Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 2 - Asset Management > Flashcards

Domain 2 - Asset Management Flashcards

1
Q

What is data acquisition?

A

The creation or retrieval of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are top secret and confidential classifications considered to be when applied to data?

A

Exceptionally grave damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What arethe secret or private data classifications considered to be?

A

Serious Damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the confidential and sensitive data classifications considered to be?

A

Damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are labels assigned to?

A

Objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What manipulates objects?

A

Subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who are the mission and business owners in data policies?

A

Senior executives / management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who are the data / information owners in data policies?

A

Managers. They assign sensitivity labels and backup frequency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Who are the data custodians in data policies?

A

Technical employess who handle backups, restore data, patch, etc..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Who are the system owners in data policies?

A

Managers and they are the owner of the systems that house the data. Like the infrastructure team.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Who are the data controllers and data processors in data policies?

A

They create and manage sensitive data in the organization. Processors manage data for controllers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is non-volatile memory?

A

It retains data in memory even after power loss. Most common use is the BIOS. Also known as ROM (Read only memory).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Programmable read only memory (PROM)?

A

Programmable, but usually done at the factory and could not be updated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Erasable Programmable read only memory (EPROM)?

A

erasable read only memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Electronically erasable read only memory (EEPROM)?

A

Electronically erasable read only memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Where is L1 cache located?

A

On the CPU and is the fastest.W

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the definition of Sanitization in data destruction?

A

It is a process of rendering target data infeasible for a given level of recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the definition of purge in data destruction?

A

removing sensitive data from a system or device to a point where data recovery is no longer feasible even in a lab environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is degaussing?

A

It is used for destroying magnetic media. It is useless on SSD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Cloud Access Security Broker (CASB)?

A

Monitors user activity and enforces security policy compliance. Think AWS config.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In discretionary access control, who gives subjects ownership of objects.

A

Users give access to their files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How does access control work when dealing with mandatory access control?

A

Based on a subjects clearance and an object’s labels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is RUBAC?

A

Rule based access control based on IF and THEN statements. Like a firewall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the focus of the Bell-Lapadula security model focus?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What type of access control is Bell-Lapadula?

A

Mandatory Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the properties of Bell-Lapadula

A

No write ups
No write down
No read or write up and down.

(Think clearances)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the focus of the Biba security model?

A

integrity

28
Q

What are the properties of the Biba?

A

No read down
No write up
No read or write up

29
Q

What access control type is Biba?

A

Mandatory Access Control

30
Q

What is Lattice (Label) Based Access Control?

A

Users have multiple access rights. Very complex.

31
Q

What is the Grahm-Denning Model?

A

Uses objects, subjects, and rules.. Has 8 rules that a specific subject can execute.

32
Q

What is Harrisonn-Ruzzo-Ullman model?

A

An OS level security model that dealsw ith the integrity of access rights in the system.

33
Q

What part of the CIA triad does the Clark-Wilson model focus on?

A

Integrity

34
Q

Describe the key points of the Clark Wilson Model?

A

Uses Subjects, Programs, and Objects.

Programs are between subjects and objects.

35
Q

What is the Brewer Nash Model?

A

Designed to mitigate conflict of interest in commercial organizations

36
Q

Describe how the Brewer Nash model works?

A

No information can flow between the subjects and objects in a way that would create a conflict of interest.

37
Q

What is the non-interference model and how does it work?

A

It ensures that any actions that take place at a higher security level do no affect or interfere with actions at a lower level.

38
Q

What is the take grant protection model and how does it work?

A

It uses rules that govern the interactions between subjects and objects.

39
Q

What is the Zachman Framework and how does it work?

A

This is used for enterprise architecture and has six frameworks. The what, how, where, who, when, and why. The frameworks get mapped to rules for planners, owners, designers, builders, programmers, and users.

40
Q

What access control can be used for security modes?

A

Mandatory Access Control and Discretionary access control.

41
Q

How is the mode determined?

A

By the types of users, data, and the levels of users.

42
Q

What are the requirements for dedicated security mode?

A

Signed NDA for all data
Proper Clearance for all data
Formal Access Approval for all data
Valid Need to know for all data

All users can access ALL data.

43
Q

What are the requirements for system high security mode?

A

Signed NDA for all data
Proper Clearance for all data
Formal Access Approval for all data
A valid need to know for some of the data
All users can access SOME data based on their need to know.

44
Q

What are the requirements for compartmented security mode?

A

Signed NDA for all data
Proper Clearance for all data
Formal Access Approval for some data
A valid need to know for some of the data
All users can access SOME data based on their need to know.

45
Q

What are the requirements for multilevel security mode?

A

Signed NDA for all data
Proper Clearance for some data
Formal Access Approval for some data
A valid need to know for some of the data
All users can access SOME data based on their need to know.

46
Q

What is the orange book in the rainbow series?

A

Earliest book which most security models are based on today. It is called the Trusted Computer System Evaluation Criteria (TCSEC).

47
Q

What is the red book in the rainbow series?

A

It addresses network systems and described The Trusted Network Interpretation (TNI).

48
Q

What is ITSEC?

A

It is the European information technology security evaluation Criteria model

49
Q

What is the international common criteria (ISO/IEC 15408)?

A

Still in use for evaluage.

50
Q

What is the target of evaluation?

A

It is the product or system that is the subject of evaluation.

51
Q

What is the protection profile?

A

It is a document which identifies security requirements for a group of devices.W

52
Q

What is a security target?

A

A document that identifies the security properties of the target of evaluation.

53
Q

What are evaluation assurance levels?

A

They score compliance against a benchmark of 7 levels. Higher level means higher compliance.

54
Q

What is the PASTA Threat Model?

A

It is attacker focused.

Gives a dynamic threat identification, enumeration, and scoring process

Stages are:
Definition of objective
definition of the technical scope
Application decomposition and Analysis (ADA)
Threat Analysis
Weakness and vulnerability analysis
Attack modeling and Simulation
Risk analysis and Management

55
Q

What is the STRIDE threat model?

A

It is developer focused and has six categories

spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

56
Q

What is the TRIKE threat model?

A

Acceptable Risk Focus

57
Q

What is the DREAD threat model?

A

categorizes the impact by a score

58
Q

What are the security domains?

A

A list of objects a subject is allowed to access, groups of objects and subjects with similar requirements.

59
Q

What is kernal mode?

A

It allows a low-level unrestricted access to memory, cpu, disk, etc.

60
Q

What is user mode?

A

No direct access to hardware. Access is directed through an API.

61
Q

What are open systems?

A

They use open standards and can use standard components.

62
Q

What are closed systems?

A

They use proprietary hardware and software

63
Q

What is the ring model?

A

It separates trusted from untrusted.

Ring 3 User applications
Ring 2 Device Drivers
Ring 1 Other device drivers

64
Q

What ring does a hypervisor sit on in the ring model?

A

It sits at -1

65
Q
A

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions