Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Info Gov > Flashcards

Info Gov Flashcards

0
Q

What are the 5 classifications commonly used by the U.S. department of Defence?

A 
Unclassified
Sensitive but Unclassified (SBU)
Confidential
Secret
Top Secret
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

What is the opposite of CIA?

A

Disclosure
Alteration
Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which classification level (US DoD) may often use the terms “for official use only” or “for internal use only”?

A

Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the difference between unclassified and SBU? (US DoD)

A

SBU generally contains personal information ie medical records or disciplinary proceedings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the lowest level of classified government information? (US DoD)

A

Confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What term is commonly used to collectively represent policies, procedures, guidelines and standards that help steer an organisations decisions and operations?

A

Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the four main types of policies?

SARI

A

Senior Management
Regulatory
Advisory
Informative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which type of policy do most policies fall under?

SARI

A

Advisory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which type of identity management system facilitates authentication, non-repudiation and access control via digital certificates?

A

PKI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which 3 of the following 5 background checks would commonly be included as part of more extensive pre-employment screening?
Credit check
Drug test
Reference check
Special background investigation
Verification of personal/professional data in application

A

Credit check
Drug test
Special background investigations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Who is ultimately responsible for an organisations information security? management or information security professional?

A

Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

With regards information a system admin what commonly be known as what? Information owner or custodian?

A

Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which term is used to ensure that not one individual has complete authority or control over a critical system or process and also reduces dependence on individuals, ie avoiding a single point of failure?

A

Separation of duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which terms describes regularly transferring key personnel into different roles or positions in different parts of the organisation?

A

Job rotation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What 3 things does the risk assessment triple consist of?

A

Quantities risk methodologies
Risk calculations
Safeguard selection criteria and objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What 2 elements are multiplied to calculate a risk?

A

Threat x Vulnerability = Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What 3 elements does the risk management triple consist of?

A

Threat
Vulnerability
Asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk management consists of 3 elements. What are they?

A

Identification
Analysis
Risk Treatment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When does risk identification occur?

A

During a risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the two methods used for determining the value of an asset?

A

Quantitive

Qualities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which method is related to cost? Quantitive or qualative?

A

Quantitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which method is related to importance? Quantitive or qualative

A

Qualative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What 3 basic elements are used to determine the value of an asset?

A

Initial and maintenance costs
Organisational (internal) value
Public value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which value (organisational or public) includes the cost of acquiring, creating or re-creatinine information, and the business impact or loss if the information is lost or compromised. It can also include liability costs, personal injury, death, etc?

A

Organisational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which value (organisational or public) includes loss of proprietary information or processes and business reputation?

A

Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 4 basic steps in threat analysis?

A
  1. Define the threat
  2. Identify the consequences if threat occurs
  3. Determine the probable frequency of threat event
  4. Assess the probability of threat occurring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What two types are threats generally categorised as?

A

Man made

Natural

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which 4 steps are involved in risk analysis?

A
  1. Identify assets to be protected including sensitivity, value, importance to the organisation.
  2. Define specific threats including threat frequency and impact data
  3. Calculate Annualised Loss Expectancy (ALE)
  4. Select appropriate safeguards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How is the annual loss expectancy calculated?

A

SLE x ARO = ALE

Single loss expectancy x annual rate of occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How is single loss expectancy (SLE) calculated?

A

Asset value x Exposure Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a measure of the negative effect or impact that a realised threat or event would have on a specific asset, expressed as a percentage otherwise known as?

A

Exposure factor

31
Q

Which type of risk analysis would include the following advantages?
No complex calculations are required
Time and work effort involved is relatively low
Volume of input data required is relatively low

A

Qualative

32
Q

Which type of risk analysis would include the following advantages?
Financial costs are defined (cost-benefit analysis)
More concise, specific data supports analysis, ie fewer assumptions
Analysis and calculations can often be automated
Specific quantifiable results are easier to communicate

A

Quantitive

33
Q

Which type of risk analysis is scenario driven and doesn’t use numeric values?

A

Qualative

34
Q

Which type of risk analysis attempts to assign objective numeric values?

A

Quantitive

35
Q

Purely Quantitive risk analysis is generally not possible or practical? True or false?

A

True

36
Q

What are the 4 methods of risk treatment?

A

Risk reduction
Risk assignment (or transference)
Risk avoidance
Risk acceptance

37
Q

What is the calculation for cost benefit analysis?

A

ALE before safeguard - ALE after safeguard - cost of safeguard = value of safeguard

38
Q

What should be considered when calculating the cost of a safeguard?

A

Total cost of ownership (TCO)

39
Q

What 4 criteria should be considered when selecting a safeguard?

A

Cost effectiveness
Legal liability
Operational impact
Technical factors

40
Q

What are the 3 main components of an effective security awareness program?

A

General awareness program, formal training and education

41
Q

What 5 key factors are critical to a successful security awareness program?

A

Senior level management support
Demonstration that security supports business objectives
Demonstration that security affects all individuals and job functions
Take into account the target audience ie level of training
Action and follow up

42
Q

Which person directs, coordinates, plans and organises information security activities throughout the organisation?
Security officer
Information Systems Security professional
Security Administrator

A

Security Officer

43
Q

Who is responsible for drafting of policies, standards and supporting guidelines, procedures and baselines?
Security officer
Information Systems Security professional
Security Administrator

A

Information Systems Security Professional

44
Q

Who is responsible for designing security controls into information systems, testing the controls and implementing the systems in production?
Security officer
Information Systems Security professional
Security Administrator
Information Systems/Technology Professional

A

Information Systems/Technology Professional

45
Q

Who is responsible for managing user access requests and privileges?
Security officer
Information Systems Security professional
Security Administrator
Information Systems/Technology Professional

A

Security Administrator

46
Q

NIST SP 800-53 is mandatory for US federal agencies and their contractors. True or False?

A

True

47
Q

NIST SP 600-53 and ISO 27001 are examples of what?

A

Control frameworks

48
Q

Common organisations that develop standards?

A

National Institute of Standards and technology (NIST)
Institute of Electronics and Electrical Engineers (IEEE)
American National Standards Institure (ANSI)
National Security Agency (NSA)

49
Q

Guidelines are recommendations, best practices and templates documented in the frameworks created by other organisations such as:

A
  • Control Objectives For Information and Related Technology (COBIT)
  • the Capability Maturity Model (CMM)
  • ISO 2700
50
Q 
Which two governance Framework documents are best to keep as standalone?
procedures
guidelines
policies
standards
baselines
A

Standards and Policies

51
Q

How often should a policy be reviewed?

A

Annually

52
Q

The following are types of what?
Canada’s “Security of Information Act”
China’s Law on “Guarding State Secrets”
The UK’s “Official Secrets Act”

A

classification and categorisation systems.

53
Q

NIST Federal Information Processing Standard 199 and NIST special publication 800-60 “Guide for mapping types of information and information systems to security categories” are required to be followed by whom

A

The US Federal Government

54
Q

What are the 9 steps of the NIST Risk Methodology?

A
  1. System Characterisation
  2. Threat Identification
  3. Vulnerability Identification
  4. Control Analysis
  5. Liklihood Determination
  6. Impact Analysis
  7. Risk Determination
  8. Control Reccomendations
  9. Results Documentation
55
Q

Which Framework/Methodology identifies 5 areas of internal control necessary to meet the Financial Reporting and disclosure objectives?

A

-COSO (The Committee of sponsoring organisations of the Treadway Commission)

56
Q

Which Framework/Methodology contains a set of best practices for IT core operational processes such as change, release and configuration management, incident and problem management, capacity and availability management and IT Financial Management. It’s primary contribution is showing how the controls can be implemented for the service management IT processes?

  • ITIL (The IT Infrastructure Library)
  • COBIT (Control Objectives for Information and Related Technology)
A
  • ITIL (The IT Infrastructure Library)
57
Q

Which Framework/Methodology provides an overall structure for information technology control and includes control objectives. Also used to examine effectiveness, efficiency, compliance, confidentiality, etc. of high level control objectives.

  • ITIL (The IT Infrastructure Library)
  • COBIT (Control Objectives for Information and Related Technology)
A
  • COBIT (Control Objectives for Information and Related Technology)
58
Q

What is ISO 17799:2005 standard?

A

contains 134 information security controls

59
Q

What is ISO/IEC 27000?

A

the information security management series

60
Q

What is ISO 27002:2005?

A

specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented information security management system

61
Q

name 8 types of risk methodologies?

A
  • NIST SP 800-30, 800-39, 800-66 - Qualative, used by US federal government, plus regulated industries and health care. 9 stages
  • CRAMM - staged discipline approach, both technical and non-technical. uses asset identification & valuation, threat and vulnerability assessment and countermeasure selection and recommendation
  • Failure Modes and Effect Analysis - hardware/software analysis using Immediate level, intermediate level and system wide
  • FRAP - uses a narrow risk assessment. allows for pre-screening to determine is risk analysis is needed
  • OCTAVE - driven by operational risk and security practices. criteria is a set of principles, attributes and outputs
  • Security Officers Management and Analysis Project (SOMAP) - open information security management project
  • Spanning Tree Analysis - creates a tree of all possible threats to or faults in a system
  • VAR (Value At Risk) - provides a summary of the worst loss due to a security breach over a target horizon
62
Q

In a quantitative risk methodology, the calculation ALE = SLE x ARO can be adjusted using which 2 estimates?

A

Local Annual Frequency Estimate (LAFE)

Standard Annual Frequency Estimate (SAFE)

63
Q

What are the 4 elements of a risk?

A

threat
vulnerability
likelihood
impact

64
Q

What is the calculation for risk?

A

likelihood x impact

65
Q

Which risk methodology uses likelihood?

A

Qualitative

66
Q

How can the likelihood be determined?

A

capabilities of the threat and the presence or absence of countermeasures

67
Q

In asset valuation, what is the consensus/modified Delphi method?

A

Participants in a valuation exercise are asked to comment anonymously about the task at hand. results collected and then discussed in public forum

68
Q

What is the difference between a tangible asset and a intangible asset?

A

Tangible is something physical, intangible is not.

69
Q

How is a tangible asset generally valued?

A

Original cost minus depreciation.

70
Q

What are 3 ways to determine tangible asset value?

A
  • Original cost minus depreciation
  • Actual market value through research
  • cost of switching to a competing asset
71
Q

Intangible assets can be defined as what?

A

Definite - expiration date ,ie patent

Indefinite - no expiration date, ie brand

72
Q

How can an intangible asset value be calculated?

A
  • cost to create and replace
  • capitalisation of historic profits
  • cost avoidance or savings
73
Q

Job descriptions should have some reference to information security responsibilities. True or False?

A

True

74
Q

Credit checks carried out as part of employment checks must be done in line with which pieces of legislation in the US?

A

Fair Credit Reporting Act (FCRA)

Equal Employment Opportunity Commission (EEOC)

75
Q

In the US the law “Americans with Disabilities Act” (ADA) may provide protection for which individuals in the event of drug screening as part of employment checks?

A

individuals undergoing drug rehabilitation

76
Q

What is a CIRT?

A

Computer Incident Response Team

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions