Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1: Everything Else > Flashcards

Domain 1: Everything Else Flashcards

1
Q
  • When a user cannot deny having performed a certain action on a system.
  • Both authentication and integrity are combined.
A

Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Users should be granted the minimum amount of access required to do their jobs no more.

A

Least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Users must know a specific piece of info before accessing it.

A

Need to know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  • Term used to describe an active entity on a system.

- Users and computer programs can be labeled this as well.

A

Subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Term used to describe data on a system

A

Objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Multiple safeguards are put into place in order to protect an asset. Safeguards aka controls are measures taken to reduce risks

A

Defense in Depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some auditing frameworks for the purpose of a security assessment?

A

SOC1 and SOC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  • Report that covers internal controls over financial reporting.
  • Gives your company’s user entities some assurance that their financial information is being handled safely and securely
A

SOC1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Focuses on implemented security controls in relation to availability security, integrity privacy, and confidentiality

A

SOC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A thirty-party is brought in to review the practices of the service provider and make a statement regarding their security posture

A

Attestation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Documents provided that give written approval to the security company to perform pen test or audit the organization network.

A

Right to penetration test/right to audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Process of acquiring products or services from a third party

A

Procurement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Ensures that the business is continually getting sufficient quality from its third-party vendors

A

Vendor Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are some steps taken before an acquisition of a company?

A

Due diligence of acquired company’s current cybersecurity program and assessment of current network security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When one company is split into two or more companies

A

Divestitures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are security concerns relating to divestitures?

A

The split companies inadvertently maintaining duplicate accounts and passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  • “protect society, the commonwealth, and the infrastructure.”
  • Security professionals are charred with the promotion of safe security practices and improvement of system infrastructure for the public good.
  • (ISC)^2 Code of Ethics
A

First canon of (ISC)^2 Code of Ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q
  • “act honorably, honestly, justly, responsibly, and legally.”
  • If laws from different jurisdictions are found to be in conflict. Then priority should be given to the jurisdiction in which services are being provided.
  • (ISC)^2 Code of Ethics
A

Second canon of (ISC)^2 Code of Ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
  • “provide diligent and competent service to principles.”
  • Security professionals provide competent services for which he or she is qualified.
  • (ISC)^2 Code of Ethics
A

Third canon of (ISC)^2 Code of Ethics

20
Q
  • “advance and protect the profession.”
  • Requires security professionals to maintain their skills and advance the skills and knowledge of others.
  • (ISC)^2 Code of Ethics
A

Fourth canon of (ISC)^2 Code of Ethics

21
Q

A document defined by the RFC regarding the expected ethical behavior on the internet.

A

Internet Activities Board (IAB) Code of Ethics

22
Q

According to the Internet Activities Board (IAB) what are some examples of unethical behavior?

A

Someone who purposely:
Seeks to gain unauthorized access to a resource
Disrupt the intended use of the internet
Wastes resources (people, capacity, computer) through such actions
Destroy the Integrity of computer-based information
Compromises to privacy of users

23
Q

The collection of practices related to supporting, defining and directing the security efforts of an organization

A

Security Governance

24
Q
  • High-level management directives

- Mandatory document

A

Policies

25
Q
  • A step-by-step guide for accomplishing a task.

- Mandatory document

A

Procedures

26
Q
  • Describes the specific use of technology, often applied to hardware and software.
  • Mandatory document
A

Standards

27
Q
  • Are best practices.

- Discretionary document

A

Guidelines

28
Q
  • Uniform ways of implementing a standard

- Discretionary document

A

Baselines

29
Q
  • Intended to change user behavior

- i.e. reminding users to never write their passwords down

A

Security awareness

30
Q

Intended to teach a user how to do something

A

Security Training

31
Q

Use of a third party to provide IT support services that were once done in-house.

A

Outsourcing

32
Q
  • Outsourcing to another country.

- One problem here that will require due diligence is understanding the industry regulations of the other country.

A

Offshoring

33
Q
  • Control Category

- Are implemented by creating and following organizational policy, procedure or regulation

A

Administrative Controls

34
Q
  • Control Category
  • Are implemented using software, hardware, or firmware that restricts access on an IT system
  • i.e. firewalls, encryption, ACLs, protocols, IDS, clipping levels etc..
A

Logical/Technical Controls

35
Q
  • Control Category

- Are implemented with physical devices ( i.e. locks, fences, gates and security guards)

A

Physical controls

36
Q
  • Control that restricts or stops unwanted or unauthorized activity from occurring
  • i.e. fences, locks, biometrics, mantraps, lighting, alarm systems, separation-of-duties policies, job rotation policies, data classification, penetration testing, access control methods, encryption, auditing and etc…
A

Preventive Access Control

37
Q
  • Control that attempts to discover or detect unwanted or unauthorized activity.
  • i.e. security guards, motion detectors, recording and reviewing of events captured by security cameras or CCTV, job rotation policies, mandatory vacation policies, audit trails, honeypots or honeynets, intrusion detection systems, violation reports and etc…
A

Detective Access Control

38
Q
  • Control that modifies the environment to return systems to normal after unwanted security incident has occurred
  • i.e. Antivirus that remove or quarantine virus, IPS, backup and restore plans
A

Corrective Access Control

39
Q
  • Control that restores the functionality of a system after a security incident.
  • i.e. Reimage, backup and restore fault-tolerate drives
A

Recovery Access Control

40
Q
  • Control used to discourage people from performing actions that violate security policy
  • i.e. Banner messages, policies, security awareness training, locks, fences, security badges, guards, mantraps, and security cameras.
A

Deterrent Access Control

41
Q
  • Control put in place to temporary alleviate the weaknesses in another control
  • i.e. Security policy dictating that smartcards be used for all employees, this process may take awhile to implement. In the meantime, hardware tokens are issues out instead
A

Compensating Access Control

42
Q
  • Control that attempts to confine or control the actions of users to force or encourage compliance with security policies
  • i.e. security policy requirements or criteria, posted notifications, escape route exit signs, monitoring, supervision, and procedures.
A

Directive Access Control

43
Q
  • Type of third-party auditing report
  • Provides a description of the controls provided by the audited organization as well as the auditor’s opinion based upon that description.
  • Cover a single point in time and do not involve actual testing of the controls by the auditor.
A

Type I

44
Q
  • Type of third-party auditing report
  • Cover a minimum six-month time period and also include an opinion from the auditor on the effectiveness of those controls based upon actual testing performed by the auditor.
A

Type II

45
Q

Which auditing report types are considered more reliable?

A

Type II reports

Type I reports simply take the audited organization at their word that the controls are implemented as described

CISSP (30 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions