Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 7: Security Operations > Flashcards

Domain 7: Security Operations Flashcards

1
Q

Continuity Planning Subtasks (5)

A

Strategy Development, Provisions and Processes ,Plan Approval, Plan Implementation, Training and Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Strategy Devlopment

A

Bridges gap btwn BIA and Continuity Planning in BCP - determines which risks are acceptable which must be mitigated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Provisions and Processes

A

specific procedures and mechanisms that will mitigate the risk deemed unacceptable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Three Categories of assets in BCP Provisions and Processes

A

People, Buildings/Facilities, Infrasctructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Important Components of a Written BCP (11)

A

Continuity Planning Goals, Statement of Importance, Statement of Priorities, Statement of Organizational Responsibility, Statement of Urgency and Timing, Risk Assessment, Risk Acceptance/Mitigation, Vital Records Program, Emergency Response Guidelines, Maintenance, Testing and Exercise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Importance of a Written BCP (3)

A

Historical Benefit, Sanity Check, Reference document

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Entitlement

A

amount of privileges granted to users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Aggregation

A

amount of privileges that users collect over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Transitive Trust

A

extends the trust between two security domains to all their sub domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Common methods for managing security in the information life cycle

A

Marking Data, Handling data, storing Data, Destroying Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SLA

A

Service level agreement - agreement between and org and vendor that stipulated performance expectations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

MOU

A

documents the intent of two entities to work together toward a common goal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ISA

A

info on how the two parties establish, maintain, and disconnect the connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Virtual Machines

A

run as guest OSs on physical servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SDNs

A

Software Defined Networks - uses simple network devices other than routers and switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

VSANs

A

Virtual Storage Area Networks - virtual dedicated high speed network that hosts multiple storage devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the primary software component in virtualization?

A

Hypervisor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Hypervisor

A

managers the VMs, virtual data storage, and virtual network components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cloud Computing

A

on demand access to computing resources from almost anywhere

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SaaS

A

Software as a Service - fully functional applications (Google Docs), Consumes do not manage or control any assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

PaaS

A

Platform as a Service - computing platform (hw, OS, application), consumers manager the applications and maybe some config settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

IaaS

A

Infrastructure as a Service - servers, storage, networking resources, consumers install OS and applications and perform all maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the 4 cloud models?

A

Public, Private, Hybrid, and Community

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Public Cloud Model

A

assets available for any consumer to rent or lease

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Private Cloud Model

A

assets are for a single organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Community Cloud Model

A

assets are provided to two or more organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Baseline

A

starting point for configuration of a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Unauthorized Changes Directly affect the __ in the CIA triad

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Vulnerability Management

A

regularly identifying, evaluating and mitigating vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

CVE

A

common vulnerability and exposure - dictionary for a standard convention in identifying vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Incident

A

Any event that has a negative effect on the CIA of an org’s asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Computer Security Incident

A

an incident that is a result of an attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Incident Response Steps

A

Detection, Response, Mitigation, Reporting, Recovery, Remediation, Lessons Learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

DoS Attacks

A

attacks that prevent a system from processing or responding to legitimate traffic or requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

DDoS

A

DoS attack using multiple attack systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

DRDoS

A

Distributed Reflective DoS, doesn’t attack victim directly, manipulates traffic to reflect attacks back

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

SYN Flood attack

A

sends multiple SYN flags, never completed conversation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Smurf Attack

A

floods the victim with ICMP echo packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Fraggle Attacks

A

floods victims with UDP Packets over port 7 and 19

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Ping Flood Attack

A

floods a victim with ping requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Ping-of-death Attack

A

send oversized ping packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Teardrop Attack

A

attacker fragments traffic in such a way that a system is unable to put data packets back together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Land Attack

A

attacker sends spoofed SYN packets suing the victims IP address as source and destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Zero-day Exploit

A

attack on a system exploiting an unknown vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Malicious Code

A

any script or program that performs an unwanted, unauthorized, or unknown activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Drive-by Download

A

code downloaded and installed on a user’s system without their knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Man in the Middle Attack

A

attacker gains a logical position between two endpoints of communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

War Dialing

A

using a modem to search for a system that accepts inbound comms attempts, newer forms use VoIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Knowledge Based Detection

A

signature or pattern based, uses database of known attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Behavior Based Detection

A

heuristics or anomaly based, creates a baseline of normal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Passive vs Active IDS Response

A

Passive is notifications, active modifies the environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Darknet

A

Portion of allocated IP addresses within a network that are not used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Pseudo Flaws

A

false vulnerabilities intentionally implanted in a system to tempt attackers

54
Q

Padded Cells

A

similar to honeypot but performs intrusion isolation

55
Q

Whitelisting

A

Identifies list of apps authorized to run

56
Q

Blacklisting

A

Identified list of apps unauthorized to run

57
Q

Logging

A

process of recording info about events to a log file or database

58
Q

Monitoring

A

process of reviewing information logs looking for something specific

59
Q

Log Analysis

A

detailed and systematic form of monitoring

60
Q

SIEM

A

Security Information and Event Management - provide real time analysis of events

61
Q

Sampling

A

process of extracting specific elements from a large collection of data to construct something meaningful

62
Q

Clipping

A

form of nonstatistical sampling

63
Q

Egress Monitoring

A

monitoring outgoing traffic to prevent data exfiltration

64
Q

What are the two primary types of DLP systems?

A

Network based and endpoint based

65
Q

Network Based DLP

A

scans all outgoing data looking for specific data

66
Q

Endpoint-based DLP

A

scans filed stored on the system as well as files sent to external devices (printers, flash drives, etc)

67
Q

Disaster Recover Planning steps in where ___ leaves off

A

BCP

68
Q

Single Point of Failure

A

any component that can cause an entire system to fail

69
Q

Fault Tolerance

A

the ability of a system to suffer a fault but continue to operate

70
Q

System Resilence

A

the ability of a system to maintain an acceptable level of service during an adverse event

71
Q

RAID-0

A

Striping, uses two or more disks and improves disk performance but does not provide fault tolerance

72
Q

RAID-1

A

Mirroring - uses two disks which both hold the same data

73
Q

RAID-5

A

Striping with Parity - uses three or more disks, provides fault tolerance but system will operate slower

74
Q

RAID-10

A

aka RAID 1 +0, a stripe of mirrors, two or more mirrors configured in a stripe

75
Q

UPS

A

Uninterruptible Power Supply, provides btwn 5 and 30 min of power

76
Q

Fail Secure System

A

systems will default to a secure state in the event of a failure

77
Q

Fail Open System

A

fails to an open state, granting all access

78
Q

4 Types of Trusted Recovery

A

Manual Recovery, Automated Recovery, Automated Recovery without Undue Loss, Function Recovery

79
Q

Function Recovery

A

automatically recover specific functions

80
Q

Manual Recovery

A

does not fail in secure state, admin manually takes actions for a secured or trusted recovery

81
Q

Automated Recovery

A

system performs trusted recovery activities to restore itself against at least one type of failure

82
Q

Automated Recovery without Undue Loss

A

system performs trusted recovery activities to restore itself against at least one type of failure + specific objects are protected against loss

83
Q

Bandwidth

A

network capacity available to carry communications

84
Q

Latency

A

time it takes a packet to travel from source to destination

85
Q

JItter

A

variation in latency between different packets

86
Q

The DRP team must first __________

A

identify the high priority business units

87
Q

Cold Sites

A

standby facilities with HVAC, power, etc and nothing else, takes weeks to set up

88
Q

Hot site

A

up to date data and facilities, may be ready instantaneously

89
Q

Warm Sites

A

contains equipment and data circuits, usually 12-24 hours to activate

90
Q

Service Bureau

A

Company that leases computer time, owns large server farms

91
Q

MAAs

A

Mutual Assistance Agreements - two orgs pledge to assist each other

92
Q

Electronic Vaulting

A

database backups are moved to a remote site using bulk transfers

93
Q

Remote Journaling

A

data transfers are performed more frequently (once/hour)

94
Q

Remote Mirroring

A

live database server is maintained at the backup site

95
Q

Full Backups

A

complete copy, resets archive bit

96
Q

Incremental Backups

A

copy only files that have been modified since the last full or incremental backup, resets archive bit

97
Q

Differential Backups

A

copy all files modified since last full backup, does not reset archive bit

98
Q

Software Escrow Arangements

A

third party sw developer provides copies of source code to another organization - in case they do not continue support or shut down

99
Q

Recovery vs Restoration

A

Recovery is short time frame, implement and maintain operations at the recovery site. Restoration restores primary site to operational capacity

100
Q

3 goals of a Read-through test

A

ensures you have key personnel aware of roles, provides individuals an opportunity to review the plans and update, update personnel who have left

101
Q

Structured Walk Through

A

table top exercise - role play scenario

102
Q

Simulation Test

A

structured walk through + testing of scenarios

103
Q

Parallel Test

A

relocate personnel to alternate site and implement site activation procedures

104
Q

Full-Interruption Test

A

shut down operations at the primary site and shifting them to the recovery site

105
Q

Operational Investigations

A

examine issues related to the organization’s computing infrastructure and have the primary goal of resolving operational issues

106
Q

Criminal Investigations

A

may result in charging suspects with a crime

107
Q

Regulatory Investigations

A

when the government believes that an individual or corporation has violated administrative law

108
Q

9 Steps of Electronic Discovery

A

Information Governance, Identification, Preservation, Collection, Processing, Review, Analysis, Production, Presentation

109
Q

What are the 3 requirements of admissible evidence?

A

relevant, related (Material) to the case, competent (obtained legally)

110
Q

Real Evidence

A

physical evidence

111
Q

Documentary Evidence

A

written items

112
Q

Testimonial Evidence

A

testimony of a witness

113
Q

Media Analysis

A

identification and extraction of information from storage media

114
Q

Network Analysis

A

activity over network

115
Q

Hardware/Embedded Device Analysis

A

review the contents of hw and embedded devices

116
Q

Military and Intelligence Attacks

A

launched to obtain secret and restricted information from law enforcement or military

117
Q

Business Attacks

A

illegally obtaining an org’s confidential information

118
Q

Financial Attacks

A

unlawfully obtain money or services

119
Q

Grudge Attacks

A

attacks carried out to damage an org or person

120
Q

Thrill Attacks

A

script kiddies, often for the fun of it

121
Q

Event

A

any occurrence that takes place during a certain period of time

122
Q

Incident

A

An event that has a negative outcome affecting the CIA

123
Q

Scanning

A

similar to a burglar casing a neighborhood

124
Q

Compromise

A

any unauthorized access to the system of information the system stores

125
Q

CIRT

A

computer incident response team

126
Q

3 Step Incident Response Process

A
  1. Detection and Identification
  2. Response and Reporting
  3. Recover and Remediation
127
Q
  1. Detection and Identification
A

detect security incident and notify appropriate personnel

128
Q
  1. Response and Reporting
A

Isolation and Containment, Gathering Evidence

129
Q
  1. Recovery and Restoration
A

restore environment to normal operating state and complete a lessons learned process

130
Q

5 rules of digital evidence

A

authentic, accurate, convincing, complete, admissable

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions