Domain 6

Question 1

NIST 800-53A

Answer 1

NIST best practices for conducting security & privacy assessments

Question 2

Security assessment and testing programs

Answer 2

Every organization should have a security assessment and testing program defined and operational.

provides a mechanism for validating the ongoing effectiveness of security controls, with a variety of tools to validate controls:

• vulnerability assessments
• penetration tests, software testing
• audits
• security management tasks

Question 3

Vulnerability Assessments

Answer 3

use automated tools to search for known vulnerabilities in systems, applications, and networks.

flaws may include missing patches, misconfigurations, or faulty code that expose the organization to security risks.

Question 4

Penetration tests

Answer 4

uses these same tools but supplements them with attack techniques where an assessor attempts to exploit vulnerabilities
and gain access to the system.

Question 5

Penetration test strategies

Answer 5

• War Dialing – Bank of Modems
• Sniffing – Monitor the Network
• Eavesdropping – Listening
• Dumpster Diving – Just like it sounds
• Social Engineering – Human Manipulation

Question 6

Employment Policies and Practices

Answer 6

Termination process and background checks

write

Question 7

Roles and Responsibilities

Answer 7

Management sets the standard and verbalizes the policy

communicate

Question 8

Security Awareness Training

Answer 8

Prevents Social Engineering, helps with phishing

train

Question 9

Software testing

Answer 9

techniques verify that code functions as designed and does not contain security flaws. (static and dynamic)

Perform software testing to validate code moving into production

Question 10

Code review

Answer 10

uses a peer review process to formally or informally validate code before deploying it in production.

Question 11

Interface testing

Answer 11

assesses the interactions between components and users with API testing, user interface testing, and physical interface testing.

Question 12

Static Software testing

Answer 12

techniques include code reviews, evaluate the security of software without
running it by analyzing either the source code or the compiled application.

Question 13

Dynamic Software testing

Answer 13

evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else. (written by someone else is not a requirement)

Question 14

Fuzzing (testing technique)

Answer 14

Uses modified inputs to test software
performance under unexpected circumstances

Modifies known inputs to generate synthetic inputs that may trigger unexpected behavior

Generational fuzzing develops inputs based on models of expected inputs to perform same task

Question 15

Log Reviews

Answer 15

particularly for administrator activities, ensure that systems are not misused.

Question 16

Account Management Reviews

Answer 16

ensure that only authorized users retain access to information systems.

Question 17

Backup Verification

Answer 17

ensures that the organization’s data protection process is functioning properly

Question 18

Key Performance and Risk Indicators

Answer 18

provide a high level view of security program effectiveness.

Question 19

Security Audits

Answer 19

occur when a third party performs an assessment of the security controls protecting an organization’s information assets.

Question 20

Internal Audits

Answer 20

are performed by an organization’s internal staff and are intended for
management use.

External audits are performed by a third
party audit firm and are generally intended for the organization’s governing body.

Assume audit is 3rd party unless question says otherwise

Question 21

Four Components of NIST 800-53A

Answer 21

Specifications - documents associated with the system being audited.

Activities - actions carried out by people
within an information system.

Mechanisms - controls used within an
information system to meet the specifications.

Individuals - people who implement specifications, mechanisms, and activities