Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 7: Security Operations > Flashcards

Domain 7: Security Operations Flashcards

1
Q

What are the four types of disk-based forensic data?

A 
Four basic types of disk-based forensic data:
• Allocated space
• Unallocated space
• Slack space
• “Bad” blocks/clusters/sectors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is allocated space?

A

• Allocated space: portions of a disk partition that are marked as actively containing data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is unallocated space?

A

• Unallocated space: portions of a disk partition that do not contain active data. This includes portions that have never been allocated, as well as previously allocated portions that have been marked unallocated. If a file is deleted, the portions of the disk that held the deleted file are marked as unallocated and made available for use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is slack space?

A

• Slack space: data is stored in specific-sized chunks known as clusters, which are sometimes referred to as sectors or blocks. A cluster is the minimum size that can be allocated by a file system. If a particular file, or final portion of a file, does not require the use of the entire cluster, then some extra space will exist within the cluster. This leftover space is known as slack space; it may contain old data, or it can be used intentionally by attackers to hide information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are bad blocks/sectors?

A

• “Bad” blocks/clusters/sectors: hard disks routinely end up with sectors that cannot be read due to some physical defect. The sectors marked as bad will be ignored by the operating system
since no data could be read in those defective portions. Attackers could intentionally mark sectors or clusters as being bad in order to hide data within this portion of the disk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 8 steps in the incident response process?

A

Steps in incident response process:

  1. Preparation - The preparation phase includes steps taken before an incident occurs
  2. Detection (identification) - events are analyzed in order to determine whether these events might comprise a security incident.
  3. Response (containment) - the incident response team begins interacting with affected systems and attempts to keep further damage from occurring as a result of the incident
  4. Mitigation (eradication) - process of understanding the cause of the incident so that the system can be reliably cleaned and ultimately restored to operational status later in the recovery phase
  5. Reporting - The reporting phase of incident handling occurs throughout the process, beginning with detection. Reporting must begin immediately upon detection of malicious activity.
  6. Recovery - involves cautiously restoring the system or systems to operational status.
  7. Remediation - Remediation steps occur during the mitigation phase, where vulnerabilities within
  8. Lessons learned (postincident activity, postmortem, or reporting) - provide a final report on the incident, which will be delivered to management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the difference between a true/false positive/negative?

A
  • True positive: A worm is spreading on a trusted network; NIDS alerts
  • True negative: User surfs the Web to an allowed site; NIDS is silent
  • False positive: User surfs the Web to an allowed site; NIDS alerts
  • False negative: A worm is spreading on a trusted network; NIDS is silent
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is security baselining?

A

Security baselining is the process of capturing a snapshot of the current system security configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a zero day vulnerability?

A

A zero-day vulnerability is a vulnerability that is known before the existence of a patch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a zero day exploit?

A

A zero-day exploit, rather than vulnerability, refers to the existence of exploit code for a vulnerability that has yet to be patched

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 8 steps in the change management process?

A

Flow of the change management process:
• Identifying the change
• Proposing the change
• Assessing the risk associated with the change
• Testing the change
• Scheduling the change
• Notifying impacted parties of the change
• Implementing the change
• Reporting results of the change implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does RAID mirroring accomplish?

A

Three critical RAID terms are mirroring, striping, and parity.
• Mirroring achieves full data redundancy by writing the same data to multiple hard disks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the goal of BCP?

A

The overarching goal of BCP is to ensure that the business will continue to operate before, throughout, and after a disaster event is experienced. The focus of BCP is on the business as a whole, ensuring that those critical services or functions the business provides or performs can still be carried out both in the wake of a disruption and after the disruption has been weathered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does a disaster recovery plan provide?

A

The Disaster Recovery Plan (DRP) provides a short-term plan for dealing with specific IT-oriented disruptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does a disaster recovery plan focus on?

A

The DRP focuses on efficiently attempting to mitigate the impact of a disaster by preparing the immediate response and recovery of critical IT systems. DRP is considered tactical rather than strategic and provides a means for immediate response to disasters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does a business continuity plan contain?

A

The BCP is an umbrella plan that includes multiple specific plans, most importantly the DRP. DRP serves as a subset of the overall BCP, which would be doomed to fail if it did not contain a tactical method for immediately dealing with disruption of information systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does NIST 800-34 provide?

A

NIST Special Publication 800-34, provides a visual means for understanding the interrelatedness of BCP and DRP, as well as Continuity of Operations Plan (COOP), Occupant Emergency Plan (OEP), and others.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the three categories of disasters?

A

The three common ways of categorizing the causes for disasters are derived from whether the threat agent is natural, human, or environmental in nature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What do natural disaster include?

A

Natural—This category includes threats such as earthquakes, hurricanes, tornadoes, floods, and some types of fires. Historically, natural disasters have provided some of the most devastating disasters to which an organization must respond.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What do human disasters include?

A

Human—The human category of threats represents the most common source of disasters. Human threats can be further classified by whether they constitute an intentional or unintentional threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What do environmental disasters include?

A

Environmental—Threats focused on information systems or datacenter environments; includes items such as power issues (blackout, brownout, surge, spike, etc.), system component or other equipment failures, and application or software flaws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the 7 types of disruptive events?

A

Types of disruptive events include:
• Errors and omissions: typically considered the most common source of disruptive events. This type of threat is caused by humans who unintentionally serve as a source of harm.
• Natural disasters: include earthquakes, hurricanes, floods, tsunamis, etc.
• Electrical or power problems: loss of power may cause availability issues, as well as integrity issues due to corrupted data.
• Temperature and humidity failures: may damage equipment due to overheating, corrosion, or static electricity.
• Warfare, terrorism, and sabotage: threats can vary dramatically based on geographic location, industry, and brand value, as well as the interrelatedness with other high-value target organizations.
• Financially motivated attackers: attackers who seek to make money by attacking victim organizations, includes exfiltration of cardholder data, identity theft, pump-and-dump stock
schemes, bogus antimalware tools, corporate espionage, and others.
• Personnel shortages: may be caused by strikes, pandemics, or transportation issues. A lack of staff may lead to operational disruption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the five steps in the disaster recovery process?

A

Steps in the disaster recovery process:

Respond - assessing the damage. determine if event constitutes a disaster
Activate team
Communicate - This communication often must occur out-of-band, meaning that the typical communication method of leveraging an office phone will quite often not be a viable option
Access - Though an initial assessment was carried out during the initial response portion of the disaster recovery process, a more detailed and thorough assessment will be performed by the disaster recovery team
Reconstitution - successfully recover critical business operations at either a primary or secondary site.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the 8 steps withing NIST 800-34 for creating a BCP/DRP?

A

NIST SP 800-34 Steps in creating a BCP/DRP:

  • Project Initiation
  • Scope of the Project
  • Business Impact Analysis (BIA)
  • Identify Preventive Controls
  • Recovery Strategy
  • Plan Design and Development
  • Implementation, Training, and Testing
  • BCP/DRP Maintenance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a continuity of operations plan?

A

Continuity of operations plan- The COOP describes the procedures required to maintain operations during a disaster. This includes transfer of personnel to an alternate disaster recovery site and operations of that site.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a business recovery plan?

A

Business recovery plan- The BRP, also known as the Business Resumption Plan, details the steps required to restore normal business operations after recovering from a disruptive event. This may include switching operations from an alternate site back to a repaired primary site. The BRP picks up when the COOP is complete. This plan is narrow and focused: the BRP is sometimes included as an appendix to the BCP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a continuity of support plan?

A

Continuity of support plan- The Continuity of Support Plan focuses narrowly on support of specific IT systems and applications. It is also called the IT Contingency Plan, emphasizing IT over general business support.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a cyber incident response plan?

A

Cyberincident response plan- The Cyberincident Response Plan is designed to respond to disruptive cyberevents, including network-based attacks. Loss of network connectivity alone may constitute a disaster for many organizations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is an occupant emergency plan?

A

Occupant emergency plan- The OEP provides the “response procedures for occupants of a facility in the event of a situation posing a potential threat to the health and safety of personnel, the environment, or property. Such events would include a fire, hurricane, criminal attack, or a medical emergency.” This plan is facilities-focused, as opposed to business- or IT-focused. The OEP is focused on safety and evacuation, and should describe specific safety drills, including evacuation or fire drills.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a crisis management plan?

A

Crisis management plan- The CMP is designed to provide effective coordination among the managers of the organization in the event of an emergency or disruptive event. The CMP details the actions management must take to ensure that life and safety of personnel and property are immediately protected in case of a disaster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a crisis communications plan?

A

Crisis communications plan -A critical component of the CMP is the Crisis Communications Plan, which is sometimes simply called the communications plan. This is a plan for communicating to staff and the public in the event of a disruptive event. Instructions for notifying the affected members of the organization are an integral part to any BCP/DRP.

32
Q

What is electronic vaulting?

A

Electronic vaulting is the batch process of electronically transmitting data that is to be backed up on a routine, regularly scheduled time interval. It is used to ransfer bulk information to an offsite facility.

33
Q

What is database journaling?

A

Database Journaling- a database journal contains a log of all database transactions. The transactions can be rebuilt from the logs if we lose the original files.

34
Q

What is database shadowing?

A

Database shadowing uses two or more identical databases that are updated simultaneously. The shadow database(s) can exist locally, but it is best practice to host one shadow database offsite.

35
Q

What are the 7 levels of DRP testing?

A 
Ranked in order of cost and complexity, from low to high:
• DRP Review
• Read-Through/Checklist/Consistency
• Structured Walkthrough/Tabletop
• Simulation Test/Walkthrough Drill
• Parallel Processing
• Partial Interruption
• Complete Business Interruption
36
Q

What are the 10 common BCP/DRP mistakes?

A

Common BCP/DRP mistakes include:
• Lack of management support
• Lack of business unit involvement
• Lack of prioritization among critical staff
• Improper (often overly narrow) scope
• Inadequate telecommunications management
• Inadequate supply chain management
• Incomplete or inadequate CMP
• Lack of testing
• Lack of training and awareness
• Failure to keep the BCP/DRP plan up to date

37
Q

What three things is ISO 27031 designed to do?

A

ISO/IEC 27031 is designed to:
• “Provide a framework (methods and processes) for any organization—private, governmental, and nongovernmental
• Identify and specify all relevant aspects including performance criteria, design, and implementation details for improving ICT readiness as part of the organization’s SMS, helping
to ensure business continuity
• Enable an organization to measure its continuity, security and hence readiness to survive a disaster in a consistent and recognized manner.”

38
Q

What does RAID striping achieve?

A

Striping focuses on increasing read and write performance by spreading data across multiple hard disks. Writes can be performed in parallel across multiple disks rather than serially on one disk. This parallelization increases performance and does not contribute to data redundancy.

39
Q

What does RAID parity achieve?

A

Parity achieves data redundancy without incurring the same degree of cost as that of mirroring in terms of disk usage and write performance.

40
Q

Which of these would be something that staff could sign to acknowledge that they understand and agree with their responsibilities during a disaster?

A

MOU/MOA (Memorandum of Understanding/Agreement): Staff signs a legal document acknowledging they are responsible for a certain activity. If the test asks, “A critical staff member didn’t show, and they were supposed to be there. What could have fixed that problem?” it would be the MOU/MOA. While slightly different, they are used interchangeably on the test.

41
Q

What is another term for signature matching?

A

Signature (Pattern) matching, similar to anti virus, it matches traffic against a long list of known malicious traffic patterns.

42
Q

In our Business Continuity Plan (BCP) which team is defined as responsible for returning us to full normal operations?

A

Salvage team (failback): Responsible for returning our full infrastructure, staff and operations to our primary site or a new facility if the old site was destroyed. We get the least critical systems up first, we want to ensure the new sites is ready and stable before moving the critical systems back.

43
Q

What is a low bandwidth coordinated attack?

A

Low-bandwidth coordinated attacks: A number of attackers (or agents) allocate different ports or hosts to different attackers making it difficult for the IDS to correlate the captured packets and deduce that a network scan is in progress.

44
Q

Why would we want to keep a positive pressure in our data center?

A

In our data center we want to keep a positive pressure to keep contaminants out, this can be dust particles that can set off particle sensors and release FM200 or another fire suppressant gas.

45
Q

What are the four types of IDS/IPSs?

A

IDSs (Intrusion Detection Systems) and IPSs (Intrusion Prevention Systems) can be categorized into 2 types and with 2 different approaches to identifying malicious traffic. Network based, placed on a network segment (a switch port in promiscuous mode). Host based, on a client, normally a server or workstation. Signature (Pattern) matching, similar to anti virus, it matches traffic against a long list of known malicious traffic patterns. Heuristic (Behavioral) based, uses a normal traffic pattern baseline to monitor for abnormal traffic.

46
Q

Our main facility has been hit with a complete power outage and we need to set up a temporary command and control center. What would we be deploying?

A

EOC (Emergency Operations Center): A central temporary command and control facility responsible for our emergency management, or disaster management functions at a strategic level during an emergency. It ensuring the continuity of operation of our organization. We place the EOC in a secure location if the disaster is impacting a larger area.

47
Q

What is the difference between a hot site and a redundant site?

A

Hot site: Similar to the redundant site, but only houses critical applications and systems, often on lower spec’d systems. Still often a smaller but a full data center, with redundant UPS’, HVACs, ISPs, generators. We may have to manually fail traffic over, but a full switch can take an hour or less. Near or real-time copies of data.

48
Q

What are the two forms of collection used in network forensics?

A

Network forensics: Systems used to collect network data for forensics use usually come in two forms: Catch-it-as-you-can: All packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage. Stop, look and listen: Each packet is analyzed in a basic way in memory and only certain information is saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.

49
Q

During and after an attack on one of our servers, what would be one of the reasons we would we NOT want to shut a compromised system down?

A

Sensitive data could be in volatile memory.

50
Q

What are the 8 plans found within a BCP?

A

BCP’s often contain DRP (Disaster Recovery Plan), COOP (Continuity of Operations Plan), Crisis Communications Plan, Crisis Management Plan, Critical Infrastructure Protection Plan, Cyber Incident Response Plan, ISCP (Information System Contingency Plan), and Occupant Emergency Plan.

51
Q

What could allow a US government agency to access your personal files and would circumvent the 4th amendment?

A

Anything subpoenaed, search warranted, turned over voluntary and in exigent circumstances (immediate danger of being destroyed), can allow law enforcement to bypass the 4th amendment. If it was legal will be decided in a court of law later.

52
Q

Which backup types clear the archive bit?

A

Full and incremental backups clears the archive bit (a flag that indicates the file was changed since the last full/incremental backup).

53
Q

What is one of the key benefits of using a Host-based Intrusion Prevention System (HIPS) over a Network-based Intrusion Prevention System (NIPS)?

A

Can look at encrypted packets

54
Q

We are restoring services and applications back from our DR site to our original site after a security incident. Which applications would we move back FIRST?

A

Least critical

55
Q

In our Disaster Recovery Plan (DRP), we could have listed the minimum hardware requirements for a certain system to function. What would that be called?

A

Minimum Operating Requirements (MOR) (Minimum Operating Requirements): The minimum environmental and connectivity requirements for our critical systems to function, can also at times have minimum system requirements for DR sites. We may not need a fully spec’d system to resume the business functionality.

56
Q

Which type of backup will back up everything, but does NOT clear the archive bit?

A

Copy backup: This is a full backup with one important difference, it does not clear the archive bit. Often used before we do system updates, patches and similar upgrades. We do not want to mess up the backup cycle, but we want to be able to revert to a previous good copy if something goes wrong.

57
Q

What are the four phases of the DRP lifecycle?

A

DRP has a lifecycle of Mitigation, Preparation, Response and Recovery. Mitigation: Reduce the impact, and likeliness of a disaster. Preparation: Build programs, procedures and tools for our response. Response: How we react in a disaster, following the procedures. Recovery: Reestablish basic functionality and get back to full production.

58
Q

What is unit testing?

A

Unit testing: Tests that verify the functionality of a specific section of code. In an object-oriented environment, this is usually at the class level, and the minimal unit tests include the constructors and destructors. Usually written by developers as they work on code (white-box), to ensure that the specific function is working as expected.

59
Q

During or after a security incident, in which order would we work on the forensic evidence?

A

Work from most volatile to least volatile, starting with the RAM and ending with the hard disks.

60
Q

What is a subscription site?

A

Subscription/cloud site: We pay someone else to have a minimal or full replica of our production environment up and running within a certain number of hours (SLA).

61
Q

What are the 6 goals of change management?

A 
Implement in an orderly manner
Formalized testing
Ability to reverse changes
Ability to inform users of changes
Minimize negative impact of changes
Minimize risk of changes
62
Q

What is a parallel run?

A

A form of new system deployment testing where the old system and the new system are run simultaneously.

63
Q

What is database partitioning?

A

Security feature used to subvert aggregation, inferencing, and contamination

64
Q

What is concurrency?

A

A database security feature that uses locking to prevent simultaneous write access to cells.

65
Q

What kind of relationships can be established with relational databases, hierarchical databases, and distributed databases?

A

Relational databases: one-to-one
Hierarchical databases: one-to-many
Distributed databases: many-to-many

66
Q

What are the six basic SQL commands?

A

Select, update, delete, insert, grant, take

67
Q

What is the cardinality and degree of a database table?

A

Cardinality refers to the number of rows in the table, whereas the degree of a table is the number of columns.

68
Q

What is workgroup recovery?

A

A type of disaster recovery that separates recovery sites by business teams.

69
Q

What role does a service bureau play in disaster recovery?

A

Leasing computer time via contractual agreements to meet an organization’s needs in a disaster or catastrophic failure.

70
Q

What three terms defines the operations security triple?

A

The relationship between assets, vulnerabilities, and threats

71
Q

What are the three teams involved in disaster recovery?

A 
Rescue team (activation/notification): 
Responsible for dealing with the disaster as it happens. Evacuates employees, notifies the appropriate personnel (call trees) pulls the network from the infected server or shuts down systems, and initial damage assessment.
Recovery team (failover):
Responsible for getting the alternate site up and running as fast as possible or for getting the systems rebuilt. We get the most critical systems up first.
Salvage team (failback):
Responsible for returning our full infrastructure, staff and operations to our primary site or a new facility if the old site was destroyed. We get the least critical systems up first, we want to ensure the new sites is ready and stable before moving the critical systems back
72
Q

What is the recovery point objective (RPO)?

A

RPO (Recovery Point Objective): The acceptable amount of data that cannot be recovered. The recovery point objective must ensure that the maximum tolerable data loss for each system, function or activity is not exceeded.
If we only back-up once a week, we accept up to a week of data loss.

73
Q

What is the difference between RTO and WRT?

A

RTO (Recovery Time Objective): The amount of time to restore the system (hardware).
The recovery time objective must ensure that the MTD for each system, function or activity is not exceeded.

WRT (Work Recovery Time): (software): How much time is required to configure a recovered system

74
Q

What is purging of storage media?

A

Clearing media for reuse in a less secure environment.. It must be done in a way that previous data is not recoverable.

75
Q

What is declassification of storage media?

A

Purging media or a system in preparation for rescue in an unclassified environment.

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions