?

A

SFA means Single-factor Authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the difference between MFA and SFA?

A

MFA enhances security by necessitating multiple authentication factors, whereas SFA relies on a single factor, which makes it less secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Open Authorization?

A

It is also known as OAuth and it is a security framework for one online service to access another on behalf of a user without sharing user credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does DAC mean?

A

DAC (Discretionary Access Control) means users have discretion to decide who can access their resources and set permissions (e.g., read, write). Access control decisions are decentralized and based on user identities, groups, or roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is an ethical wall?

A

It mainly separates different parts of an organization to prevent conflicts of interest, maintain confidentiality, and ensure ethical standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Access control?

A

It is a system which regulates who can access system resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the Access control types?

A

There are several types of Access control and those include Physical (e.g., keycards), Logical (e.g., passwords), Role-Based (by job), Attribute-Based (based on attributes), Discretionary (owner control), Mandatory (security labels), Rule-Based, Time-Based, Biometric (biological traits), and Visitor Management (for guests).

22
Q

What are Access Tokens?

A

These are temporary keys used in authentication. They’re given after the initial login and are used to access resources without sharing login credentials.

23
Q

What is the standard used in Health Care Sectors? (choose one)

A

1) PCI DSS
2) GDPR
3) HIPPA

Answer: HIPPA

24
Q

Tru or Flase: GPDR is the standard used for Payment related?

A

Answer: False

25
Q

———————- is the standard use for payment cards? (fill in the blank)

A

Answer: PCI DSS

26
Q

What is key escrow?

A

Key escrow refers to the process where copies of encryption keys are securely kept with a reliable third party, known as the escrow agent. These keys are generally utilized for encrypted data storage or communication.

27
Q

——- is a method used to decipher codes by examining the frequency of letters or symbols in encrypted texts.

A

Answer: Frequency Analysis

28
Q

What is the work factor?

A

The Work Factor represents the amount of effort, resources, and time needed to compromise a cryptographic system or encryption. It serves as an indicator of the level of difficulty an attacker would face when attempting to decode encrypted data.

29
Q

True or False: Encryption is the process of converting ciphertext (coded data) back into its original plaintext form.

A

Answer: False

30
Q

What is decryption?

A

It is the process of converting ciphertext back into its original plaintext form.

31
Q

What does “out-of-band” mean in communication and networking?

A

“Out-of-band” means using a different way to send extra details or instructions along with the main data to make better communication.

32
Q

What is Non-Repudiation?

A

Non-repudiation ensures that the individual who sent a message or initiated a digital transaction cannot deny their act or transitions.

33
Q

What is the keyspace in cryptography?

A

Keyspace refers to the total range of possible keys that can be used for encoding or decoding data with a cryptographic algorithm.

34
Q

What does CPTED stand for?

A

“Crime Prevention Through Environmental Design,” is a strategy that uses design and planning to lower crime and enhance safety by influencing the physical environment.

35
Q

What is a session key?

A

A session key is a one-time encryption key made for a specific transaction to keep data safe.

36
Q

What does IPS stand for?

A

IPS stands for Intrusion Prevention System.

37
Q

What does IDS stand for?

A

IDS stands for Intrusion Detection System.

38
Q

The goal of cryptography is to ______ information from unauthorized individuals

A

Answer: protect

39
Q

“Cipher” is another term for al_______

A

Answer: gorithm (algorithm)

40
Q

True or False: Monoalphabetic cipher means more than one alphabet is used.

A

False.
Monoalphabetic cipher means only one alphabet is used.

41
Q

MCQ: It is a technique which replaces bits, characters or blocks or characters with different bits characters or blocks.

A

1) Transposition Cipher
2) Substitution Cipher

42
Q

True or False: Caesar Cipher is the most secure and effective cipher method.

A

False.
(One-time pad is the most secure cipher method).

43
Q

True or False: Scytale Cipher method is an example of substitution cipher.

A

False.
(It is a transposition cipher method. )

44
Q

In most languages, certain letters appear more often.

In English, it is the letter _______

A

E

45
Q

Two main parts to encryption are the ——– used and ———–.

A

Answer: algorithm, the key.

46
Q

Are there any issues with the XOR technique?

A

Yes, XOR can be prone to attacks if the key is short or reused. It also lacks authentication and doesn’t guard against cryptographic attacks.

47
Q

What is cryptanalysis?

A

Cryptanalysis is the process of decoding encrypted data, breaking encryption techniques, and bypassing authentication to reveal concealed information.

48
Q

Is cipher text readable by human and machine?

A

Cipher text is not readable by humans and machines. Only plaintext is readable by humans and machines.

49
Q

What is more vulnerable? Data at rest or data being transmitted?

A

Data in transit is generally more at risk than data at rest, as it’s exposed to potential interception and eavesdropping during its journey, making it prone to various attacks.

50
Q

S______ key encryption, and A________ key encryption are two types of cryptosystems.

A

Symmetrical, Asymmetrical.

51
Q

True or False: Asymmetric key encryption is a cryptosystem that uses the same key for both encryption and decryption.

A

False

52
Q

MCQ: It is also known as PKI, which uses different keys for encryption and decryption

A

1) Symmetric
2) Asymmetric
(Answer: Asymmetric)

53
Q

What is Steganography?

A

It is a method of concealing the existence of data by embedding it within a different media type.

54
Q

What is a payload in computing and networking?

A

The payload is the actual data or meaningful content carried within a packet or message.

CISSP Preparation (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions