Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity > Domain 1: Security Principles > Flashcards

Domain 1: Security Principles Flashcards

1
Q

Which region enacted comprehensive legislation addressing personal privacy in 2016?

A

European Union

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the purpose of implementing security controls in the risk management process?

A

To mitigate減輕 the risk to an acceptable level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

If a pickpocket is a threat, what would be their attack vector?

A

Their technique and approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How do companies that offer identity theft insurance manage their own financial risk?

A

By calculating premium payments against potential payouts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What term is used to refer to information that, when combined with other pieces of data, significantly narrows缩小 the possibility of association with more individuals?

A

Personally Identifiable Information (PII)个人身份信息

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What potential risk can occur when a remote worker’s laptop is left unattended or unlocked?

A

Accidental introduction of unauthorized software with malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In the United States, which act governs the privacy of medical information?

A

HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In e-commerce and electronic transactions, what does non-repudiation protect against?

A

Falsely虛假地 denying transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an “asset” in the context of risk management terminology?

A

Something in need of protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Who is responsible for determining risk tolerance in an organization?

A

Executive management and board of directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Executive management and board of directors

A

Evaluate the likelihood of the event and take appropriate actions to mitigate the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which regulation grants data protection and control to individuals within the EU, regardless of citizenship?

A

General Data Protection Regulation (GDPR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What role might security professionals play in risk assessment at a system level?

A

Assisting in risk assessment at a system level

Security professionals are likely to assist in risk assessment at a system level, focusing on process, control, monitoring, or incident response and recovery activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Who is responsible for identifying risks within an organization?

A

Employees at all levels of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an example of a physical control?

A

Walls, fences, guards, locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

According to the code of ethics, what are information security professionals expected to uphold堅持?

A

Be honorable, honest, just and responsible within legal conduct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Multifactor authentication involves using two or more instances of different authentication factors.

Which of the following are considered a widely accepted factor for authentication?

A

Something you have
Something you are
Something you know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Kristal is the security administrator for a large online service provider. Kristal learns that the company is harvesting the personal data of its customers and sharing the data with local governments where the company operates, without the knowledge of the users, to allow the governments to persecute users on the basis of their political and philosophical beliefs.

The published user agreement states that the company will not share personal user data with any entities without the users’ explicit permission.

According to the ISC2 Code of Ethics, to whom does Kristal ultimately owe a duty in this situation?

A

The users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the primary purpose of the ISC2 Code of Ethics?

A

Ensuring the safety and welfare of society and the common good

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

While taking the certification exam for this certification, you notice another candidate for the certification cheating.

What should you do?

A

Report the candidate to ISC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What type of authentication process is used at the bank with an ATM card?

A

Two-factor authentication

The use of an ATM card (something you have) and a PIN (something you know) at the bank, providing two different factors of authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What type of cyber attack often targets the availability of data?

A

Ransomware attacks勒索軟體

Ransomware attacks often target the availability of data by locking up systems and blocking access to vital information and services. Access is typically restored only after a ransom is paid.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does knowledge-based authentication involve?

A

Differentiating between authorized and unauthorized users using a passphrase or secret code

passphrase or secret code (e.g., PIN or password)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the purpose of using a risk matrix?

A

To prioritize risks based on likelihood and impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What measures would a trauma center be most likely to take to ensure zero tolerance for power failure?

A

Redundancy in emergency power supplies, battery backup, and generators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which of the following is NOT one of the four typical ways of managing risk?

A

Conflate 合併

typical ways of managing risk:
Avoidance
Acceptance
Mitigation
Transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

When a company chooses to ignore a risk and proceed with a risky activity, which treatment is being applied by default?

A

Acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is risk tolerance often likened to?

A

Risk appetite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Siobhan is deciding whether to make a purchase online; the vendor wants Siobhan to create a new user account and is requesting Siobhan’s full name, home address, credit card number, phone number, email address, the ability to send marketing messages to Siobhan, and permission to share this data with other vendors.

Siobhan decides that the item for sale is not worth the value of Siobhan’s personal information, and decides to not make the purchase.

What kind of risk management approach did Siobhan make?

A

Avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is done with the result of the risk assessment process?

A

It is presented as a report or presentation to the management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A chief information security officer (CISO) at a large organization documented a policy that establishes the acceptable use of cloud environments for all staff.

A

Management/Administrative control

Policies, standards, processes, procedures and guidelines set by corporate administrative entities (e.g., executive- and/or mid-level management) are management/administrative controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Software security practitioners seek to maintain the CIA of systems and software based on business needs.

Which aspect of the CIA is focused on guaranteeing that authorized subjects are granted uninterrupted access to objects in a timely fashion?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the correct sequence of the elements in governance, starting from the highest level?

A

Regulations, standards, policies, procedures

34
Q

Guillermo is the system administrator for a midsized retail organization. Guillermo has been tasked with writing a document that describes, step-by-step, how to securely install the operating system on a new laptop.

This document is an example of a ________.

A

Procedure

35
Q

Lankesh is the security administrator for a small food distribution company. A new law is published by the country in which Lankesh’s company operates; the law conflicts with the company’s policies.

Which governance element should Lankesh’s company follow?

A

The law

36
Q

What term is sometimes used interchangeably可交替地 with “incident management”?

A
37
Q

What is the purpose of a red book in the context of business continuity?

A

To serve as a hard copy backup accessible outside the facility , containing outlined procedures in case electronic access is unavailable.

38
Q

Why are notification systems and call trees important in a business continuity plan?

A

To alert personnel when the BCP is being enacted實行

39
Q

What is a key outcome of a Business Impact Analysis (BIA)?

A

Identification of functions and dependencies

40
Q

In the United States, what type of networks can be used to maintain essential activity during a severe cyberattack that affects communications?

A

Military-grade networks

41
Q

What is the first phase in the components of an incident response plan?

A

Preparation

The components of the incident response plan are:
Preparation,
Detection & Analysis,
Containment, Eradication根除 & Recovery, and
Post-Incident Activity.

42
Q

What are the four primary responsibilities of a response team when an incident occurs?

A

Determining damage, assessing compromise, implementing recovery procedures, and supervising security measures

43
Q

What is the next step after detection and analysis in the incident response process?

A

Finding the appropriate containment strategy

44
Q

What is the key responsibility of the incident response team in the plan?

A

Assessing and scoping out damage

45
Q

An external entity has tried to gain access to your organization’s IT environment without proper authorization.

This is an example of a(n) _________.

A

Intrusion

46
Q

What is the key characteristic of a Zero Day vulnerability?

A

It does not fit recognized patterns, signatures, or methods

47
Q

What is the primary distinction 不同between business continuity planning (BCP) and disaster recovery planning (DRP)?

A

DRP is about restoring IT, while BCP focuses on business operations

48
Q

Which of the following is very likely to be used in a disaster recovery (DR) effort?

A

Data backups

49
Q

What is the purpose of the Executive Summary in a Disaster Recovery Plan?

A

To offer a high-level overview of the plan

50
Q

Who must provide support for business continuity planning efforts?

A

Executive management or an executive sponsor

51
Q

Which of these components is very likely to be instrumental to any disaster recovery (DR) effort?

A

Backups

52
Q

Why is it necessary to consider not only the server level but also the database and dependencies on other systems in disaster recovery plans for complex systems?

A

To address the intricate難理解的 dependencies of the systems

53
Q

You are working in your organization’s security office. You receive a call from a user who has tried to log in to the network several times with the correct credentials, with no success.

After a brief investigation, you determine that the user’s account has been compromised.

This is an example of a(n)_________.

A

Incident detection

Incident detection refers to the identification and recognition of a security incident, such as a compromised user account, within an organization’s network or information systems.

54
Q

Which of the following is an example of security control?

A

Firewall

55
Q

What is the definition of an object in the context of access controls?

A

An entity that responds to a request for service

56
Q

Derrick logs on to a system to read a file.

In this example, Derrick is the ______.

A

Subject

57
Q

Which of the following is a subject? -

A

User

58
Q

What is the strategy that integrates people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of an organization?

A

Layered Defense

59
Q

How does privileged access management implement the principle of least privilege?

A

By granting each user access only to the items they need

60
Q

Which of the following is an example of a logical access control method?

A

Biometrics on a smartphone

61
Q

Limiting access to data on the network would be considered which of the following controls?

A

Logical or technical controls

62
Q

What would be considered an administrative control in the context of seat belt usage?

A

Passing a law requiring seat belt use

63
Q

What alternative control could be used if biometric locks on multiple doors are not necessary and access does not need to be audited?

A

Replacing doors with deadbolt locks

64
Q

Which of these combinations of physical security controls share a single point of failure?

A

High-illumination lighting 高照度照明and cameras

Both lighting and cameras require power. A power failure will disable both the cameras and the lights.

65
Q

Which of the following is an example of a physical access control?

A

Motion detectors

66
Q

What challenges do small and medium businesses face regarding technical controls in payroll 工資稅systems?

A

Insufficient personnel for duty separation

67
Q

What does behavioral biometrics measure?

A

User actions, such as voiceprints and keystroke dynamics

68
Q

Which is a physical control that prevents “piggybacking” or “tailgating,” 緊隨when an unauthorized person follows an authorized person into a controlled area?

A

Turnstile

69
Q

In what type of environment does role-based access control work well?

A

High-staff turnover and similar access requirements

70
Q

What is user provisioning in identity management?

A

Managing access to resources and information systems

71
Q

What term is used to describe the situation where someone inherits expanded permissions that are not appropriate for their role in Role-based Access Control (RBAC)?

A

Privilege creep

72
Q

What is the key feature of just-in-time privileged access management?

A

Role-based subsets of privileges

73
Q

In Mandatory Access Control (MAC), what determines the level of access to certain areas in certain government agencies?

A

Government policy and security clearance

74
Q

Who can modify security rules in a system governed by Mandatory Access Control (MAC)?

A

Trusted subjects designated as security administrators

75
Q

Duncan and Mira work in the data center at Triffid, Inc. There is a policy in place that requires both to be present in the data center at the same time.

If one has to leave for any reason, the other must step out, too, until they can both re-enter.

This is called ________.

A

Two-person integrity

76
Q

Why is Discretionary Access Control (DAC) not considered very scalable?

A

It relies on the discretion of individual object owners

77
Q

What is the two-person rule in the context of security strategy?

A

Two people must be in an area together

78
Q

Why is it recommended to disable accounts for a period before deletion when an employee leaves the company?

A

To preserve the integrity of audit trails or files

79
Q

Lakshmi presents a user ID and a password to a system to log on.

Which of the following characteristics must the password have?

A

Confidential

80
Q

Which of the following is an example of a monitoring tool?

A

Cameras

81
Q

Which of the following is the responsibility of systems administrators who use privileged accounts?

A

Operating systems and applications

Systems administrators with privileged accounts have the principal responsibilities for operating systems, application deployment, and performance management.

Cybersecurity (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions