Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 Security and Risk Management > Flashcards

Domain 1 Security and Risk Management Flashcards

1
Q

business organizations use which of the following levels of classifications:

A

Public, Internal Use Only, Confidential, Restricted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

time between when the changes are made on one system and when they’re propagated to other systems is known as:

A

Time-of-check/time-of-use (TOC/TOU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This person is responsible for the overall protection of the information assets.

A

Executive Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This legal system is also known as Regulatory Law and is concerned with the governance of public bodies and agency power among other areas.

A

Administrative Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who should direct short-term recovery actions immediately following a disaster?

A

Disaster Recovery Manager.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following should NOT be a role of the Security Administrator?

A

Authorizing access rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the main purpose of Corporate Security Policy?

A

To communicate management’s intentions in regards to information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A contingency plan should address:

A

Potential risks. Residual risks. Identified risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following focuses on sustaining an organization’s business functions during and after a disruption?

A

Business continuity plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The deliberate planting of apparent flaws in a system for the purpose of detecting attempted penetrations or confusing an intruder about which flaws to exploit is called:

A

enticement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three primary goals of a BIA?

A

Criticality prioritization, downtime estimation, and resource requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

most appropriate to notify an internal user that monitoring is being enforced and there is no expectation of privacy on systems that belong to the company?

A

Written agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

guidelines recommended to protect PII

A

Limited, Relevant and Specific in Purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

This type of authentication is better than simple passwords but the technology involved is still subject to loss, damage, or theft for examination.

A

Type 2: Something you have

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the appropriate role of the security analyst in the application system development or acquisition project?

A

control evaluator & consultant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The first step in the implementation of the contingency plan is to perform:

A

A data backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Who is responsible for restricting and monitoring access of a data user?

A

Security Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following would be the best recovery strategy if you have an application which cannot accept any downtime without negatively impacting the organization.

A

Dual Data Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Hashing functions takes message input of a given length and create a(n) __________.

A

Fixed Length Output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

This sequence is used to detect errors in transmission of messages and is often deployed with symmetric key cryptography.

A

Checksum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A professor in a school shared a time management software with a colleague so that she could check out its features and buy the software if she found it useful. This may have likely violated the terms under which the software was licensed to the professor. What ethical principle would the professor apply to justify his action?

A

Change of scale test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which of the following is not part of the current state assessment phase for BCP/DRP?

A

Design initial acceptance testing of plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following contains general approaches that also provide the necessary flexibility in the event of unforeseen circumstances?

A

Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which of the following teams is responsible for starting recovery of the original site in the aftermath of a disaster?

A

Salvage team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what are the guidelines to classify data?

A

Classify all data irrespective of the format it exists in (paper, digital, audio, video)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What formula is used to calculate total risk?

A

Threats x vulnerability x asset value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

the following is NOT a responsibility of a database administrator

A

Providing access authorization to databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the five key principle that forms the core of the COBIT5 framework?

A

1) Meeting Stakeholders needs,
2) Covering the enterprise end to end,
3) Apply a single integrated framework,
4) Enabling a holistic approach,
5) Seperating governance from management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The method for determining the level of risk to the organization’s information if this data to be lost or compromised is known as:

A

Information Classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Plans and organizes information security activities throughout the organization.

A

Security officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

When it comes to Risk Mitigation, which risk countermeasure involves not even taking the chance with the risk?

A

Risk Avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the three primary goals of a BIA?

A

Criticality prioritization,
downtime estimation, and
resource requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

ISC2 Code of Ethics Canons?

A

*Protect society, the commonwealth, and the infrastructure
Advance and protect the profession
Act honorably, honestly, justly, responsibly, and legally Provide diligent and competent service to principals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

financial risks can be calculated is by using the formula:

A

P * M = C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

(AAA)

A

Identity and Authentication, Authorization and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

legal system where court decisions governed by previous court rulings and generally use an adversarial approach to litigation.

A

Common Law

37
Q

MTD estimates for business continuity planning:

A

nonessential: 30 days;
normal: seven days;
important: 72 hours;
urgent: 24 hours;
critical: minutes to hours.

38
Q

What information gathering technique is generally regarded as legal

A

Dumpster Diving

39
Q

BCP testing interval

A

Annually

40
Q

4 ways to handle risk

A

risk mitigation,
risk avoidance,
risk transference
risk acceptance.

41
Q

What type of evidence cannot be used on its own, but may be admissible to prove other, more substantial evidence?

A

Corroborative evidence

42
Q

BCP defined

A

A business continuity plan is a set of policies, procedures, guidelines, and standards that are intended to ensure the survival and continued operation of a business following a disaster. It should be tightly coupled with the corporate security policy and program for reasons of operational efficiency, cost savings, as well as providing an overarching framework protecting the business and its assets from threats to its survival and well being

43
Q

Advisory policy

A

Advisory policy. Such policies typically advise employees on acceptable behavior within an organization and the result of not conforming to such behavior. For example, such an advisory policy could be put into effect while handling confidential data.

44
Q

formula is used to calculate total risk

A

Threats x vulnerability x asset value

45
Q

Backup types:

A

Incremental backups take less time to complete than either full or differential backups, as only the files with changed archived bits are backed up. However, incremental backups are more complicated and take more time to restore, because they must be restored in the precise order in which they were backed up to avoid missing a file.

46
Q

Risk

A

A risk is the likelihood that a threat agent will take advantage of a vulnerability. It ties the vulnerability, threat and the likelihood of being exploited, to the business impact that could result.

47
Q

Guidelines

A

Guidelines are general approaches and provide the necessary flexibility to handle emergencies. Guidelines may also be certain recommended approaches / actions to handle certain scenarios.

48
Q

Service outage levels:

A

A non-disaster is an outage in hours

A disaster is an event that causes an entire facility to be unavailable for a day or longer, and typically involves the use of a backup site while the primary facility is being repaired..

A catastrophe is an event in which an entire facility is destroyed.

49
Q

the following is a key metric in the aftermath of a disaster

A

Compromised customer service

50
Q

Which type of online backup provides faster IO access to files?

A

Disk Shadowing

51
Q

The following represents the correct order in of activities in response to an incident?

A

Triage, Reaction, Follow-up

52
Q

How often should background checks be done on employees in a company?

A

Prior to their joining work and as required.

53
Q

CoBIT

A

The CoBIT stands for Control Objectives for Information and related Technology. This is published by the IT Governance Institute and is an effective IT Governance framework. COSO is a model for corporate governance, while ISO 17799 and ISO 27001 are enterprise security standards.

54
Q

The ISC2 Code of Ethics does not include which of the following behaviors for a CISSP:

A

Control

55
Q

Which of the following would be best suited to oversee the development of an information security policy?

A

Security officers

56
Q

Which of the following should NOT be a role of the Security Administrator?

A

Authorizing access rights

57
Q

best suited to oversee the development of an information security policy

A

Security Officer

58
Q

NOT a role of the Security Administrator

A

Authorizing access rights

59
Q

Configuration Management process is one that can:

A

(1) accommodate change;
(2) accommodate the reuse of proven standards and best practices;
(3) ensure that all requirements remain clear, concise, and valid;
(4) ensure changes, standards, and requirements are communicated promptly and precisely; and
(5) ensure that the results conform to each instance of the product.

60
Q

How should a risk be HANDLED when the cost of the countermeasure OUTWEIGHS the cost of the risk?

A

Accept the risk

61
Q

Information classification should be based on

A

the value of the information to the organization and its sensitivity

62
Q

BCP vs BRP vs COOP

A

A business continuity plan (BCP) focuses on sustaining an organization’s business functions during and after a disruption. Information systems are considered in the BCP only in terms of their support to the larger business processes. The business recovery plan (BRP) addresses the restoration of business processes after an emergency. The BRP is similar to the BCP, but it typically lacks procedures to ensure continuity of critical processes throughout an emergency or disruption. The continuity of operations plan (COOP) focuses on restoring an organization’s essential functions at an alternate site and performing those functions for up to 30 days before returning to normal operations. The disaster recovery plan (DRP) applies to major, usually catastrophic events that deny access to the normal facility for an extended period. A DRP is narrower in scope than an IT contingency plan in that it does not address minor disruptions that do not require relocation.

63
Q

The copyright law (“original works of authorship”) protects the right of the owner in all of the following except?

A

The idea itself

64
Q

MOM in criminal cases refers to

A

Motivation, Opportunity, Means

65
Q

A periodic review of user account management should not determine:

A

Strength of user-chosen passwords

66
Q

An effective information security policy should:

A

Include separation of duties

Be understandable and supported by all stakeholders

Specify areas of responsibility and authority

67
Q

Whose role is it to assign classification level to information?

A

Owner

68
Q

How often should tests and disaster recovery drills be performed?

A

At least once a year

69
Q

What are the three primary goals of a BIA?

A

Criticality prioritization, downtime estimation, and resource requirements.

70
Q

Which of the following best describes an exploit?

A

A chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software

71
Q

Who is responsible for restricting and monitoring access of a data user?

A

Security Administrator

72
Q

This position is responsible for ensuring that users, owners, custodians, systems and networks are in compliance with security policy.

A

Information Systems Auditor

73
Q

Contingency Planning includes

A

prioritization of apps = asset valuation

assessment of threat impact = threat modeling

development of recovery scenarios = risk mitigation

74
Q

Who is responsible for providing adequate physical and logical security for Information System (IS) program, data, and equipment?

A

Security Administrator

75
Q

What is one component of penetration testing that is often left out and doesn’t include any technical intrusion testing?

A

Social Engineering

76
Q

A weakness or lack of a safeguard, which may be exploited by a threat, causing harm to the information systems or networks is called a ?

A

Vulnerability

77
Q

Which of the following is given the responsibility of the maintenance and protection of the data?

A

Data custodian

78
Q

What category of law deals with regulatory standards that regulate performance and conduct?

A

Administrative/regulatory law.

79
Q

What can be described as a measure of the magnitude of loss or impact on the value of an asset?

A

Exposure factor

80
Q

What is the name of the process defined by extracting user names, machine names, network hosts, shares and finding services hosted on computers?

A

Enumeration

81
Q

The method for determining the level of risk to the organization’s information if this data to be lost or compromised is known as:

A

Information Classification

82
Q

Which of the following BEST describes why it is critical to train your user community on data classification?

A

They are the ones most often handling critical information and can best ensure its proper use.

83
Q

Which answer BEST explains specifically what a firewall does to provide basic network security?

A

Enforce Administrative Policy

84
Q

Financial risk formula

A

P*M=C
Probability
Magnatude
Cost

85
Q

Which disaster recovery plan test involves functional representatives meeting to review the plan in detail?

A

Structured walk-through test

86
Q

Who is responsible for providing technical support for the hardware and software environment by developing, installing and operating the requested system?

A

System Development Management

87
Q

Plans and organizes information security activities throughout the organization.

A

Security officer

88
Q

After all other risk management principles have been applied, this principle is observed as the last requirement. This principle MUST be observed if the business function is to occur:

A

Risk Acceptance

89
Q

This sequence is used to detect errors in transmission of messages and is often deployed with symmetric key cryptography.

A

Checksum

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions