Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

ISC2 Cyber Security > Domain 1 - Security Principles > Flashcards

Domain 1 - Security Principles Flashcards

1
Q

What is Information Security?

A

Secures everything.. Paper, documents voice, etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is IT security?

A

All hardware software, being processed, stored and communicated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Cyber Security?

A

Is everything from IT security that is accessible from the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the CIA triad stand for?

A

Confidentiality, Availability, and Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is confidentiality mean?

A

That there is no unauthorized access to the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the three states of data?

A

Data:

At rest
In motion
In use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does Integrity mean?

A

We ensure the data has not been altered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does availability mean?

A

Ensuring authorized people can access the data they need.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does DAD stand for?

A

Disclosure, Alteration, and Destruction . It is the opposite of the CIA triad.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the IAAA acronym stand for?

A

Identification
Authentication
Authorization
Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Identification?

A

Something that identifies you. Username, SSN, employee number.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an example of Type 1 Authentication? Also known as knowledge factors.

A

Something you know
Your pin number for the ATM
your password or passphrase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an example of Type 2 Authentication? Also known as possession factors.

A

ID
passport
token
smart code
MFA device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is an example of Type 3 Authentication? Also known as realistic or biometric factors.

A

It is something you are
Iris scan
facial geometry
fingerprint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are physiological characteristics?

A

Uses the shape of the body for type 3 authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are behavioral characteristics?

A

Uses the pattern of behavior of the person for type 3 athentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Authorization?

A

It is he process of assigning access to systems after a user has authenticated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is DAC (Discretionary Access Control)?

A

It’s when access to an object is assigned at the discretion of the object owner.

Commonly used when availability is most important.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is MAC (Mandatory Access Control?

A

Labels are assigned to objects and subjects (users) have clearance assigned to them to be able to see the objects.

commonly used when confidentiality is the most important

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is RBAC?

A

Role based access control. Access is based on a role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is ABAC (Attribute Based Access Control)?

A

Access to objects is based on subjects, objects, and environmental conditions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is context-based access control?

A

Access is provided to an object and is based on contextual parameters such as location, time, access history, etc..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is content based access control?

A

Access is provided on the attributes or content of an object. Think different data on the same website depending on who you are.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is accountability?

A

Tracing an action to a subject’s identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are subjects?
Users or applications
26
What are objects?
Any data
27
What is the formula for risk?
Threat * Vulnerability * Impact
28
What is the formula for total risk?
Threat * vulnerability * asset value
29
What is the formula for residual risk?
total risk - countermeasures
30
What is the high-level process for risk maagement?
Identify Risk Assess Risk Respond to Risk Risk monitoring
31
What is a qualitative risk analysis?
It is subjective. How likely something is to happen and how bad is it if it does happen. Happens first.
32
What is quantitative risk analysis?
What will it actually cost us in dollars.
33
What is due diligence?
Doing research before implementation
34
What is due care?
It is the implementation itself
35
What is the first step of the risk assessment processs?
Ensuring you have an inventory of your assets.
36
What are the risk strategies?
Risk mitigation Risk transference (share.. Like insurance) Risk acceptance Risk avoidance (not pursuing whatever is causing the risk)
37
What is the asset value in quantitative risk analysis?
The value of the asset in dollars
38
What is the exposure factor in quantitative risk analysis?
How much of the asset is lost in an incident
39
What is single loss expectancy in quantitative risk analysis?
How much a single incident will cost us
40
What is the annual rate of occurrence in quantitative risk analysis?
How many times a specific incident happens in a year.
41
What is the annualized loss expectancy in quantitative risk analysis?
How much will this cost if we don't mitigate the risk.
42
What is leftover risk called?
Residual Risk
43
What is a KGI?
Key goal indicator. Measured after the project is done.
44
What is KPI?
Key Performance indicator. Measured on one single task.
45
What are KRIs?
Metrics that demonstrate the risk an organization is facing.
46
Who sets Risk appetite?
Senior Management
47
What is a secondary risk?
A risk that may open another risk
48
Where are risks tracked?
The risk register
49
Single use passwords are what authentication type?
Type 2. Something you have.
50
What are the access control categories?
Administrative (Directive) controls Technical (logical) controls - Hardware, Software, Firmware Physical controls
51
What are Administrative (Directive) control examples?
Policies, procedures, and laws we need to adhere to.
52
What are Technical (logical) control examples?
Hardware, software, firmware, smart cards, etc..
53
What are Physical access control examples?
Locks, doors, fences, dogs, man traps, alarms, cameras.
54
What are preventative controls?
They prevent actions from happening. Least privileged access IPS Drug Tests
55
What are detective controls?
They detect during or after an attack IDS Alarms Logs Camera
56
What are corrective controls?
Controls that correct an attack AV Patches
57
What are recovery controls?
controls to help us recover after an attack. Disaster recovery plans Backups HA environments
58
What are deterrent access controls?
controls that deter and attack, but don't stop anything. Guard Dog Camera
59
What is a compensating control?
Controls that compensate. A guard stationed around a break in the fence.
60
What are the four code of ethics cannons?
Protect society and the common good Act honorably, honestly, justly,legally Provide diligent and competent service Advance and protect the profession
61
Who sets governance?
Senior Leadership
62
What kind of law is HIPAA?
Administrative Law
63
What is an example of private regulations?
PCI DSS
64
Are security breach notification laws federal?
No, all 50 states have individual laws.
65
What is the electronic communications privacy act?
Protection against warrantless wiretapping. weakened by the Patriot Act.
66
Who does GDPR protect?
The EU and EEA citizens
67
Who handles the tactical planning?
Management
68
hat can be used to help build policies?
Our strategy

ISC2 Cyber Security (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions