Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 7 > Flashcards

Domain 7 Flashcards

1
Q

__ determines the MTD e.g. this server can only be down for 4 hours.

A

BIA (Business Impact Analysis) determines the MTD (Maximum Tolerable/Allowable Downtime)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

__ firewall is software-based and filters anything coming into or leaving your system e.g. Windows firewall, ZoneAlarm (Windows), Application Firewall (Mac OS X)

A

Host-based firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

__ firewalls are referred to as ACLs (Access Control Lists) on some devices.

A

Packet filtering firewall. It inspects layer 3 IP header and is not very secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

__ firewalls maintain a state table so they can allow a syn ack only if there was a corresponding syn. They are primarily focused on layers 3 and 4.

A

Stateful inspection firewall. Looks at port while inspecting Layer 4 TCP/UDP header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

__ focuses on dynamically provisioning resources to cloud services e.g. providing computing resources of anywhere from 1 to thousands of systems within minutes such as Amazon during Nov/Dec. Organizations typically pay per unit, not per virtual host (based on equivalent CPU capacity).

A

Elastic Cloud Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

__ host discovery is the most direct way to identify a host, typically with a simple ping sweep. An additional stimulus beyond ICMP Echo Request is required for hardened systems.

A

active

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

__ Intrusion __ System can take measures on its own to control and minimize damage such as spoofing a reset to both sides of the connection. This will drop the connection to control the damage. It can also use an API to tell the firewall to block an IP address.

A

Active IDS can take measures on its own to control and minimize damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

__ IDS sends an alert but does not stop attack. __ IDS stops the attack, usually be sending resets.

A

passive, active

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

__ is a client service such as client email like Gmail.

A

SaaS (Software as a Service)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

__ is a cloud-based VPS such as a Linux server

A

IaaS (Infrastructure as a Service), VPS (Virtual Private Server)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

__ is a passive sniffer/sensor for analyzing and alerting on attacks whereas __ is an inline device that can block and stop attacks.

A

IDS, IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

__ is a plan that provides detailed steps to restore critical information systems and data.

A

DRP (Disaster Recovery Plan)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

__ is a plan to avoid irreparable loss of mission critical operations.

A

BCP (Business Continuity Planning)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

__ is a server service such as Apache web service.

A

PaaS (Platform as a Service). Admins have control over the service config only, not the general OS e.g. can restart the web service but not the entire system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

__ is a strategic ongoing plan focused on business processes with the goal of proactively fixing potential problems. It is an ongoing, strategic and over-arching plan.

A

BCP (Business Continuity Planning)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

__ is a subcomponent of BCP that is a reactive plan focused on recovery when normal business operations are interrupted.

A

DRP (Disaster Recovery Plan)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

__ is a type of data redundancy that is similar to remote journaling but provides additional robust backup by storing duplicate data on multiple remote storage devices.

A

Database shadowing: similar to journaling but stored on multiple devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

__ is a type of testing where team members step through the plan looking for errors or false assumptions.

A

structured walkthrough testing or validity testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

__ is how long a system/process can be down before the mission is impacted.

A

RTO (Recovery Time Objective)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

__ is how long the business will allow a disruption of mission critical functions.

A

MTD (Maximum Tolerable Downtime)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

__ is primarily concerned with evidence and proving in court whether or not someone did something.

A

Forensics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

__ planning is short-term focused (has a stop and start) while __ planning is long-term focused (continuous)

A

DRP, BCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

__ software focuses on worms and viruses. __ might bundle the functionality of antispyware, HIPS, application whitelisting, antivirus.

A

antivirus, antimalware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

__ testing involves actually failing over operations to an alternate computing facility.

A

full interruption testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

__ testing is a recovery to an alternate site with the main site still active

A

parallel testing involves actual recovery at an alternate computing facility but while normal operations are still maintained at the primary location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

__ testing is simply reviewing the plan to ensure all areas are covered.

A

read-through testing, checklist testing or consistency testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

__, __ and __ firewalls are all single connection while __, __ and __ firewalls are 2 connections.

A

Packet, Stateful, NGFWs are single connection. Application, Application-Level and Circuit Proxy are 2 connection firewalls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

__is a subcomponent of BCP focused on rapid restoration of mission critical functions.

A

COOP (Continuing Operations Plan)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A __ backup copies only files that have changed since the last full backup was last performed.

A

Differential backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

A __ backup is the most efficient type of backup because it backs up the least amount of data each day.

A

Incremental backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A __ backup is used if time and tape space is at an extreme premium, and usually resets the archive bit on the files after they have been backed up.

A

Incremental backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

A __ firewall develops a virtual connection between the host and destination, and typically sits at the session layer.

A

Circuit-Level Proxy Firewall, does NOT use application-level proxy software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A __ firewall hides the origin of a packet and is implemented on a computer by using proxy server software.

A

Application-Level Proxy Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

A __ firewall is slower but more effective than a packet filtering firewall, and inspects ports.

A

SI (Stateful Inspection) firewall. Looks at port while inspecting Layer 4 TCP/UDP header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

A __ firewall is the slowest of all firewalls since it fully analyses the entire packet, going all the way up to layer 7 and then back down to layer 1.

A

Proxy firewall (or ‘Application proxy’ because it processes packets at all 7 layers). Breaks the connection into two pieces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

A __ firewall maintains one TCP connection with the client and one with the server.

A

Proxy firewall (or ‘Application proxy’ because it processes packets at all 7 layers). Breaks the connection into two pieces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

A __ is a system directly connected to the internet such as a firewall or router. It is directly exposed to attack.

A

Bastion host e.g. web, mail, FTP servers. A host computer in the public area or DMZ that is exposed to attack from the Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

A __ testing is a walkthrough test that involves specific mock-up scenarios.

A

simulation or tabletop testing: team members respond as if an emergency is occuring. You may recover locations (emergency operations center and alternate sites) and enable communications liks while team members execute recovery steps in walk-through manner however you do not actually perform recovery actions (restore backups).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

A __ will run an executable in a sandbox before being run on the client to make sure it does not do any damage.

A

MDD (Malware Detonation Device) or Sandboxing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

A cloud-based service such as an Apache web service would be considered what?

A

PaaS (Platform as a Service). Admins have control over the service config only, not the general OS e.g. can restart the web service but not the entire system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

A device that continuously monitors web server logs, firewall and proxy logs, system and event logs and many others is __. It is detective

A

SIEM (Security Information and Event Management)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

A false positive on __ which alerts on matching signatures can be an annoyance. A false positive on __ is a self-imposed DoS condition since it will block the traffic. This can potentially block business / revenue therefore false positives cannot be allowed in the config for this type of system.

A

IDS, IPS cannot allow false positives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

A firewall that uses 2 separate connections with the best security is __ firewall.

A

Application Proxy firewall, processes packets at all 7 layers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

A formalized agreement between two business entities to faciliate recovery after a disaster.

A

reciprocal agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

A honey__ is a server, Honey__ is a network. Honey__ is a file.

A

honeypot (server), honeynet (network), honey token (file)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

A inline device that is only alerting is an Intrusion __ System.

A

Prevention since inline, even though it is only alerting. The difference is how it is deployed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

A major patch was released that exploits 99% of your systems. You received approval from executives to patch it even though the next CCB meeting isn’t until next week. What is the next step?

A

Present it at the next CCB meeting. Everything needs to be tracked in the CMDB (Change Management Database)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

A single connection firewall with the best security?

A

NGFW (Next Generation Firewall)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

A tangible object or physical evidence is known as __ evidence.

A

real evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

According to __ you can stop 80% of all attacks with which 4 items.

A

ASD (Austrailian Signals Directorate): patching OS, patching applications, application whitelisting, limiting and controlling admin access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

An oral testimony by a witness would be an example of __ evidence.

A

Direct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

__ includes a focused vulnerability assessment to determine the weaknesses to the business process that has to be recovered (smaller than full risk assessment).

A

BIA (Business Impact Analysis)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Block-level striping is done at RAID __.

A

RAID 4,5,6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Burden of proof for criminal action is __.

A

Beyond a shadow of a doubt or beyond a reasonable doubt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Does RAID guarantee that if one drive fails, you will not lose information?

A

No because of RAID 0 which is for performance; RAID 1 and higher do meet that requirement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

During an evacuation the __ is typically the first one out and responsible for beginning the process of accounting for all employees.

A

meeting point leader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

During incident handling, you should develop a report and send recommendations to management in the __ phase.

A

Lessons Learned Phase

58
Q

Evidence must be gathered legally or it can’t be used. This concept is called __.

A

Exclusionary rule

59
Q

Explain the following IDS events and two IDS equations.

A

“TP: attack (getting alert when you should; alert, attack), TN: normal traffic (no alert and you shouldn’t be getting an alert; no alert, no attack), FP (getting alert when you shouldn’t; alert, no attack), FN (not getting alert when you should; no alert, attack).
Trick: N implies ‘no alert’, P is ‘alert’; then false or true is whether that is correct
TP+FN=100% attack traffic, TN+FP=100% normal traffic so if TP (implying attack traffic) is 60% then FN is 40%”

60
Q

For data redundancy, __ is where a disk controller is duplicated so if one controller fails, the other controller operates. This does not denote multiple disks as baskups, but multiple disk controllers.

A

Disk duplexing

61
Q

For firewalls we start filtering at layer __ since MAC address change hop by hop but IP addresses stay the same through the path.

A

3

62
Q

For incident handling you should restore from backup in the __ phase. Make sure you do not restore compromised code.

A

Recovery phase

63
Q

For security you should keep an inventory for IPs and running apps but you would not need to do so for __

A

user accounts

64
Q

For the __ phase of incident handling you should fix the problem before putting the system back online.

A

Eradication phase

65
Q

For the __ phase of incident handling you should use SMART guidelines to determine whether an event is an incident.

A

Identification phase, SMART - Specific, Measurable, Acheiveable, Realistic, Timely

66
Q

How can we maximize the effectiveness of a firewall?

A

Make sure all connections are going through the firewall.

67
Q

If done at a byte level it is RAID __.

A

RAID 3

68
Q

If the TN for IDS events is 30% what is 70%. Is this the attack or normal traffic?

A

“FP, normal. TP: attack (getting alert when you should), TN: normal traffic (no alert and you shouldn’t be getting an alert), FP (getting alert when you shouldn’t), FN (not getting alert when you should)
TP+FN=100% attack traffic, TN+FP=100% normal traffic so if TP (implying attack traffic) is 60% then FN is 40%”

69
Q

If there are no other qualifiers on exam and ISC2 is just referring to normal mode IDS, they are referring to __ IDS.

A

passive IDS (monitor traffic and alert)

70
Q

If you are doing a live implementation of a circuit level firewall, however applications are not working e.g. ftp and telnet, what may you need to do?

A

The network utilities have to be ‘socksified’ to operate. Choose this answer if you get question like this on exam.

71
Q

If you are having trouble detecting unauthorized connectivity and need a preventative measure, you could use __ as an asset inventory of what devices can connect. To complement this and check the configuration of the devices you could use __.

A

802.1X, NAC (Network Access Control)

72
Q

If you currently have 4 drives and want to implement RAID-1 how many drives do you need in total?

A

8 because you need 1 backup drive for every 1 active drive (each new drive mirrors each original drive)

73
Q

If you need to patch a lot of systems e.g. 30/50/80K and if you don’t do it within 5 days a vulnerability is guaranteed to crash your systems. Should you patch all systems immediately or do an incremental rollout?

A

Incremental rollout. This is probably the number one question people get wrong since they answer that the patch should be released right away.

74
Q

If you want a firewall that breaks up a connection and optimizes performance which would you choose?

A

Circuit-Level Proxy Firewall, faster since it does not examine all 7 layers like a regular application proxy firewall.

75
Q

In __, allowed EXEs are cryptographically hashed and verified. If programs are not pre-verified, then they cannot run.

A

Application Whitelisting: doesn’t even care if a new malware binary is dropped into System32. The focus is on executables, applications, binaries once they attempt execution.

76
Q

In a __ backup the file’s archive bit is not reset until the next full backup.

A

Differential backup

77
Q

In addition to considering an alternate location for recovery, many __ plans will take into account the possibility of running in the “recovered” state for 30 or more days.

A

COOP (Continuing Operations Plan)

78
Q

In CCB each person has veto power however the __ can override the decision if they determine it’s best for the business.

A

data owner

79
Q

In RAID if it is done at a bit level it is RAID __.

A

RAID 2

80
Q

In terms of data redundancy, __ is a batch process where data is transmitted through communication lines to storage on a remote server e.g. performed every evening at a specific time

A

Electronic vaulting

81
Q

In the __ phase of incident handling you should make a clean binary backup of the system. In the __ phase you should secure the area, make a backup, change passwords and optionally pull the system off the network.

A

Identification phase, Containment

82
Q

Infrastructure with computers and the latest data is a __ site.

A

hot site: fully functioning alternative data center with the latest information (fully redundant)

83
Q

Infrastructure with computers but not the lastest data is a __ site.

A

warm site: so you would need to backup/restore

84
Q

Infrastructure with no computers is a __ site.

A

cold site: basic infrastructure (walls, maybe some desks), no computers, basically a building

85
Q

My cousin’s sister’s friend gave me this actual business document. This is an example of __.

A

hearsay

86
Q

Name the types of BCP testing.

A

read-through/checklist/consistency testing (simply reviewing plan to ensure all areas are covered), structured walk-through or validity testing (team members step through plan looking for errors or false assumptions), simulation or tabletop (walkthrough test that involves specific mock-up scenarios), parallel (recovery to an alternate site with main site still active), full interruption (actual failover to the alternate computing facility)

87
Q

Printed business records, manuals and printouts are examples of __ evidence.

A

documentary evidence

88
Q

RAID __ increases flexibility in the implementation and fault tolerance because there is no longer a single point of failure when it comes to parity.

A

RAID 5

89
Q

RAID __ is often called interleave parity

A

RAID 5

90
Q

RAID __ is often referred to as striping

A

RAID 0

91
Q

RAID __ is the simplest, least optimized form of RAID and requires a one-to-one disk ratio.

A

RAID 1

92
Q

RAID __ uses a dedicated parity drive and is implemented at the block level.

A

RAID 4

93
Q

RAID implementations go from bit to byte to block. The smaller the unit (bit) the more granular errors can be tracked and the less amount of data has to be replicated, however what is the downside of smaller units?

A

Less efficient because more information has to be tracked.

94
Q

Recovering an organization whenever an adverse event interrupts normal business operations is called __.

A

IR (Incident Response). You want to minimize damage and get back to a normal operating state

95
Q

Regarding search and seizure, __ is issued by a court to law enforcement for tangible objects. __ is issued by a court to an individual.

A

search warrant, subpoena (if you violate and don’t show to court you could get arrested and go to jail)

96
Q

Server clustering is similar to redundant servers except that all the services in the cluster are __ and take part in __. The cluster acts as a single entity and balances the load to improve performance.

A

online, processing service requests

97
Q

SOCKS is the most common example of a __ firewall and is used to authenticate a client.

A

Circuit-Level Proxy Firewall, does NOT use application-level proxy software.

98
Q

Summarize the RAID levels

A

“RAID 0 (striped set, no redundancy), RAID 1 (mirrored set, fully redundant), RAID 2 Obsolete, bit interleaved, hamming code), RAID 3 (dedicated parity, byte-level striping), RAID 4 (dedicated parity, block-level striping), RAID 5 distributed parity, block-level striping), RAID 6 (double distributed parity, block-level striping)
‘RAID Summary - D7 pg 146”””

99
Q

The __ deals with the restoration or continued operations of the business processes whereas the __ deals with the restoration of the critical information systems that support the business processes.

A

BCP, DRP

100
Q

The __ involves collection and identification, storage/preservation/transportation, presentation in court, and returning to the victim (owner).

A

Evidence Life Cycle

101
Q

The __ is ultimately responsible for an evacuation and is the last one out

A

safety warden: often a company officer or executive

102
Q

The __ is where the cost to recover and the cost of disruption meets.

A

Cost Balance Point D7 pg 164

103
Q

The __ phase of incident handling includes updating the disaster recovery plan and providing checklists and procedures.

A

Preparation, D7 pg 104

104
Q

The __ rule is to limit the potential for alteration.

A

Best evidence rule

105
Q

The BIA uses information from the __ to prioritize business functions and calculate business impact.

A

vulnerability assessment: identifies critical business functions; results are used as input to recovery strategy

106
Q

The error checking for RAID level 2 is done through parity information created using a __ which detects errors and establishes which part of which drive is in error.

A

hamming code

107
Q

The fastest type of firewall is __

A

Packet filtering firewall. It inspects layer 3 IP header and is not very secure.

108
Q

The key differentiating feature of __ firewall versus traditional firewalls is that this type can understand and filter specific client-side application capabilities.

A

NGFW (Next Generation Firewall)

109
Q

The primary focus of __ is on taking files and rendering/executing them in advance of passing them to the target.

A

MDD (Malware Detonation Device) or Sandboxing

110
Q

There are some exceptions however most business records that are generated electronically fall under the __ rule and are considered to be unreliable and inaccurate simply because there is no way to prove otherwise.

A

Hearsay Rule

111
Q

Third-party or second-hand evidence can also be called __ and under the US Federal Rules of Evidence, it is inadmissable in court. An exception is business documents and public records e.g. my sister’s cousin’s friend gave me this actual business document.

A

hearsay

112
Q

This most effective firewall looks at layer 7 application headers, uses a single connection and is the slowest firewall.

A

NGFW (Next Generation Firewall)

113
Q

This type of data redundancy transmits data in real-time or near real-time to backup storage at a remote location.

A

Remote journaling: data written to second system in close to real time

114
Q

This type of firewall is overtly instrumented to handle layer 7 aspects. An example of a __ firewall would be blocking facebook chat for all end users except a few executives due to data exfiltration.

A

NGFW (Next Generation Firewall)

115
Q

This type of RAID is commonly called mirroring because it mirrors data from one disk to another.

A

RAID 1

116
Q

This type of RAID stripes data across disks but provides no redundancy. It is good for performance.

A

RAID 0

117
Q

This type of RAID uses a dedicated parity drive and is implemented at the byte level.

A

RAID 3

118
Q

Three types of NIDS are __.

A

Signature Matching, Protocol Behavior, Anomaly Detection

119
Q

To implement RAID __ you need a total of 39 disks, 32 for data storage and 7 for error recovery of that data. This method is performed at a bit level and therefore is not as efficient as other methods.

A

RAID 2

120
Q

Today’s adversaries are so advanced that no single log may indicate an attack however if you correlate logs using this type of monitoring tool, you may be able to see unusual patterns and identify the adversary.

A

SIEM (Security Information and Event Management)

121
Q

Using a model, chart or illustration to aid the jury is an example of __ evidence.

A

demonstrative evidence

122
Q

We use the __ numbering system to uniquely tag and identify data, for instance so it could be recovered as part of the eDiscovery process.

A

Bates numbering system

123
Q

What is necessary in order for audit information to be useful when handling employee issues?

A

It needs to be reviewed regularly; everything else is secondary (centrally managing the logs, etc), if they’re not reviewed, nothing else will matter

124
Q

What is required for centralized logging to work properly?

A

NTP (Network Time Protocol) server must be used. If you have centralized logging but no consistent time source you cannot correlate.

125
Q

What is the best way to secure a service?

A

Best answer is to turn the service off or uninstall it. Secondary is to agressively apply patches.

126
Q

What is the golden rule of change management.

A

All changes must go through the CCB. If emergency, you can still make emergency changes as long as you present it at the next meeting.

127
Q

What is the only RAID level that requires an exact number of drives?

A

RAID 2

128
Q

What is the primary reason for centralized logging?

A

To get the logs off the system as quick as possible to prevent adversary from covering their tracks aka protection/safety of the logs. Do NOT pick correlation of the logs which would only be a secondary reason.

129
Q

What is the process for Incident Handling?

A

“Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. remember ‘PIC ERL’
D7 pg 102”

130
Q

What must be true about audit trails in order to safely use them in employee terminations?

A

They are reviewed on a regular basis

131
Q

What RAID level is now obsolete?

A

RAID 2

132
Q

When a vendor releases a patch they are telling the world there is a vulnerability. If the adversary can break in before the patch is applied he wins, if you patch before they break in, you win. What is this called?

A

Race condition

133
Q

When looking at a threat you need to identify the source of the threat which is typically __ and the cause of damage which is normally __.

A

external, internal (insider in organization) e.g. user clicking email that allowed adversary a pivot point to break in. need to differentiate since you will remediate the issue differently depending on the cause

134
Q

Which RAID is the first to intermix drives that have both data and parity?

A

RAID 5

135
Q

Which RAID(s) use one set of drives for data and separate drive(s) for error recovery codes?

A

RAID 2,3,4

136
Q

Which RAID systems will guarantee that even if one drive fails, you will NOT lose information.

A

RAID 1 and higher. You WILL lose information with RAID 0 which is for performance

137
Q

With __ host discovery we employ a sniffer and simply look for evidence of traffic indicative of systems.

A

passive

138
Q

Which backup method does not reset the archive bit on files that are backed up?

A

Differential backup

139
Q

An advantage of a __ backup is that if your system needs to be restored, it only requires two tapes.

A

Differential backup

140
Q

This ‘additive backup method’ is additive in the fact that it does not reset the archive bit so all changed or added files are backed up in every backup until the next full backup.

A

differential backup

141
Q

A __ backup is the most efficient type of backup because it backs up the least amount of data each day.

A

Incremental backup

142
Q

This type of backup requires the most tapes.

A

Incremental backup

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions