Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 (Security and Risk Management) > Flashcards

Domain 1 (Security and Risk Management) Flashcards

1
Q

What does CIA stand for?

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the purpose of confidentiality?

A

Enforces secrecy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the purpose of integrity?

A

Accuracy, reliability of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are example controls that enforce confidentiality?

A

Encryption, Access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are example controls that enforce Integrity?

A

Hashing, Change Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are example controls that enforce availability?

A

RAID, backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Definition of Vulnerability

A

System weakness that allow treat agent to compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Definition of Threat

A

Danger associated with exploiting vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Examples of a Treat Agent

A

Intruder, careless employee or bad policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Definition of Risk

A

Likelihood of threat source exploiting vulnerability and its business impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Definition of Exposure

A

Instance of being exposed to loss. Example: Weak Password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Definition of Control

A

Countermeasure to mitigate risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the three control types?

A

Administrative, Technical and Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Examples of Administrative controls

A

Documents, training, management related

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Examples of Technical controls

A

Firewall, encryption, IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Example of physical control

A

Fences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Definition of Defense-In-Depth

A

coordinated use of several controls in layered approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Name the six control functions

A

Preventative, Detective, Corrective, Deterrent, Recovery and Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does a Preventative control function do?

A

Intend to avoid incident happening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does a detective control function do?

A

Identify incident activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does a corrective control function do?

A

Fixes systems after incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does a deterrent control function do?

A

Discourages attackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does a recovery control function do?

A

Brings environment back to operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does a compensating control function do?

A

Alternative measure of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Definition of Security Through Obscurity

A

Assume your enemies are not as smart as you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Definition of Methodology

A

Process to follow to build architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Definition of Strategic Alignment

A

Business drivers being met by security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Definition of Business enablement

A

Core business processes are integrated into security model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does a system architect do?

A

Structure of software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What does a enterprise architect do?

A

Structure of organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is computer assisted crime?

A

Computer used to carry out crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is computer targeted crime?

A

Computer was victim

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is computer incidental crime?

A

A computer happen to have been used in crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Definition of Advanced Persistent Threat

A

Very focused and motivated attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Characteristics of Civil law system

A

Decide liability not guilt. Financial compensation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Characteristics of criminal law

A

Innocent until proven guilty. Punishment loss of freedom

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Characteristics of Customary Law Systems

A

Based on tradition, Deals with personal conduct, Fine or community service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a mixed law system?

A

Mostly mix civil and common law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Characteristics of Administrative law

A

Regulatory standards for performance and conduct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Characteristics of Trade Secret

A

Qualify only if provides company with competitive edge. Must require skill, money effort develop. Proprietary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Examples of a Trade Secret

A

Algorithms, source code, recipe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Characteristics of Copyright

A

Does not cover resource but expression of idea

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Examples of Copyright

A

Drawing, music

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Examples of Trademark

A

Work, symbol, sound

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Characteristics of Patent

A

Excludes others from copying, lasts 20 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What do you call non practicing entities that do not use patent?

A

Patent troll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is Freeware

A

Can use and share

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is Shareware

A

Released for marketing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is Personally Identifiable Information?

A

Data that can identify a single person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is privacy?

A

The ability to control who has information about you

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is a Chief Privacy Officer?

A

Usually lawyer oversees how data managed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Name three privacy problems

A

Data aggregation, loss of borders, convergent technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is a generic approach regulation?

A

Stretches across industries, also called horizontal enactment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Tip for Reasonable Exception of Privacy?

A

Tell staff they are being monitored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Definition of Threat?

A

Something that has the potential to cause harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Quality of a safeguard?

A

It’s proactive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Quality of a Countermeasure?

A

It’s reactive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is a Secondary Risk?

A

A risk that comes later as the result of another risk response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is Residual Risk?

A

The risk left over after a risk response

60
Q

What does the Delphi Technique do?

A

Get users to contribute to risk analysis anonymously

61
Q

Quantitative Analysis - what does AV stand for?

A

Asset value, Dollar number asset is worth

62
Q

Quantitative Analysis - what does EF stand for?

A

Exposure factor. % of loss expected as result

63
Q

Quantitative Analysis - what does SLE stand for?

A

Single loss expectancy. Dollar amount cost single occurrence of threat

64
Q

Quantitative Analysis - what does ARO stand for?

A

Annual Rate of Occurrence. How often a threat is expected to materialize

65
Q

Quantitative Analysis - what does ALE stand for?

A

Annual loss expectancy. Cost per year as a result of the threat

66
Q

Quantitative Analysis - what does TCO stand for?

A

Total cost of ownership. Cost of implementing the safeguard

67
Q

What is Asset Value (AV)?

A

Dollar number asset is worth

68
Q

What is Exposure Factor (EF)?

A

% of loss expected as result

69
Q

What is Single Loss Expectancy (SLE)?

A

Dollar amount cost single occurrence of threat

70
Q

What is Annual Rate of Occurrence (ARO)?

A

How often the threat is expected to materialize

71
Q

What is Annual Loss Expectancy (ALE)?

A

Cost per year as a result of the threat

72
Q

What is Total Cost of Ownership (TCO)?

A

Total cost of implementing a safeguard

73
Q

Formula for Single Loss Expectancy (SLE)?

A

SLE (Single Loss Expectancy) = AV (Asset Value) * EF (Exposure Factor)

74
Q

Formula for Annual Loss Expectancy (ALE)?

A

ALE (Annual Loss Expectancy) = SLE (Single Loss Expectancy) * ARO (Annual Rate of Occurrence)

75
Q

What are the five ways to mitigate risk?

A

Reduce, Accept, Transfer, Avoidance, Rejection

76
Q

What does Risk Reduction do?

A

Lessen the probability and/or impact of a risk

77
Q

What is Risk Transference?

A

Shares the risk with someone else. Insurance or SLA. Lessen portion of loss. Does not reduce likelihood.

78
Q

What is Risk Acceptance?

A

Logical solution when cost of mitigation is greater than the potential for loss

79
Q

What is Risk Rejection?

A

Happens when we ignore the risk

80
Q

What is Risk Avoidance?

A

When we don’t go ahead with whatever would expose us to that risk

81
Q

What is Total Risk?

A

The risk that exists before any control is implemented

82
Q

What is Governance?

A

Ensures that stakeholder needs and goals understood

83
Q

What is Management?

A

Plans, build, runs and monitors activities as directed by governance

84
Q

COBIT and COSO buzzword

A

Goal orientated

85
Q

OCTAVE buzzword

A

Self directed risk assessment

86
Q

What does ISO 27002 do?

A

Practical advise for implementing security controls in ISMS (Information Security Management System)

87
Q

What does ISO 27001 do?

A

Establish, Implement, Control and Improve ISMS (Information Security Management Systems).

88
Q

What does ISO 27004 do?

A

Provides metrics for measuring the success of ISMS (Information Security Management Systems).

89
Q

What does ISO 27799 do?

A

Directives on protecting personal health information

90
Q

What does ISO 27005 do?

A

A standards based approach to risk management

91
Q

What standard replaced ISO 17799?

A

ISO 27002

92
Q

Who is ultimately responsible for the security within an organization?

A

Senior management

93
Q

What is Due Diligence?

A

Continuously monitoring an organizations practices to ensure they are meeting the security requirements

94
Q

What is Due Care?

A

Ensuring that best practices and implemented and followed.

95
Q

What is the Prudent Man Rule?

A

Acting responsibly and cautiously as a prudent man would

96
Q

What are the three characteristics of the Organization Security Policy?

A

Very high level management statement,
Assign responsibility,
Explains drivers.

97
Q

What is a System Specific Policy?

A

Every system has a different policy (printers, AD etc)

98
Q

What is a Issue Specific Policy?

A

Company stance on various employee issues. Privacy, e-mail usage etc

99
Q

What are Standards within Policies?

A

Mandatory, gives specifics about how to support policy

100
Q

What are Procedures?

A

Mandatory, Step by step instructions

101
Q

What are Guidelines?

A

Not mandatory, suggestive in nature. Recommended actions and guides to users

102
Q

What are Baselines?

A

Mandatory, minimum acceptable security configuration for a system or process

103
Q

What is Disaster Recovery Planning (DRP)?

A

Handels disaster and ramification right after disaster hits

104
Q

What is Business Continuity Planning (BCP)?

A

Deals with long term effects of outage

105
Q

What is Business Continuity Management (BCM)?

A

Holistic management process that cover both

106
Q

Who is the leader of the BCP (Business Continuity Management) team?

A

Business continuity coordinator

107
Q

What is Maximum Tolerable Downtime (MTD)?

A

Classifications for how long each system can be down (Critical, Normal, nonessential etc)

108
Q

What is performed before Business Continuity Planning (BCP)?

A

A business impact analysis (BIA)

109
Q

What is Separation of Duties?

A

Ensure no individual cannot complete a critical task by himself

110
Q

What is Collusion?

A

At least two people working together to cause fraud

111
Q

What is Split Knowledge?

A

No one person knows how to completely perform a task (IE launch codes)

112
Q

What is Dual Control?

A

Two people must perform action such as key turn

113
Q

What is Rotation of Duties?

A

No one person hold position for too long

114
Q

What is the WASSENAAR agreement?

A

Cannot export crypto to terrorist countries

115
Q

What is cyber squatting?

A

Registering a URL that somebody else would need

116
Q

What is HIPPA (Health Insurance Portability and Accountability Act)?

A

Applies to healthcare

117
Q

What is a Crisis Communication Plan?

A

How to report to staff and public

118
Q

What is a Occupant Emergency Plan (OEP)?

A

Keep people safe

119
Q

How often should a Disaster Recovery Plan be tested?

A

At least once a year

120
Q

What is a Failover?

A

Action taken to recover

121
Q

What is a Failback?

A

Go back to normal after failover

122
Q

What is a Parallel test in DRP?

A

System moved and used offsite, risky

123
Q

What is a Full Interruption Test?

A

Shutdown original site, risky

124
Q

What is Recovery Point Objective (RPO)?

A

How current must my data be if restoring from a backup?

125
Q

What is Maximum Tolerable Downtime (MTD)?

A

What is the longest that a system can be down?

126
Q

What is Mean Time Between Failures (MTBF)?

A

Lifespan of hardware

127
Q

What is Minimum Operating Requirements (MOR)?

A

What is the minimum system spec

128
Q

What is the opposite of CIA?

A

Disclosure, Alteration and Destruction

129
Q

What does IAAA stand for?

A

Identity and Authentication, Authorization and Accountability

130
Q

What in an example of Identity and Authentication?

A

Username and password

131
Q

What is an example of Authorization as it relates to IAAA?

A

Actions done on a system after Authentication such as read and write access

132
Q

What is nonrepudiation?

A

A user cannot deny having performed a transaction

133
Q

What is the difference between subjects and objects?

A

Subject is a user, object is a file

134
Q

What are the three types of Financial Damages in legal terms?

A

Statutory, Compensatory and Punitive

135
Q

What are Statutory Financial Damages?

A

Prescribed by law awarded to victim even if they have suffered no loss

136
Q

What are Compensatory Financial Damages?

A

Provide victim with financial award to compensate for loss

137
Q

What are Punitive Financial Damages?

A

Punish individual or organization

138
Q

What is Attestation?

A

Having a third-party audit a service provider to ensure they can be trusted

139
Q

What is a Divestiture?

A

The opposite of an acquisition in which two companies become one

140
Q

Is a Policy mandatory or discretionary?

A

Mandatory

141
Q

Is a Procedure mandatory or discretionary?

A

Mandatory

142
Q

Is a Standard mandatory or discretionary?

A

Mandatory

143
Q

Is a Guideline mandatory or discretionary?

A

Discretionary

144
Q

Is a Baseline mandatory or discretionary?

A

Discretionary

145
Q

What is offshoring?

A

Outsourcing to another country

CISSP (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions