Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA > Domain 5: Protection of Information Assets > Flashcards

Domain 5: Protection of Information Assets Flashcards

1
Q

In regards to the security baseline, what should the auditor first ensure?

A

The IS auditor should ensure the sufficiency of the baseline to address the security requirements of the organisation. Other aspects can be determined after.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the four types of power failure?

A

Blackout, Brownout, “sags, spikes and surges” and Electromagnetic interference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a brownout?

A

Where power has severely reduced voltage. Can strain devices and lead to permanent device damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the purpose of surge and spike devices?

A

Surge and Spike devices help to protect against high-voltage power bursts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are sags, spikes and surges?

A

Sag is a rapid decrease in voltage level. Surge and Spike is a rapid increase in voltage level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the most effective control to protect against short-term reduction in power?

A

A power line conditioner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a wet-based sprinkler?

A

A sprinkler where water remains in the system piping, considered more effective and reliable but is at risk of water damage if pipes leak.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a dry pipe sprinkler?

A

Dry pipe sprinklers rely on a pump to send the water into the system. This is less effective and reliable but does not have the risk of water leaks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a Halon system?

A

Halon gas starves the fire by removing oxygen from the air, because of this - all humans should be evacuated prior to releasing halon gas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are two alternatives to Halon gas?

A

FM-200 is one alternative and is the most commonly use fire suppression gas. Argonite is another alternative.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the most effective control to protect against the long-term unavailability of electrical power?

A

An alternative power supply

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the most effective control to protect against high-voltage power burst?

A

A surge device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the risk of carbon dioxide and Halon gas?

A

Suffocation in a closed room as both reduce oxygen in the atmosphere

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the most effective control when dealing with site visitors?

A

Escorting visitors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the safest gas to be used as a fire extinguisher?

A

FM-2000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the greatest concern for an IS auditor reviewing the fire safety arrangements?

A

The use of a carbon dioxide based fire extinguisher in a human accessed room

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Mandatory Access Control? (MAC)

A

Control rules are goverened by an approved policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Discretionary Access Control? (DAC)

A

Control access can be activated or modified by the data owner as per their discretion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the 4 steps for implementing logical access?

A
  1. Prepare inventory of resources, 2. Classify the resources, 3. Labelling of resources and 4. Create an access control list
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Degaussing? (demagnetizing)

A

It is a process used to erase or destroy magnetic information stored on magnetic media such as hard drives, floppy disks, magnetic tapes, and credit cards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the three authentication factors that can be used for granting access?

A

Something you know (password), something you have (one-time password) and something you are (biometrics)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is non repudiation?

A

Protection against an individual who falsely denies having performed a certain action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Why is considering security and performance parameters most important when reviewing system controls?

A

As it helps to ensure that the objectives are alligned with the business objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a good method to prevent unauthrosied access to critical databases?

A

Blocking access after a specificed number of failed logins. This is preventive solution rather than detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the greatest risk for SSO?

A

Greater impact of password leakage as only password is used to access many services. Enable 2/MFA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is False Acceptance Rate? (FAR)

A

The rate of acceptance of a false person. For example, if biometrics allows access to an unauthroised person, this is false acceptance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is False rejection rate? (FRR)

A

The rate of rejection of the correct person. For example, if biometrics rejects an authorised person, this is false rejection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is Cross error rate (CER) otherwise known as equal error rate (EER)?

A

This is the rate that FAR and FRR are equal. A biometric system with the lowest CER or EER is the most effective system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a biometric replay attack?

A

A replay attack is where an attacker makes use of residual biometric characteristics (fingerprints left on a device) to gain access.

30
Q

What is a biometric mimic attack?

A

A mimic attack is where an attacker tries to reproduce a fake biometric feature of a genuine user in order to gain access.

31
Q

What are the stages in the biometric life cycle?

A

Enrollment, storage, verification, identification and termination process

32
Q

What is the OSI layer model?

A

Physical, Data Link, Network, Transport, Session, Presentation and Application

33
Q

What is PD NT SPA

A

Please do not throw sausage pizza away

34
Q

What is attenuation?

A

Attenuation is the loss or weakening of a signal transmission.

35
Q

Which is the most secure transmission mediums (cable)?

A

Fibre optic

36
Q

Which OSI layer is primarily concerned with the reliability of data transfer between systems?

A

Transport layer

37
Q

What is a defense-in-depth security arrangement?

A

This concept includes the use of multiple security mechanisms that support and complement each other.`

38
Q

What are 4 types of firewall?

A

Packet filtering, stateful inspection, circuit-level and application level

39
Q

What are the types of firewall implementation?

A

Dual homed firewall, screened host firewall and screened subnet firewall or DMZ

40
Q

What is a packet filtering router?

A

A router that operates at the network layer which tracks IP addresses and port numbers of both source and destination addresses. It will take action per defined rules.

41
Q

What is stateful inspection firewall?

A

A stateful firewall monitors and tracks the destination of each packet that is being sent from the internal network.

42
Q

What is a circuit-level firewall?

A

A circuit-level firewall operates at the session layer. It facilitates secure communication between two network entities, such as a client and a server, by validating and controlling the establishment of TCP.

43
Q

What is an application level firewall?

A

It operates at the application layer and controls applications such as FTP and http.

44
Q

What is a bastion host?

A

A bastion host, also known as a jump box or a hardened server, is a highly secure and fortified server that is strategically placed on a network’s perimeter to protect other resources within the network. It acts as a gateway or entry point for accessing and managing internal systems and resources from external networks, such as the internet.

45
Q

What are the characteristics of a dual-homed firewall?

A

A packet filtering router facing the internet and connects to the bastion hosts NIC1. NIC2 of the bastion host links to the internal network

46
Q

What is the aim of a Session Border Controller (SBC)?

A

Protect VoIP sessions from DDOS attacks. Prevent toll fraud. Encrypt signals and provide QoS.

47
Q

What is symmetric encryption?

A

Where a single key is used to encrypt and decrypt data.

48
Q

What is asymmetric encryption?

A

Where two keys are used. One for encryption and one for decryption.

49
Q

What is required in encryption when the objective is confidentiality?

A

Encrypting with the receiver’s public key and the full message is encrypted.

50
Q

What is required in encryption when the objective is authentication/non-repudiation?

A

Encrypting with the sender’s private key and encrypting the hash of the message

51
Q

What is required in encryption when the objective is integrity?

A

Encrypting with the sender’s private key and encrypting the hash of the message

52
Q

What is required in encryption when the objective is confidentiality and authentication?

A

Using the receiver’s public key to encrypt the message and then using the sender’s private key to encrypt the hash of the message.

53
Q

What is required in encryption when the objective is confidentiality, integrity and authentication?

A

Using the receiver’s public key to encrypt the message and then using the sender’s private key to encrypt the hash of the message.

54
Q

For asymmetric encryption, how can message confidentiality be ensured?

A

Using a public key for encryption and using a private key for decryption

55
Q

In public key encryption, how can the sender of the message be authenticated?

A

Using the sender’s private key to encrypt the hash of the message and using the sender’s public key to decrypt it. The same applies for integrity.

56
Q

What is the most efficient use of PKI?

A

Using both symmetric and asymmetric methods

57
Q

What is a digital certificate?

A

A digital certificate is an electronic document used to prove the ownership of a public key.

58
Q

What is a certifying authority (CA)?

A

An entity that issues digital certificates

59
Q

What is a registration authority (RA)?

A

An entity that verifies user requests for digital signatures

60
Q

What is a certification revocation list (CRL)?

A

A CRL is a list of digital certificates that have been revoked and terminated by the CA prior to their expirary date and should no longer be trusted.

61
Q

What is a certification practice statement (CPS)?

A

A CPS is a document that states the practices and processes for the issuing and managemtn of digital certificates by the CA.

62
Q

What is PKI?

A

It is a set of roles, policies and procedures for the issuance, maintenance and revocation of public key certificates

63
Q

What is a hypervisor?

A

Software and hardware used to create virutal resources

64
Q

Accountability for the maintenance of appropriate security measures over information assets resides with whom?

A

Data owners

65
Q

A company is considering upgrading its existing virtual private network (VPN) to support voice-over IP (VoIP) communications via tunneling. What should be PRIMARILY addressed?

A

Reliability and QoS.

66
Q

What is the advantage of validated digital signatures for an email application?

A

Helps to detect spam.

67
Q

Why is exposing Electromagnetic emissions from a terminal a cpncern?

A

Provides information to an unathorised user.

68
Q

What is web of trust?

A

Web of trust is a key distribution method suitable for communication in a small group

69
Q

What is forward error control?

A

Forward error control involves transmitting additional redundant information with each character or frame to facilitate detection and correction of errors

70
Q

What is the goal of a web site certificate?

A

authentication of the web site that will be surfed

71
Q

How can Confidentiality of the data transmitted in a wireless LAN best be protected?

A

CISA (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions