Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISC2 Cyber Security > Domain 1 - Security Principles > Flashcards

Domain 1 - Security Principles Flashcards

1
Q

What is Information Security?

A

Secures everything.. Paper, documents voice, etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is IT security?

A

All hardware software, being processed, stored and communicated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Cyber Security?

A

Is everything from IT security that is accessible from the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the CIA triad stand for?

A

Confidentiality, Availability, and Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is confidentiality mean?

A

That there is no unauthorized access to the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the three states of data?

A

Data:

At rest
In motion
In use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does Integrity mean?

A

We ensure the data has not been altered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does availability mean?

A

Ensuring authorized people can access the data they need.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does DAD stand for?

A

Disclosure, Alteration, and Destruction . It is the opposite of the CIA triad.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the IAAA acronym stand for?

A

Identification
Authentication
Authorization
Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Identification?

A

Something that identifies you. Username, SSN, employee number.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an example of Type 1 Authentication? Also known as knowledge factors.

A

Something you know
Your pin number for the ATM
your password or passphrase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an example of Type 2 Authentication? Also known as possession factors.

A

ID
passport
token
smart code
MFA device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is an example of Type 3 Authentication? Also known as realistic or biometric factors.

A

It is something you are
Iris scan
facial geometry
fingerprint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are physiological characteristics?

A

Uses the shape of the body for type 3 authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are behavioral characteristics?

A

Uses the pattern of behavior of the person for type 3 athentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Authorization?

A

It is he process of assigning access to systems after a user has authenticated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is DAC (Discretionary Access Control)?

A

It’s when access to an object is assigned at the discretion of the object owner.

Commonly used when availability is most important.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is MAC (Mandatory Access Control?

A

Labels are assigned to objects and subjects (users) have clearance assigned to them to be able to see the objects.

commonly used when confidentiality is the most important

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is RBAC?

A

Role based access control. Access is based on a role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is ABAC (Attribute Based Access Control)?

A

Access to objects is based on subjects, objects, and environmental conditions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is context-based access control?

A

Access is provided to an object and is based on contextual parameters such as location, time, access history, etc..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is content based access control?

A

Access is provided on the attributes or content of an object. Think different data on the same website depending on who you are.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is accountability?

A

Tracing an action to a subject’s identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are subjects?

A

Users or applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are objects?

A

Any data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the formula for risk?

A

Threat * Vulnerability * Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the formula for total risk?

A

Threat * vulnerability * asset value

29
Q

What is the formula for residual risk?

A

total risk - countermeasures

30
Q

What is the high-level process for risk maagement?

A

Identify Risk
Assess Risk
Respond to Risk
Risk monitoring

31
Q

What is a qualitative risk analysis?

A

It is subjective. How likely something is to happen and how bad is it if it does happen. Happens first.

32
Q

What is quantitative risk analysis?

A

What will it actually cost us in dollars.

33
Q

What is due diligence?

A

Doing research before implementation

34
Q

What is due care?

A

It is the implementation itself

35
Q

What is the first step of the risk assessment processs?

A

Ensuring you have an inventory of your assets.

36
Q

What are the risk strategies?

A

Risk mitigation
Risk transference (share.. Like insurance)
Risk acceptance
Risk avoidance (not pursuing whatever is causing the risk)

37
Q

What is the asset value in quantitative risk analysis?

A

The value of the asset in dollars

38
Q

What is the exposure factor in quantitative risk analysis?

A

How much of the asset is lost in an incident

39
Q

What is single loss expectancy in quantitative risk analysis?

A

How much a single incident will cost us

40
Q

What is the annual rate of occurrence in quantitative risk analysis?

A

How many times a specific incident happens in a year.

41
Q

What is the annualized loss expectancy in quantitative risk analysis?

A

How much will this cost if we don’t mitigate the risk.

42
Q

What is leftover risk called?

A

Residual Risk

43
Q

What is a KGI?

A

Key goal indicator. Measured after the project is done.

44
Q

What is KPI?

A

Key Performance indicator. Measured on one single task.

45
Q

What are KRIs?

A

Metrics that demonstrate the risk an organization is facing.

46
Q

Who sets Risk appetite?

A

Senior Management

47
Q

What is a secondary risk?

A

A risk that may open another risk

48
Q

Where are risks tracked?

A

The risk register

49
Q

Single use passwords are what authentication type?

A

Type 2. Something you have.

50
Q

What are the access control categories?

A

Administrative (Directive) controls

Technical (logical) controls - Hardware, Software, Firmware

Physical controls

51
Q

What are Administrative (Directive) control examples?

A

Policies, procedures, and laws we need to adhere to.

52
Q

What are Technical (logical) control examples?

A

Hardware, software, firmware, smart cards, etc..

53
Q

What are Physical access control examples?

A

Locks, doors, fences, dogs, man traps, alarms, cameras.

54
Q

What are preventative controls?

A

They prevent actions from happening.

Least privileged access
IPS
Drug Tests

55
Q

What are detective controls?

A

They detect during or after an attack

IDS
Alarms
Logs
Camera

56
Q

What are corrective controls?

A

Controls that correct an attack

AV
Patches

57
Q

What are recovery controls?

A

controls to help us recover after an attack.

Disaster recovery plans
Backups
HA environments

58
Q

What are deterrent access controls?

A

controls that deter and attack, but don’t stop anything.

Guard
Dog
Camera

59
Q

What is a compensating control?

A

Controls that compensate.

A guard stationed around a break in the fence.

60
Q

What are the four code of ethics cannons?

A

Protect society and the common good

Act honorably, honestly, justly,legally

Provide diligent and competent service

Advance and protect the profession

61
Q

Who sets governance?

A

Senior Leadership

62
Q

What kind of law is HIPAA?

A

Administrative Law

63
Q

What is an example of private regulations?

A

PCI DSS

64
Q

Are security breach notification laws federal?

A

No, all 50 states have individual laws.

65
Q

What is the electronic communications privacy act?

A

Protection against warrantless wiretapping. weakened by the Patriot Act.

66
Q

Who does GDPR protect?

A

The EU and EEA citizens

67
Q

Who handles the tactical planning?

A

Management

68
Q

hat can be used to help build policies?

A

Our strategy

ISC2 Cyber Security (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions