Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SSCP > Domain 2 - Security Operations > Flashcards

Domain 2 - Security Operations Flashcards

1
Q

What is a baseline?

A

A detailed configuration standard that includes specific security settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Some examples of Security Guidelines?

A
  1. Method for selecting a strong password.
  2. criteria for evaluating new security technology
  3. Suggest training curricula for staff.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a standard?

A

A formal, documented requirement that set uniform criteria for a specific technology, configuration, nomenclature, or method.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What helps organizations help maintain consistency in the way security risks are addressed?

A

Standards, baselines, procedures, and even guidelines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a procedure?

A

Step-by-step instructions for performing a specific task or set of tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the typical components of a procedure?

A 
Purpose
Applicability
Steps
Figures
Decision Points
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is release management?

A

A software engineering discipline that controls the release of applications, updates, and patches to the production environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the goal of release management?

A

To provide assurance that only tested and approved application code is promoted to production or distributed for use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Code Signing?

A

Assists users in validating that the application was issued by a trust source.

Typically used for web apps running Java or ActiveX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Smoke Tested?

A

High-level, scripted testing of the major application components and interfaces to validate the integrity of the application before making it available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Systems Assurance?

A

Process of validating that existing security controls are configured and functioning as expected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Change Control?

A

Process adopted by an organization to ensure that all changes to system and application software are subject to the appropriate level of management control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Change Control Process?

A 
Request Submission
Recording
Analysis/Impact Assessment
Decision Making and Prioritization
Approval
Status Tracking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CM

A

CONFIGURATION MANAGEMENT

Discipline that seeks to manage configuration changes so that they are appropriately approved and documented.

“Technical and Administrative’ Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Typical Steps in the configuration management process.

A 
Change Request
Approval
Documentation
Testing
Implementation
Reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Four Operational Aspects of CM

A

Identification
Control
Accounting
Auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CMBD

A

CONFIGURATION MANAGEMENT DATABASE

Holds information about the structure of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CI

A

CONFIGURATION ITEM

Component of each system listed in the CMBD using a name, number, and version ID.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Security Impact Assessment

A

Analysis conducted by qualified staff within an organization to determine the extent to which changes to the information system affect the security posture of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Interoperability

A

Describe the extent to which systems and devices can exchange data and interpret that shared data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Syntactical Interoperability

A

Two or more systems that are capable of communicating and exchanging data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Patch Management Process

A
  1. Acquisition - Find Patch
  2. Testing - Test Patch before installation
  3. Approval - Approve for deployment
  4. Packaging - Package or configure for OS.
  5. Deployment
  6. Verification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SSCP Domains

A 
Access Controls
Analysis and Monitoring
Cryptography
Malicious Code
Networks & Telecom
Risk, Response, & Recovery
Security operations and administration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

BMS

A

BALANCED MAGNETIC STRIP

Device that uses a magnetic strip to determine if an alarm signal is initiated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

PIR

A

PASSIVE INFRARED SENSORS

Common interior intrusion detection sensors.

ex. Occ Sensor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Electric Locks vs Electric Strikes

A

Electric Locks use the doors physical locks.

Electric Strikes - bolts remains the same, but strike is changed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Anti-Passback

A

Strategy where a person must present a credential to enter an area and again to leave.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

‘Mantrap”

A

When a person opens a door, and for the next door to open, the one just enter must securely close.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Rim Lock

A

Lock (or latch) typically mounted on the surface of a door.

Ex - dead bolt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Mortise Lock

A

Lock (or latch) that is recessed into the edge of a door rather than on the surface.

Ex - Handle + Lock in single package.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Locking Cylinders

A

Pin Tumbler cylinder is composed of circular pin tumblers that fit into matching circular holes on two internal parts of the lock.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Cipher Lock

A

Controlled by a mechanical key pad.

Think of front door handle with PIN pad on it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Vaults - Class M

A

One 1/4 hour

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Vaults - Class 1

A

One 1/2 hour

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Vaults - Class 2

A

One hour

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Vaults - Class 3

A

Two hours

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Classified Container

A

Reinforced Filing Cabinet that can store proprietary and sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Cable Plant Management

A

Design, Documentation, and management of layer 1 in the OSI model, the Physical Layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

MTBF

A

MEAN TIME BEFORE FAILURE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Two-Person Rule

A

Strategy where two people must be in an area together, making it impossible for a person to be in the area alone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Two main categories of smoke detectors

A
  1. Optical (Photoelectric)

2. Physical (Ionization)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Three Types of Fire Detectors

A
  1. Flame Detectors
  2. Smoke Detectors
  3. Heat Detectors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Two Types of Flame Detectors

A
  1. IR

2. UV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Four Groups of Sprinkler Systems

A
  1. Wet Systems - Constant supply of water
  2. Dry Systems - Releases when value is stimulated by excess heat.
  3. Pre-Action - No water until detectors in the area are activated. Removes ‘False Alarms’.
  4. Deluge - Same as pre-action, but all sprinkler heads are in the open position.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

2 Types of Gas Suppression

A
  1. Aero-K: Uses aerosol of potassium

2. FM-200: Colorless, liquefied compressed gas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

6 Aspects in the Change Control Policy Document

A
  1. Request Submission
  2. Recording
  3. Analysis/Impact Assessment
  4. Decision Making & Prioritization
  5. Approval
  6. Status Tracking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Operational Aspects of CM?

A

Identification, Control, Accounting, Auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Systems Certification Process?

A

Method of validating adherence to security requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Dual Control

A

Antifraud measure that requires two people to complete a transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Waterfall Model

A

Development method that follows a linear sequence of steps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What two things are used to accomplish non-repudiation?

A

Digital Signatures

Public Key Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the elements that make up IS risks?

A

Threat, Vulnerability, Impact

Risk = Threat + Vulnerability + Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Remote Attestation

A

Form of integrity protection that makes use of a hashed copy of hardware and software configuration to verify that configurations have not been altered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

4 Tenets of the Code of Ethics

A
  1. Protect Society, commonwealth, and infrastructure
  2. Act honorably
  3. Provide Diligent service to principals
  4. Advance/Protect Profession
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Confidentiality

A

Property of information in which it is only made available to those who have a legitimate need to know.

56
Q

Integrity

A

Property of information whereby it is recorded, used, and maintained in a way that ensures its accuracy.

57
Q

RAID

A

REDUNDANT ARRAY OF INDEPENDENT DISKS

ex. Controllers, UPS, Backup and recovery

58
Q

Non-repudiation

A

Service that ensures the sender cannot deny a message was sent and the integrity of the message is intact.

59
Q

(ISC)2 Code of Ethics

A
  1. Protect Society, commonwealth, and infrastructure
  2. Act honorably, honestly, justly, responsibly, and legally. 3. Provide diligent and competent service to principals 4. Advance and protect the profession.
60
Q

Donn Parker’s 5 Ethical Principles

A
  1. Informed Consent
  2. Higher ethic in the worst case
  3. Change of Scale Test
  4. Owner’s conservation of ownership
  5. , User’s conservation of ownership
61
Q

C-I-A Triad

A

Confidentiality
Integrity
Availability

62
Q

Confidentiality

A

Property of information in which it is only made available to those who have a legitimate need to know.

63
Q

Methods for Maintaining a level of Confidentiality

A

Authorization
Identity
Access Management Encryption and Disclosure controls

64
Q

DLP

A

Data Leakage Prevention

65
Q

Integrity

A

Property of information whereby it is recorded, used, and maintained in a way that ensures it’s completeness, accuracy, internal consistency, and usefulness for a stated purpose.

66
Q

Systems Integrity

A

Maintenance of a known good configuration and expected operational function.

67
Q

Sarbanes-Oxley Act of 200

A

Mandates certain controls over the integrity of financial reporting.

68
Q

SLA

A

Service Level Agreement

Specify percentage of uptime as well as support procedures and communication for planned outages.

69
Q

RTO

A

Recovery Time Objectives Specify the acceptable duration of an unplanned outage due to catastrophic system non-availability.

70
Q

Non-repudiation

A

Service that ensures the sender cannot deny a message was sent and the integrity of the message is intact.

71
Q

Security Architecture

A

The practice of designing a framework for the structure and function of information security systems and practices in the organization.

72
Q

Essential Best Practices Include:

A 
Defense-in-depth
Risk-based controls
 Least Privilege 
Authorization
Accountability 
Separation of Duties
73
Q

Calculate Risk Equation

A

IMPACT + VULNERABILITY + THREAT = RISK

74
Q

LUA

A

“Least User Access “

“Least Privilege”

75
Q

Difference Categories of Controls

A
  1. Management - Controls concerning risk (Policy and Procedures)
  2. Technical - Executed in hardware,software, and firmware.
  3. Operational - Primarily implemented and executed by people.
76
Q

NIST SP 800-88

A

NIST Matrix for Determining Requirements for Clearing and Sanitizing Media

77
Q

Oersteds

A

Unit of measurement for the intensity of the magnetic energy a disk or tape can store.

78
Q

Degaussing

A

A technique of erasing data on disk or tape that ensures that there is insufficient magnetic remanances to reconstruct data.

79
Q

IRM

A

Information Rights Management

Functions to assign specific properties to an object such as how long the object may exist, what users can access it, and if any notifications should be sent if any changes occur.

80
Q

Data Scrubbing

A

aka Data Sanitization

Obfuscate sensitive data in such a way that the actual data values cannot be deduced or derived from the sanitized data itself.

81
Q

DeDupication

A

Process that scans the entire collection of information looking for similar chucks of data that can be consolidated.

82
Q

ITAM

A

IT Asset Management

Entails collecting inventory, financial, and contractual data to manage the IT Asset throughout its life cycle.

83
Q

Session Management

A

Includes timing out inactive sessions, deleting session information after timeout, not passing credentials in URL strings, and using salted hashes to protect session IDs.

84
Q

CSRF

A

Cross Site Request Forgery

Forces a logon victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other authentication information, to a vulnerable web app. Allows attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

85
Q

Missing Function Level Access Control

A

While most web apps verify function-level access rights before making that functionality visible in the UI, apps need to perform the same AC checks on the server when each function is accessed. If not verified, attackers will be able to forge requests in order to access functionality without proper authorization.

86
Q

Insecure Direct Object References

A

Direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Attacker can manipulate these reference to access unauthorized data.

87
Q

XSS

A

Cross Site Scripting

Flaws that occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. Allows attackers to execute script in the victim’s browser, which can hijack user sessions, deface websites, or redirect the user to malicious sites.

88
Q

Injection

A

SQl, OS, and LDAP Injections, occur when untrusted data is sent to an interpreter as part of a command or query. Attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

89
Q

OWASP Top 10

A
  1. Injection
  2. Broken Authentication & Session Management
  3. XSS - Cross Site Scripting
  4. Insecure Direct Object References
  5. Security Misconfiguration
  6. Sensitive Data Exposure
  7. Missing Function Level AC
  8. CSRF (Cross Site Request Forgery)
  9. Using Components with Known Vulnerabilities
  10. Un-validated Redirects and Forwards
90
Q

OWASP

A

Open Web Application Security Project

Free, available listing of the top vulnerabilities found in web applications.

91
Q

Agile

A

Example of Iterative Development Model.

Relies on feedback from application users and development teams as their primary control mechanism.

92
Q

RAD

A

Rapid Application Development

Leverage modern development environments that make it possible to quickly build UI components as requirements are gathered.

PROS? Quick and typically catches issues early.

CONS? Can suffer from ‘Scope Creep’, as new requirements are continually added and teams lose sight of the end goal.

93
Q

Spiral Model

A

Similar to the Waterfall Development Cycle, but adds a repeated PDCA (Plan-Do-Check-Act) sequence at the end of each stage.

94
Q

What phase is Web App design is the Software programming completed?

A

Implementation

95
Q

Who participates in the design phase of a Web App?

A

Security Architect or administrator.

96
Q

The general designed document, once refined to produce specifications for the….

A

Detailed design.

97
Q

Where the design may first be laid out?

A

General Design Document

98
Q

“Who signs off the ‘Requirements Gathering and Analysis”

A

Project Sponsor and stakeholders

99
Q

The Waterfall Model

A

6 Steps for developmental software applications as safely and securely as possible.

  1. Requirement Gathering and Analysis
  2. System Design
  3. Implementation
  4. Integration
  5. Deployment
  6. Maintenance
100
Q

UML

A

Unified Modeling Language

Documentation of the sequences of actions called uses cases.

101
Q

Authorization Official or Approver

A

Senior executive or manager with the authority to assume full responsibility for the system covered in the system security plan.

102
Q

Security Officer

A

Responsible for coordinating development, review, and acceptance of security plans and for IDENTIFICATION, IMPLEMENTATION, ADMINISTRATION, and ASSESSMENT.

103
Q

Information Owner

A

Has overall authority for the information stored, processed, or transmitted by the system. Responsible for specifying policies for appropriate use of information and security requirements for protecting information in the system.

104
Q

System Owner

A

Responsible for decisions regarding system procurement or development, implementation and integration, and operation and ongoing maintenance.

105
Q

System Security Plan

A

Comprehensive document that details the security requirements for a specific system, the controls established to meet those requirements, and the responsibilities and expected behaviors of those administering and accessing the system.

106
Q

AC (Security Control)

A

Access Control

Technical

107
Q

AT (Security Control)

A

Awareness Training

Operational

108
Q

AU (Security Control)

A

Audit and Accountability

Technical

109
Q

CA (Security Control)

A

Security Assessment and Authorization

Management

110
Q

CM (Security Control)

A

Configuration Management

Operational

111
Q

CP (Security Control)

A

Contingency Planning

Operational

112
Q

IA (Security Control)

A

Identification and Authentication

Technical

113
Q

IR (Security Control)

A

Incident Response

Operational

114
Q

MA (Security Control)

A

Maintenance

Operational

115
Q

MP (Security Control)

A

Media Protection

Operational

116
Q

PE (Security Control)

A

Physical & Environmental Protection

Operational

117
Q

PL (Security Control)

A

Planning

Management

118
Q

PM (Security Control)

A

Project Management

Management

119
Q

PS (Security Control)

A

Personnel Security

Operational

120
Q

RA (Security Control)

A

Risk Assessment

Management

121
Q

SA (Security Control)

A

System and Services Acquisition

Management

122
Q

SC (Security Control)

A

System and Communications Protection

Technical

123
Q

SI (Security Control)

A

System and Information Integrity

Operational

124
Q

Directive (Controls)

A

Designed to specify acceptable rules of behavior within an organization.

125
Q

Deterrent (Controls)

A

Designed to discourage people from violating security directives.

126
Q

Preventive (Controls)

A

Prevent a security incident or information breach.

127
Q

Compensating (Control)

A

Implemented to substitute for the loss of primary controls and mitigate risk down to an acceptable level.

128
Q

Detective (Control)

A

Designed to signal a warning when a security control has been breached.

129
Q

Corrective (Control)

A

Implement to remedy circumstance, mitigate damage, or restore controls.

130
Q

Recovery (Control)

A

Implemented to restore conditions to normal after a security incident.

131
Q

System Security Plan

A

Comprehensive document that details the security requirements for a specific system, the controls established to meet those requirements, and the responsibilities and expected behaviors of those administering and accessing the system.

132
Q

System Owner

A

Responsible for decisions regarding system procurement or development, implementation and integration, and operation and ongoing maintenance.

133
Q

Information Owner

A

Has overall authority for the information stored, processed, or transmitted by the system. Responsible for specifying policies for appropriate use of information and security requirements for protecting information in the system.

134
Q

Security Officer

A

Responsible for coordinating development, review, and acceptance of security plans and for IDENTIFICATION, IMPLEMENTATION, ADMINISTRATION, and ASSESSMENT.

135
Q

Authorizing Official or Approver

A

Senior executive or manager with the authority to assume full responsibility for the system covered in the system security plan.

SSCP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions