Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP 2024 > Domain 1: Study Essentials > Flashcards

Domain 1: Study Essentials Flashcards

1
Q

What does confidentiality seek to prevent?

A

Confidentiality seeks to prevent the unauthorized disclosure of information: it keeps data secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the goal of integrity?

A

Integrity seeks to prevent unauthorized modification of information and ensure that data written in an authorized manner is complete and accurate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does availability ensure?

A

Availability ensures that information is available when needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an active entity in an information system called?

A

Subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a passive data file referred to as?

A

Object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does Annualized Loss Expectancy represent?

A

The cost of loss due to a risk over a year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a threat?

A

A potentially negative occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a vulnerability?

A

A weakness in a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What defines risk?

A

A matched threat and vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a safeguard?

A

A measure taken to reduce risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does Total Cost of Ownership refer to?

A

The cost of a safeguard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Return on Investment?

A

Money saved by deploying a safeguard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the elements of the CIA Triad?

A

The elements are confidentiality, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does confidentiality mean?

A

Confidentiality is the principle that objects are not disclosed to unauthorized subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does integrity mean?

A

Integrity is the principle that objects retain their veracity and are intentionally modified only by authorized subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does availability mean?

A

Availability is the principle that authorized subjects are granted timely and uninterrupted access to objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the elements of AAA services?

A

AAA services focus on identification, authentication, authorization, auditing, and accounting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How does identification work?

A

Identification is when a subject professes an identity and accounting is initiated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is authentication?

A

Authentication is the process of verifying or testing that a claimed identity is valid.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the role of authorization in security?

A

Authorization ensures that the requested activity or object access is possible given the rights and privileges assigned to the authenticated identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the auditing process?

A

Auditing is the programmatic means by which subjects are held accountable for their actions while authenticated on a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Why is accounting important in security?

A

Effective accounting relies on the capability to prove a subject’s identity and track their activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is abstraction in security?

A

Abstraction is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are security boundaries?

A

A security boundary is the line of intersection between any two areas, subnets, or environments that have different security requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is security governance?

A

Security governance is the collection of practices related to supporting, defining, and directing the security efforts of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is third-party governance?

A

Third-party governance is the system of external entity oversight that may be mandated by law, regulation, or contractual obligation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is documentation review?

A

Documentation review is the process of reading the exchanged materials and verifying them against standards and expectations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How does security function align with business strategy?

A

Security management planning aligns the security functions to the strategy, goals, mission, and objectives of the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a business case?

A

A business case is usually a documented argument to define a need to make a decision or take some form of action.

30
Q

What is security management planning?

A

Security management is based on strategic, tactical, and operational plans.

31
Q

What are the elements of a formalized security policy structure?

A

The elements include security policy, standards, baselines, guidelines, and procedures.

32
Q

What are key security roles?

A

The primary security roles are senior manager, security professional, asset owner, custodian, user, and auditor.

33
Q

What is due diligence?

A

Due diligence is establishing a plan, policy, and process to protect the interests of an organization.

34
Q

What is due care?

A

Due care is practicing the individual activities that maintain the due diligence effort.

35
Q

What is threat modeling?

A

Threat modeling is the security process where potential threats are identified, categorized, and analyzed.

36
Q

What are the concepts of supply chain risk management (SCRM)?

A

SCRM is a means to ensure that all the vendors or links in the supply chain are reliable, trustworthy, reputable organizations that disclose their practices and security requirements to their business partners.

37
Q

What is a computer-assisted crime?

A

A computer-assisted crime occurs when a computer is used as a tool to help commit a crime.

38
Q

How can criminals steal confidential organizational data?

A

Criminals can steal confidential organizational data in many different ways, and this can occur without a computer.

39
Q

What is a computer-targeted crime?

A

A computer-targeted crime occurs when a computer is the victim of an attack that’s sole purpose is to harm the computer and its owner.

40
Q

What are examples of computer-targeted crimes?

A

Examples include denial-of-service (DoS) and buffer overflow attacks.

41
Q

What is an incidental computer crime?

A

An incidental computer crime occurs when a computer is involved in a computer crime without being the victim of the attack or the attacker.

42
Q

What is an example of an incidental computer crime?

A

A computer being used as a zombie in a botnet is part of an incidental computer crime.

43
Q

What is a computer prevalence crime?

A

A computer prevalence crime occurs due to the fact that computers are so widely used in today’s world.

44
Q

What is an example of a computer prevalence crime?

A

Software piracy is an example of this type of crime.

45
Q

What is the difference between hackers and crackers?

A

Hackers attempt to break into secure systems to obtain knowledge, while crackers do so without using the knowledge for nefarious purposes.

46
Q

What is Civil Law?

A

Civil law, also known as civil code law, is based on written laws and does not rely on precedence. It is the most common legal system in the world.

47
Q

What is Common Law?

A

Common law, developed in England, is based on customs and precedent. It requires lower courts to follow higher court decisions.

48
Q

What are the three systems of Common Law?

A

Common law is divided into criminal law, civil/tort law, and administrative/regulatory law.

49
Q

What does Criminal Law cover?

A

Criminal law covers actions harmful to others and requires proof of guilt beyond a reasonable doubt.

50
Q

Who prosecutes in Criminal Law?

A

The plaintiff is usually the state or federal government.

51
Q

What are the consequences in Criminal Law?

A

Guilty parties may be imprisoned and/or fined.

52
Q

What does Civil/Tort Law deal with?

A

Civil/tort law addresses wrongs committed against individuals or organizations.

53
Q

What must a plaintiff prove in Civil/Tort Law?

A

The plaintiff must prove that the defendant had a duty of care, breached that duty, and caused harm.

54
Q

What types of damages can a victim seek in Civil Law?

A

Victims can seek compensatory, punitive, and statutory damages.

55
Q

What is Administrative/Regulatory Law?

A

Administrative law sets performance standards by government agencies for organizations and industries.

56
Q

What sectors are covered by Administrative/Regulatory Law?

A

Common sectors include public utilities, communications, banking, and healthcare.

57
Q

What is Customary Law?

A

Customary law is based on the customs of a country or region and is often incorporated into mixed legal systems.

58
Q

What is Religious Law?

A

Religious law is based on religious beliefs and varies by culture and country.

59
Q

What is Mixed Law?

A

Mixed law combines two or more types of law, often civil law and common law.

60
Q

What is a Patent?

A

A patent grants exclusive rights to an invention for a period of time, usually 20 years.

61
Q

What is a Trade Secret?

A

A trade secret protects proprietary information and can be kept indefinitely if confidentiality is maintained.

62
Q

What is a Trademark?

A

A trademark protects symbols, sounds, or expressions that identify a product or organization.

63
Q

How long is a Trademark valid?

A

A trademark is valid for 10 years and must be renewed.

64
Q

What is Copyright?

A

Copyright protects authored works from reproduction without consent and lasts for the life of the author plus 70 years.

65
Q

What is Freeware?

A

Freeware is software available free of charge, including rights to copy, distribute, and modify.

66
Q

What is Shareware?

A

Shareware is software shared for a limited time that requires purchase after a trial period.

67
Q

What is Commercial Software?

A

Commercial software is licensed for purchase in a wholesale or retail market.

68
Q

What is Software Piracy?

A

Software piracy is the unauthorized reproduction or distribution of copyrighted software.

69
Q

What is Digital Rights Management (DRM)?

A

DRM controls the use of digital content and involves device controls.

70
Q

What does the U.S. DMCA of 1998 impose?

A

The DMCA imposes criminal penalties on those who circumvent content protection technologies.

71
Q

What are the steps of NIST risk management framework

A

The NIST risk management framework includes the following steps:

  1. Categorize information systems.
  2. Select security controls.
  3. Implement security controls.
  4. Assess security controls.
  5. Authorize information systems.
  6. Monitor security controls.
72
Q

What is eDiscovery?

A

Electronic discovery (eDiscovery) refers to civil litigation or government investigations that deal with the exchange of information in electronic format as part of the discovery process.

CISSP 2024 (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions