Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

KM - Personal CISSP > Domain 7 -- Security Operations > Flashcards

Domain 7 -- Security Operations Flashcards

1
Q

Give a list of tasks that should be performed by the security admin, not the network admin.

A
  • Implements and maintains security devices and SW
  • Carries out security assessments
  • Creates and maintains user profiles and implements and maintains access control mechanisms
  • Configures and maintains security labels in mandatory access control (MAC) environments
  • Manages password policies
  • Reviews audit logs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What kinds of questions do security admins need to ask themselves?

A
  • Are users accessing information and peforming tasks that are not necessary for their job function?
  • Are repetitive mistakes being made?
  • Do too many users have rights and privileges to sensitive or restricted data or resources?
    *
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a clipping level?

A

A clipping level is a baseline for violation activities before the activity is considered suspicious

IDS systems normally track activities and behavior patterns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Locks are considered _________ devices to intruders.

A

delaying

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of lock is a basic padlock?

A

A ward lock.

It has a spring loaded with a notch cut in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What kind of lock has more pieces than a ward lock?

A

A tumbler lock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the three types of tumbler locks and what’s the difference between them?

A
  • The pin tumbler lock is the most common
  • Wafer tumbler lock – the round kind normally found in filing cabinets
    • Does not afford much protection – easily circumvented
  • Lever Tumbler lock
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a cipher lock?

A

A cipher lock is a programmable lock that are keyless and use keypads.

  • Can require a card to be swiped or a combo to be entered
  • More expensive, but more functionality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What kinds of functionality is available on cipher locks?

A
  • Door delay – alarm triggers if door is open for too long
  • Key override – special combination can be enterred to over ride normal functions
  • Master keying
  • Hostage alarm
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are two important things to remember to do with combination locks?

A
  1. Change the combination periodically
  2. use random combination sequences
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are examples of device locks?

A
  • Switch controls - cover on/off power switches
  • Slot locks
  • Port controls - blocks access to disk drives or unused serial or parallel ports
  • Peripheral switch controls
  • Cable traps (prevent removal of input/output devices by passing cables through a lockable unit
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the three grades of locks available?

A
  • Grade 1 – Commercial and industrial light use
  • Grade 2 – Heavy duty residential / light duty commercial
  • Grade 3 – Residential consumer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the three main categories of lock cylinders?

A
  • Low security – No pick or drill resistance
  • Medium security – some pick protection provided
  • High security – pick resistance through many different mechanisms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are two techniques for circumventing tumbler locks and how do they work?

A
  1. Raking –
  2. Lock bumping
    • Need a bump key to make it work
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Exam Tip

What are Electronic Access Control (EAC) tokens?

A
  • Generic term to describe proximity authentication devices
    • proximity readers
    • programmable locks
    • biomentric systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the goals of External Boundary Protection Mechanisms?

A
  • Control pedestrian and vehicle traffic flow
  • Various levels of protection for different security zones
  • Buffers and delaying mechanisms to protect against forced entry attempts
  • Limit and control entry points
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What controls can be used to provide external boundary protection?

A
  • Access control mechanisms
    • locks, keys, card systems, personnel awareness
  • Physical barriers
    • Fences, gates, walls, door windows, vents, vehicular barriers
  • Intrusion detection
    • Perimeter sensors, interior sensors, annunciation mechanisms
  • Response
    • Guards, local law enforcement
  • Deterrents
    • Signs, lighting, environmental design
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Talk to me about fence height.

A
  • 3-4 feet high only deter casual trespassers
  • 6-7 feet high are considered too high to climb easily
  • 8 feet high means that you are serious about protecting your property
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is PIDAS Fencing?

A

It stands for Perimeter Intrusion Detectionand Assessment System (PIDAS)

  • has sensors
  • Can detect if a person attempts to climb or cut fence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is meant by glare protection for the security force?

A

It means that bright lights should be pointed towards the things that the guards have to observe (like gates) so that the security team is not fighting the light to do their job

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is standby lighting

A

It is lighting that can be configured to turn on or off at various times to give the appearance that faicilities are occupied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is an annunciator system?

A

They are products that can “listen” for noise or watch CCTV cameras or detect movement.

It makes it so the security guard doesn’t have to stare at a camera for 8 hours per day.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the sorts of things that physical IDS can trigger on?

A
  • Beams of light
  • Sounds and vibrations
  • Motion
  • Different kinds of fields
    • microwave, ultrasonic, electrostatic
  • Electrical circuit
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are some of the most important things to keep in mind regarding Intrusion Detection systems?

A
  • They are expensive and require human intervention
  • Require redundanct power and emergency power backup
  • They can be linked to a centralized security system
  • They should have a failsafe configuration, which defaults to activiated
  • They should detect and be resistant to tampering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Exam Tip:

Because the use of guard dogs introduces significant risks to human safety, exam answers that include dogs are likely to be ___________.

A

incorrect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Audit and access logs are ______________, not preventative.

A

detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are examples of internal physical security controls?

A
  • Work area separation
  • Personnel badges that must be worn in the building
  • Roving guards that look for violations and unauthorized personnel
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What’s the definition of provisioning for the CISSP exam?

A
  • the set of all activities required to provide one or more new information services to a user or group of users.
  • Provisioning must be done securely
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What’s the best way to track hardware to know that you’ve got everything you’re supposed to be tracking?

A

Get monitorying software that detects devices on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the key things to do in order to track software properly?

A
  • Application whitelisting
  • Using gold masters
  • Enforcing the principle of least privilege
  • Automated scanning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the Asset Management Cycle?

A
  • Business Case
  • Acquisition
  • Operation and Maintenance (O&M)
  • Retirement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is configuration management as it relates to the CISSP exam?

A

Configuration managementis the process of establishing and maintaining consistent baselines on all of our systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What’s the difference between Change Management and Configuration Management?

A

Change management is a business process.

  • concerned with changing features of system being developed
  • IT and security people are not usually in charge of change management (though they are involved in it)

Configuration management is an operational process

  • Example is how to configure software
  • Information security usually leads in configuration management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the steps in the Change Control Process?

A
  • Request for a change to take place
  • Approval of the change
  • Documentation of the change
  • Tested and presented
  • Implementation
  • Report Change to management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What’s the difference between:

  • System reboot
  • Emergency system restart
  • System cold start
A
  • System reboot – takes place after the system shuts itself down in a controlled manner in response to a kernel failure
  • Emergency system restart – takes place after a system failure happends in an uncontrolled manner
  • System Cold Start – takes place when an unexpected kernel or media failure happends and the regular recovery procedure cannot recover the system to a more consistent state
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the three steps to take after a system crash?

A
  1. Enter into single user or safe mode
  2. Fix issue and recover files
  3. Validate critical files and operations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Name 4 things you should do while recovering a system

A
  • Protect the boot sequence (C:, A:, D:) – make sure that a hacker can’t get the system to boot from a drive that you don’t want it to boot from
  • Do not allow bypassing of writing actions to system logs
  • Do not allow system forced shutdowns – only admins should have the ability to shut systems down.
  • Do not allow outputs to be rerouted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are steps that should be part of any Change Control Policy?

A
  • Request for a Change to take place
  • Approval of the change
  • Documentation of the Change
  • Tested and Presented
  • Implementation
  • Report Change to management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is a critical element of any change plan?

A

A backout plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What’s the difference between:

  • System reboot
  • Emergency system restart
  • System cold start
A
  • System Reboot - Takes place after the system has shut itself down in a controlled manner in response to a kernel failure
  • Emergency system restart- takes place after a system failure happens in an uncontrolled manner
  • System Cold Start takes place when an unexpected kernel or media failure happens and the regular recovery procedure cannot recover the system to a more consistent state
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are some key guidelines for remote systems administration?

A
  • Require a VPN connection protected with 2-factor authentication
  • Commands and data should not take place in cleartext
  • Strong authentication should be in place for any administrative activities
  • Truly critical systems should be administered locally, rather than remotely
  • Only a small number of administrators should be able to carry out remote functionality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What’s the difference between MTBF and MTTF?

A
  • MTBF - Mean Time Between Failures assumes that a device is repairable
  • MTTF – Mean Time to Failure – means that the device is not repairable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What does MAID stand for?

A

Massive Array of Inactive Disks

Similar idea to RAID, but with the intent to replace tape drives / tape libraries.

Disks spin up and are powered on only when needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What does MSSP stand for?

A

Managed Security Services Provider

45
Q

What considerations should you consider before hiring an MSSP?

A
  • Requirements
  • Understanding
  • Reputation
  • Costing
  • Liability
46
Q

What’s the difference between an event and an incident?

A
  • An event is something that happened
  • An incident is a negative thing that happened
  • An incidednt is a type of event
47
Q

What are three types of Incident response teams?

A
  • A virtual team. These are experts who have other duties, assighments, but who will be part of the incident response team in a crisis
  • A permanent team – People who are dedicated strictly to incident response
  • A hybrid team – hybrid of virtual and permanent.
48
Q

What are the basic items that an incident response team should have available?

A
  • A list of outside agencies and resources to contact or report to
  • An outline of roles and responsibilities
  • A call tree to contact these roles and outside entities
  • A list of computer or forensic experts to contact
  • A list of steps to take to secure and preserve evidence
  • A list of items that should be included in a report for management and potentially the courts
  • A description of how the different systems should be treated in this type of situation
49
Q

What is CERT and how can you take advantage of it?

A

CERT stands for Computer Emergency Response Team

  • CERT is an organization that is responsible for monitoring and advising users and companies about security preparation and security breaches.
  • Members of a company’s incident response team should get on the mailing list to keep apprised of new issues and so they can spot malicious events
50
Q

What are the seven steps of the Cyber Kill Chain?

A
  1. Reconnaissance
  2. Weaponization
  3. Delivery (95% of the time via email with a link to a malicious website)
  4. Exploitation (attacker’s software is running in your organization)
  5. Installation. Malicious software is usally delivered in stages
  6. Command and Control – Most malware will phone home to let attackers know that the attack was successful
  7. Actions on the Objective

As security professionals, we want to kill the attack as early as possible.

51
Q

What information should be reported for each security incident?

A
  • Summary of incident
  • Indicators
  • Related incidents
  • Actions taken
  • Chain of custody of all evidence (if applicable)
  • Impact assessment
  • Identity and comments of incident handlers
  • Next steps to be taken
52
Q

What are the key steps in Incident Response?

A
  • Detection
  • Response
  • Mitigation
  • Reporting
  • Recovery
  • Remediation – permanent solution to make sure it never happens again
53
Q

What is an IOC and IOA and give examples?

A

IOC stands for Indicator of Compromise

IOA stands for Indicator of Attack

Indicators of both:

  • Outbound traffic to a particular IP address or domain name
  • Abnormal DNS query patterns
  • Unusually large HTTP requests and/or responses
  • DDos traffic
  • New Registry entries (in Windows systems)
54
Q

What questions should be asked to ensure that the organization learns from the incidents it encounters?

A
  • What happened?
  • What did we learn?
  • How can we do better next time?
55
Q

What are key considerations re whether to bring law enforcement in regarding a security breach?

A
  • Law enforcement agencies are good at investigation
  • Company could lose control over where the investigation goes
  • Secrecy of compromise is not promised. Could be part of public record
  • Effects of reputation must be considered
  • Evidence will be collected and may not be available for a long period of time. It may take a year or more to get it to court
56
Q

What is teh SWGDE and what are its principles?

A

It’s an organization that aims to ensure consistency across the forensics community. Principles:

  1. When dealing wtih Digital evidence, all of the general forensic and procedural principles must be applied.
  2. Upon the seizing of digital evidence, actions taken should not change that evidence
  3. When it is necessary for a person to access original digital evidence, that person should be trained for the purpose
  4. All activity relating to the seizure, access, storage, or transfer of digital evidence must be fully documented, preserved and available for review.
  5. An individual is responsible for all actions taken with respect to digital evidence while the digital evidence is in their possession.
  6. Any agency that is responsible for seizing, accessing, storing, or transferring digital evidence is responsible for compliance with these principles.
57
Q

What does MOM stand for with respect to computer crime?

A

Motive, Opportunity, Means

58
Q

Motive is the _____ and ______ of a crime.

A

who and why

59
Q

What are the four different types of assessments Incident Investigators can do?

A
  • Network Analysis
  • Media Analysis
  • Software analysis
  • Hardware/embedded device analysis
60
Q

What are the four types of Incident Investigations and how are they different?

A
  • Administrative – focused on policy violations (least impactful)
  • Criminal – if we think that a crime may have been committed, then we need to preserve evidence and engage Law enforcement agencies (LEA’s)
  • Civil – similar to legal, but law enforcement won’t be involved (just lawyers on both sides). Standard of proof is much lower for civil cases
  • Regulatory – a regulatory investigation is initiated by a government regulator when there is reason to believe that an orginzation is not in compliance with applicable laws.
    • Company’s responsibility is to preserve evidence adn assist regulators as appropriate
61
Q

What are the key steps in the Forensic Investigation Process

A
  • Identification
  • Preservation
  • Collection
  • Examination
  • Analysis
  • Presentation
  • Decision
62
Q

What are the key principles to keep in mind regarding the crime scene?

A
  • Only allow authorized individuals onto the crime scene
  • Document who is at the crime scene
  • Document who the last individuals were to interact with the systems
  • If the crime scene becomes contaminated, document it
63
Q

To prove the integrity of the evidence, it is important to create an _________ ___________ of the evidence

A

Message digest

64
Q

What are some of the key tools in a forensics toolkit?

A
  • Documentation Tools
  • Disassembly and removal tools
  • Package and transport supplies
65
Q

What is a very important concept in evidence handling?

A

Chain of custody

66
Q

What are the four steps in the lifecycle of evidence?

A
  • Collection and identification
  • Storage, preservation and transportation
  • Presentation in Court
  • Return of evidence to the victim or owner
67
Q

Which amendment of the US Constitution protects Americans against unlawful search and seizure?

A

The Fourth Amendment

68
Q

What’s the difference between enticement and entrapment?

A
  • Enticement is legal as usally done. Honeypots are enticement
  • Entrapment would be if a user clicked on an ad and was taken to a honeypot which then recorded all of the suspected hackers actions
69
Q

What does WRT stand for in the context of Disaster Recovery?

A

WRT is Work Recovery Time

70
Q

What does MTD stand for in the context of Disaster Recovery?

A

Maximum Tolerable Downtime

71
Q

What’s the difference between:

  • Nondisaster
  • Disaster
  • Catastrophe
A
  • Nondisaster is a significant disruption in service, but is limited
  • A disaster is an event that causes an entire facility to be unusable for a day or longer
  • A catastrophe is a major disruption that destroys the facility altogether
72
Q

What’s a hot site?

A
  • A facility that is leased or rented and is fully configured and ready to operate within a few hours
  • The only missing resource is the data
73
Q

What is a warm site?

A
  • A warm site is a leased or rented facility that is partially configured with some equipment, such as HVAC and foundational infrastructure components, but not actual computers
  • Drawback is that you have to procure the equipment and then set it up.
74
Q

What is a cold site?

A
  • A cold site is a leased or rented facility that supplies the basic environment, electrical wiring, AC, plumbing and flooring, but non of the equipment or additional services
  • It could take weeks to get the site activated and ready to work.
  • Least expensive option, but the most time consuming after the disaster
75
Q

What is a tertiary site?

A
  • If there’s a danger of the main backup facility not being available, a tertiary site could be considered.
  • Plan B if Plan A does not work out.
76
Q

What is a reciprocal agreement?

A
  • Company A allows Company B to use its facilities in the event of a disaster and vice versa
  • Not always the greatest idea. Lots of downsides
    • Security, operational, will it even work?
77
Q

How far away should the backup facility be for DR?

A
  • Bare minimum 5 miles
  • 15miles for low to medium critical environments
  • 50 - 200 miles for critical operations and to protect against regional disasters
78
Q

What is a mutual aid agreement?

A
  • It’s like a reciprocal agreement, except it has more than 2 parties.
  • Even more complicated than reciprocal agreements
79
Q

What’s a redundant site?

A
  • There is a second site that is equipped and configured just like the primary site.
  • It is owned by the company
  • It is a mirror of the main site
  • It is different from a hot site because a hot site is a subscription service, whereas a redundant site is owned by the company
80
Q

What’s a rolling hot site?

A
  • Large truck or trailer that can be transported easily to a location. Loaded with equipment
  • aka mobile site
81
Q

What is a software escrow agreement?

A
  • A third party holds the source code, backups of compiled code, manuals and other supporting materials
  • Gives customer access to source code only if and when the vendor goes out of business, is unable to carry out its responsibilites or is in breach of the contract
82
Q

What’s the difference between a differential backup and an incremental backup?

A
  • Differential backup is a backup of everthing since the last full backup
  • Incremental backup is a backup of everything since the last full or incremental backup.
  • Disadvantage is that if you need to recover you need to get the last full backup, plus every intervening incremental backup.
83
Q

What is electronic vaulting?

A
  • Electronic vaulting is making copies of files as they are modified and periodically transmits them to an offsite backup site.
  • Does not happen in real-time, but is carried out in batches
84
Q

What is remote journaling?

A
  • Moving the journal (aka transaction logs) to a remote site, rather than the actual files
  • Used for database recovery, where the trans can be replayed.
  • Exam tip – remote journaling takes place in real-time and transmits only file delta’s . By comparison, electronic vaulting takes place in batches and moves the entire file that has been updated.
85
Q

What is electronic tape vaulting?

A

Electronic tape vaulting transmits data over a network to tape devices located in the alternate data center.

86
Q

What is an important part of DR that is dreaded by most people?

A

Documentation

87
Q

What is proximate cause?

A

Proximate cause is an act or omission that naturally and directly produces a consequence.

88
Q

What should be considered to fill the gap between preventive countermeasures and the unexpected?

A

Insurance

Cyber insurance to protect against DOS attachks, malware damages, electronic theft, privacy lawsuits, etc.

Businesness interruption insurance if the company is out of business for a certain amount of time.

89
Q

What are some of the key teams needed for a DR plan?

A
  • Damage assessment team
  • Recovery team
  • Relocation team
  • Restoration team
  • Salvage team
  • Security team
90
Q

What does the DR assessment team do?

A
  • Determine the cause of the disaster
  • Determine the potential for further damage
  • Identify affected business functions and areas
  • Identify the level of functionality for the critical resources
  • Identify the resources that must be replaced immediately
  • Estimate how long it will take to bring critical functions back on line
  • If it will take longer than the estimated MTD, then a disaster should be declared and the BCP should be put into action
91
Q

In a disaster, what is the top priority?

A

Human safety

92
Q

What are the four requirements for evidence to be admissible in court?

A
  1. Relevant
  2. Complete
  3. Sufficient
  4. Reliable
93
Q

An administrator is granting permissions to a database. What is the default level of access the administrator should grant to new users in the organization?

A

No access

94
Q

What is a primary benefit of job rotation and separation of duties policies?

A

Preventing fraud

95
Q

Which of the following can be an effective method of configuration management using a baseline?

A

Using images

96
Q

Which of the following is the best response after detecting and verifying an incident?

A

Containment is the first step after detecting and verifying an incident. This limits the effect or scope of an incident. Organizations report the incident based on policies and governing laws, but this is not the first step.

97
Q

Which of the following would security personnel do during the remediation stage of an incident response?

A

Security personnel perform a root cause analysis during the remediation stage. A root cause analysis attempts to discover the source of the problem.

98
Q

Of the following choices, what is the best form of anti-malware protection?

A

Anti-malware protection at several locations

A multipronged approach provides the best solution. This involves having antimalware software at several locations, such as at the boundary between the internet and the internal network, at email servers, and on each system. More than one antimalware application on a single system isn’t recommended. A single solution for the whole organization is often ineffective because malware can get into the network in more than one way. Content filtering at border gateways (boundary between the internet and the internal network) is a good partial solution, but it won’t catch malware brought in through other methods.

99
Q

What can be used to reduce the amount of logged or audited data using nonstatistical methods?

A

Clipping levels

Clipping is a form of nonstatistical sampling that reduces the amount of logged data based on a clipping-level threshold. Sampling is a statistical method that extracts meaningful data from audit logs.

100
Q

What is the end goal of disaster recovery planning?

A

Restoring normal business activity

Once a disaster interrupts the business operations, the goal of DRP is to restore regular business activity as quickly as possible. Thus, disaster recovery planning picks up where business continuity planning leaves off.

101
Q

According to the Federal Emergency Management Agency, approximately what percentage of U.S. states is rated with at least a moderate risk of seismic activity?

A

80 percent

Forty-one of the 50 U.S. states are considered to have a moderate, high, or very high risk of seismic activity. This rounds to 80 percent to provide the value given in option D.

102
Q

What is the typical time estimate to activate a warm site from the time a disaster is declared?

A

12 hours

103
Q

What is the main purpose of a military and intelligence attack?

A

To obtain secret and restricted information from military or law enforcement sources

A military and intelligence attack is targeted at the classified data that resides on the system. To the attacker, the value of the information justifies the risk associated with such an attack. The information extracted from this type of attack is often used to plan subsequent attacks.

104
Q

What’s the main goal of a financial attack?

A

A financial attack focuses primarily on obtaining services and funds illegally.

105
Q

What’s the goal of a grudge attack?

A

Any action that can harm a person or organization, either directly or through embarrassment, would be a valid goal of a grudge attack. The purpose of such an attack is to “get back” at someone.

106
Q

What are the primary reasons attackers engage in thrill attacks? (Choose all that apply.)

A
  • Bragging rights
  • Pride of conquering a secure system

Thrill attacks have no reward other than providing a boost to pride and ego. The thrill of launching the attack comes from the act of participating in the attack (and not getting caught).

107
Q

According to the (ISC)2 Code of Ethics, how are CISSPs expected to act?

A
  1. Honorably,
  2. honestly,
  3. justly,
  4. responsibly
  5. legally
108
Q

Which of the following actions are considered unacceptable and unethical according to RFC 1087, “Ethics and the Internet”?

A

Only “actions that compromise the privacy of users” are explicitly identified in RFC 1087.

109
Q
A

KM - Personal CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions