Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My own CISSP > Domain 7 - Operations > Flashcards

Domain 7 - Operations Flashcards

1
Q

Maximum Tolerable Downtime (MTD)?

A

Maximum Tolerable Downtime (MTD). The MTD represents the total amount of time the system owner/authorizing official is willing to accept for a mission/business process outage or disruption and includes all impact considerations. Determining MTD is important because it could leave contingency planners with imprecise direction on selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures, including their scope and content.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Recovery Time Objective (RTO)?

A

Recovery Time Objective (RTO). RTO defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD. Determining the information system resource RTO is important for selecting appropriate technologies that are best suited for meeting the MTD. When it is not feasible to immediately meet the RTO and the MTD is inflexible, a Plan of Action and Milestone should be initiated to document the situation and plan for its mitigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Recovery Point Objective (RPO)?

A

Recovery Point Objective (RPO). The RPO represents the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered (given the most recent backup copy of the data) after an outage. Unlike RTO, RPO is not considered as part of MTD. Rather, it is a factor of how much data loss the mission/business process can tolerate during the recovery process. Because the RTO must ensure that the MTD is not exceeded, the RTO must normally be shorter than the MTD. For example, a system outage may prevent a particular process from being completed, and because it takes time to reprocess the data, that additional processing time must be added to the RTO to stay within the time limit established by the MTD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Raid Level 0

A

Stripping only to increase the performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Raid Level 1

A

Miroir on two disks minimum. Most expensive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

RAID 2

A

(HAMMING CODE PARITY)
Multiple disks
Parity information created using a hamming code
Can be used in 39 disk array 32 Data and 7 recovery
Not used, replaced by more flexible levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

RAID 3

A 
Raid 3
(BYTE LEVEL PARITY) 
Stripe across multiple drives
Parity information on a parity drive
Provides redundancy
Can affect performance with single parity drive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

RAID 4

A 
(BLOCK LEVEL PARITY)
RAID 4 – Block level
Stripe across multiple drives
Parity information on a parity drive
Provides redundancy
Can affect performance with single parity drive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RAID 5

A

(INTERLEAVE PARITY)
Most popular
Stripes data and parity information across all drives
Uses interleave parity
Reads and writes performed concurrently
Usually 3-5 drives. If one drive fails, can reconstruct the failed drive by using the information from the other 2.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

RAID 7

A

RAID 7 (SINGLE VIRTUAL DISK)
Functions as a single virtual disk
Usually software over Level 5 hardware
Enables the drive array to continue to operate if any disk or any path to any disk fails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RAID Summary

A 
0 – Striping
1 – Mirroring
2 – Hamming code parity
3 – Byte level parity
4 – Block level parity
5 – Interleave parity
7 – Single Virtual Disk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When RAID runs as part of the operating system on the file server, it is an example of a:

A

When RAID runs as part of the operating system on the file server, it is an example of a software implementation. RAID can also be implemented as hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Tape Array?

A

A Tape Array is a large hardware/software backup system based on the RAID technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is an Hierarchical Storage Management ( HSM )

A

Hierarchical Storage Management (HSM) provides a continuous on-line backup by using optical or tape “jukeboxes,” similar to WORMs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the main purpose of off-site testing?

A

Ensure the continued compatibility of the contingency facilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The Chain of Custody will include a detailed record of:

A 
Who obtained the evidence
What was the evidence
Where and when the evidence was obtained
Who secured the evidence
Who had control or possession of the evidence

With the purpose of presenting in court.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the backup that will not change the archive bit even after backup?

A

A differential backup is a partial backup that copies a selected file to tape only if the archive bit for that file is turned on, indicating that it has changed since the last full backup. A differential backup leaves the archive bits unchanged on the files it copies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What include Media Viability Controls?

A

Media Viability Controls include marking, handling and storage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Detectice security controls examples?

A

detective security controls are log monitoring and review, system audit, file integrity checkers, and motion detection.

20
Q

What is the equivalent of Memory dump in court?

A

Hearsay
A memory dump can be admitted as evidence if it acts merely as a statement of fact. A system dump is not considered hearsay because it is used to identify the state of the system, not the truth of the contents.

21
Q

When a post-morthem should be done?

A

5 days after the incident.

22
Q

Another name for Fail Safe is ?

A

fail-safe (sometimes called fail-open)

23
Q

How work Fail Secure?

A

After an alarm, or intrusion, the system stay secure. This would be used for systems, like Windows Blue Screen, not when Humain life in possibly in danger.

24
Q

Which RAID level does NOT offer parity protection?

A

RAID Level 10 is a combination of Levels 0 and 1, neither of which offer parity protection.

25
Q

What is a Checklist during a test of a disaster recovery plan?

A

Checklist—Copies of the plan are sent to different department managers and business unit managers for review. This is a simple test and should be used in conjunction with other tests.

26
Q

What is a Structured Walk-Through during a test of a disaster recovery plan?

A

Structured Walk-through—Team members and other individuals responsible for recovery meet and walk through the plan step-by-step to identify errors or assumptions.

27
Q

What is a Simulation during a test of a disaster recovery plan?

A

Simulation—This is a simulation of an actual emergency. Members of the response team act in the same way as if there was a real emergency.

28
Q

What is a Parrallel test during a test of a disaster recovery plan?

A

Parallel—This is similar to simulation testing, but the primary site is uninterrupted and critical systems are run in parallel at the alternative and primary sites. The systems are then compared to ensure all systems are in sync.

29
Q

What is a Full interruption test during a test of a disaster recovery plan?

A

Full interruption—This test involves all facets of the company in a response to an emergency. It mimics a real disaster where all steps are performed to test the plan. Systems are shut down at the primary site and all individuals who would be involved in a real emergency, including internal and external organizations, participate in the test. This test is the most detailed, time-consuming, and expensive all of these.

30
Q

What is DAM for Database?

A

DAM is designed to monitor databases and report on suspicious activities and is widely used by organizations who are concerned about security breaches or attacks which could be costly in terms of availability of data disclosure.

31
Q

What is X.500?

A

LDAP is a protocol used to query X.500 directory services and not a security event management system.

32
Q

What is the Chain of Events in case of Forensic investigation?

A

Identify, Preserve, Analyze and Present

33
Q

What are the 5 levels of CCMI?

A 
Level 1 is Initial or Chaotic
Level 2 is Repeatable
Level 3 is Defined
Level 4 is Managed
Level 5 Optimizing
34
Q

What CCMI Level is Defined?

A

Level 3 : It is characteristic of processes at this level that there are sets of defined and documented standard processes established and subject to some degree of improvement over time. These standard processes are in place (i.e., they are the AS-IS processes) and used to establish consistency of process performance across the organization.

35
Q

What CCMI Level is Managed?

A

Level 4 : It is characteristic of processes at this level that, using process metrics, management can effectively control the AS-IS process (e.g., for software development ). In particular, management can identify ways to adjust and adapt the process to particular projects without measurable losses of quality or deviations from specifications. Process Capability is established from this level.

36
Q

The major objective of system configuration management is which of the following?

A

Operations stability.

37
Q

What is important about DB Electronic Vaulting?

A

Electronic vaulting is accomplished by backing up system data over a network. The backup location is usually at a separate geographical location known as the vault site. Vaulting can be used as a mirror or a backup mechanism using the standard incremental or differential backup cycle. Changes to the host system are sent to the vault server in real-time when the backup method is implemented as a mirror. If vaulting updates are recorded in real-time, then it will be necessary to perform regular backups at the off-site location to provide recovery services due to inadvertent or malicious alterations to user or system data.

38
Q

What is important about DB Remote Journaling?

A

Journaling or Remote Journaling is another technique used by database management systems to provide redundancy for their transactions. When a transaction is completed, the database management system duplicates the journal entry at a remote location. The journal provides sufficient detail for the transaction to be replayed on the remote system. This provides for database recovery in the event that the database becomes corrupted or unavailable.

39
Q

What is different in DB Shadowing?

A

Database shadowing may be used where a database management system updates records in multiple locations. This technique updates an entire copy of the database at a remote location.

40
Q

What is MTD?

A

The Maximum Tolerable Downtime (MTD) is the maximum length of time a BUSINESS FUNCTION can endure without being restored, beyond which the BUSINESS is no longer viable

41
Q

Explain RTO, Recovery Time Objective.

A

. RTO defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD. Determining the information system resource RTO is important for selecting appropriate technologies that are best suited for meeting the MTD. When it is not feasible to immediately meet the RTO and the MTD is inflexible, a Plan of Action and Milestone should be initiated to document the situation and plan for its mitigation.

42
Q

What is different about RPO, Recovery Point Objective?

A

The RPO represents the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered (given the most recent backup copy of the data) after an outage. Unlike RTO, RPO is not considered as part of MTD. Rather, it is a factor of how much data loss the mission/business process can tolerate during the recovery process. Because the RTO must ensure that the MTD is not exceeded, the RTO must normally be shorter than the MTD. For example, a system outage may prevent a particular process from being completed, and because it takes time to reprocess the data, that additional processing time must be added to the RTO to stay within the time limit established by the MTD.

43
Q

Is a Policy normally detective, preventive or corrective?

A

Preventive or Directive depending on the situation.
Preventive security controls are put into place to prevent intentional or unintentional disclosure, alteration, or destruction (D.A.D.) of sensitive information.

44
Q

What is the equivalent of Directive Security Controls.

A

Directive security controls are the equivalent of administrative controls. Directive controls direct that some action be taken to protect sensitive organizational information. The directive can be in the form of a policy, procedure, or guideline.

45
Q

After a computer has been infected, and cleaning what should you do with it?

A

It need to be completelly reinstalled before being reused.

46
Q

There are other names for :
Knowledge-based ID systems
Behavior-based ID systems
both type of Intrusion Detection methodology.

A

Signature-based ID and Statistical anomaly-based ID, respectively.

My own CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions