Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CYBR 158 > MOD 8 - Midterm > Flashcards

MOD 8 - Midterm Flashcards

1
Q

What do the letters in the CIA triad stand for?

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is confidentiality?

A

Concept of measures used to ensure the protection of the secrecy of data, objects or resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is integrity?

A

The concept of protecting the reliability and correctness of data. prevents unauthorized altercations of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Availability?

A

Authorized subjects are granted timely and uninterrupted access to objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Name the AAA services.

A

Identification
Authentication
Authorization
Auditing
Accounting(Accountability)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the types of security plans in security governance

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the minimum level of security?

A

Baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Due dilligence

A

Establishing a plan, policy and process to protect the interest of an organization, knowing what should be done and planning for it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Due care

A

practicing the individual activities that maintain the due diligence effort, doing the right action at the right time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Separation of duties

A

Making sure duties are split from each other so things get done ; protects from fraud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Job rotation

A

Making sure multiple people know how to do the same job and you are forcefully rotated into this position; protects against fraud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is SLA?

A

Service Level Agreement
An agreement established ahead of time that ensures organizations providing services to internal and/or external customers maintain an appropriate level of service agreed on by both the service provider and the vendor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is security governance

A

The collection of practices related to supporting, defining and directing the security efforts of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is risk assessment?

A

A detailed process of identifying factors that could damage or disclose data, evaluating those factors in light of data value and countermeasure cost, and implementing cost-effective solutions for mitigating or reducing risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is vulnerability?

A

Weakness in asset or the absence or the weakness of a safeguard or countermeasure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the types of risk analysis?

A

Qualitative - Rank threats on a scale to evaluate their risks, costs and effects
Quantitative - Inventory assets and assign a value (money)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the risk responses?

A

Reduce/Mitigate
Assign/Transfer
Accept
Deter
Avoid
Reject/Ignore

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is exposure?

A

The amount of damage done to an asset if the risk manifests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is asset value?

A

How much something costs. Dollar amount of the asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is BCP?

A

Business Continuity Planning

Involves assessing risks to organizational processes and creating policies, plans and procedures to minimize the impact those risks might have on the organization if they were to occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is shoulder surfing?

A

Looking over someone shoulder to get their information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the 4 steps of BCP?

A

Project planning and scope
Business impact analysis
Continuity planning
Approval and implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the two types of threats?

A

Natural
Person made/Man made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Why is BCP used?

A

To reduce the impact of a realized risk on organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the main formula for SLE?

A

SLE (Single loss expectancy) = Asset value * Exposure Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the formula for ALE?

A

ALE = SLE * ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is ARO?

A

Annualized rate of occurrence (number of times per year)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

In the scope of BIA, what is MTD?

A

Maximum tolerable downtime

The amount of time a business can be inoperable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is RTO?

A

Recovery time objective

The amount of time it takes for a business to recover.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is PHI?

A

Protected Health Information

Health information that relates to an individual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is proprietary data?

A

It gives competitive advantage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the government data classification?

A

Top secret
Secret
Confidential
Unclassified
For official use only
Sensitive but unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the non-government data classification?

A

Confidential/Proprietary
Private
Sensitive
Public

34
Q

What is Data at Rest?

A

Any data stored on media such as system hard drives, solid state devices, external, USB drives, storage area networks and backup tapes.

35
Q

What is Data in transit

A

Includes data transmitted over an internal network using wired or wireless methods and data transmitted over public networks such as the internet.

36
Q

What is Data in use?

A

Refers to data in memory or temporary storage buffers while an application is using it.

37
Q

What is DLP? How does it work?

A

Data Loss Prevention

Hostbased/Endpoint Based DLP (looks on your host to make sure information isn’t put on USB stick.
Network based DLP (looks on the network to find keywords)

38
Q

What do baselines provide?

A

The minimum level of security

39
Q

What is PII?

A

Personal Identifiable Information

Anything that can identify a human

40
Q

What would occur if top secret data is breached?

A

Exceptionally grave damage

41
Q

What is anonymization?

A

The process of removing all relevant data so that it is theoretically impossible to identify the original subject or person.

42
Q

What is hardware?

A

Physical components of a computer.
Anything you can touch.

43
Q

What is multi-processing?

A

Having more than one processor simultaneously

44
Q

What are the 2 modes in an operating system

A

User and Privileged/Kernel

45
Q

What is ROM?

A

Read Only Memory

You can’t write on it

46
Q

What is Random Access Memory?

A

Directly readable and writable memory

47
Q

What is Firmware?

A

Software that is stored in a ROM or an EEPROM chip.
E.g BIOS

48
Q

What is a DCE?

A

Distributed Computing environment

49
Q

What is IOT?

A

Internet of things

50
Q

Mobile device deployment policy

A

Bring your own device (BYOD)
COE (Corporate-Owned personally enabled)
CYOD (Choose your own device)
COMS (Corporately owned mobile strategy; the best one)

51
Q

What is a rootkit?

A

Malware that embeds itself deep within an OS

52
Q

What is a covert channel?

A

Information that is shared on a path that is not normally used to pass information.

53
Q

What is Malware?

A

A broad range of software threats that exploit various network,
operating system, software, and physical security vulnerabilities to spread
malicious payload to computer systems.

or

Broad range of software with malicious payloads

EX: Trojan Horses, viruses, worms

54
Q

What is APT?

A

Advanced persistent Threat

55
Q

What are the two main functions of viruses?

A

Propagation
Destruction

56
Q

What is a logic bomb?

A

Malicious code that lies dormant until triggered by the occurrence of one or more conditions such as time, program launch, website logon, certain keystrokes.

57
Q

Who introduced logic bombs?

A

Coders because they want to protect their code.

58
Q

What worm infected something in Iran?

A

Stuxnet

59
Q

What is spyware?

A

Monitors your actions and transmits important details to a remote system that spies on your activity.

60
Q

What are zero days?

A

Security flaws discovered by hackers that have not been thoroughly addressed by the security community.

61
Q

What is integrity monitoring?

A

Programs that detect unauthorized file modifications

62
Q

What is code signing?

A

Use digital signatures to ensure the authenticity of code.

63
Q

What are injection attacks?

A

Specially formatting input to execute user-defined SQL commands.

64
Q

What is secure coding practices?

A

Input Validation
Error handling
Remove comments
Get rid of hardcoded credentials

65
Q

What does physical security protect against?

A

Physical threats

66
Q

What is secure facility plan?

A

Outlines the security needs of your organization and emphasizes methods or mechanisms to employ to provide security.

67
Q

What is critical path analysis?

A

A systematic effort to identify relationships between mission-critical applications, processes and operations and all of the necessary supporting elements.

68
Q

What are the functional order of controls?

A

Deterrence
Denial
Detection
Delay
Determine
Decide

69
Q

What is MTTF?

A

Mean Time To failure

Expected typical functional lifetime required to perform a repair on a device given a specific operating environment

70
Q

What is MTTR?

A

Mean Time To Repair

Average length of time required to perform a repair on the device

71
Q

What physical considerations are required for server rooms?

A

Human Incompatible:
Gas fire extinguisher
Low temperatures
Little or no lightning
Equipment stacked with little room to maneuver

72
Q

What is local alarm system?

A

Broadcast audible alarm

73
Q

What is piggybacking?

A

Following someone through a secured gate or doorway without being identified or authorized personally

74
Q

What is a SCIF?

A

Sensitive Compartmented Information Facility

Used by the government and military contractors to provide a secure environment for highly sensitive data storage and computation.

75
Q

What is UPS?

A

Uninterruptable Power Supply

A self charging battery that can be used to supply consistent clean power to sensitive equipment.

76
Q

What is a brownout?

A

Prolonged low voltage

77
Q

What are the two modes of EMI?

A
78
Q

What class of fire extinguishers should be used for electric systems?

A

Class C

79
Q

What is Access control vestibule?

A

A mantrap

80
Q

What is KPI? What does it do?

A

Key Performance Indicators

Provide metrics of operations.

CYBR 158 (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions