Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Course 001 - Foundations of Cybersecurity > Module 2 - 01-2 > Flashcards

Module 2 - 01-2 Flashcards

The Eight CISSP Security Domains

1
Q

What does CISSP stand for?

A

Certified Information Systems Security Professional (CISSP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are Core Security Concepts called?

A

Security Domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

As of 2022, how many Security Domains has the CISSP defined?

A

Eight (8)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the Eight CISSP Security Domains?

A

1) Security and Risk Management
2) Asset Security
3) Security Architecture and Engineering
4) Communication and Network Security
5) Identity and Access Management
6) Security Assessment and Testing
7) Security Operations
8) Software Development Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the First (1st) CISSP Security Domain?

A

1) Security and Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define (1) Security and Risk Management

A

Defines security goals and objectives, risk mitigation, compliance, business continuity, and the law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the Second (2nd) CISSP Security Domain?

A

2) Asset Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define (2) Asset Security

A

Secures digital and physical assets.
It’s also related to the storage, maintenance, retention, and destruction of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the Third (3rd) CISSP Security Domain?

A

3) Security Architecture and Engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define (3) Security Architecture and Engineering

A

Optimizes data security by ensuring effective tools, systems, and processes are in place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the Fourth (4th) CISSP Security Domain?

A

4) Communication and Network Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define (4) Communication and Network Security

A

Manage and secure physical networks and wireless communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the Fifth (5th) CISSP Security Domain?

A

5) Identity and Access Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define (5) Identity and Access Management

A

Keeps data secure, by ensuring users follow established policies to control and manage physical assets, like office spaces, and logical assets, such as networks and applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the Sixth (6th) CISSP Security Domain?

A

6) Security Assessment and Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define (6) Security Assessment and Testing

A

Conducting security control testing, collecting and analyzing data, and conducting security audits to monitor for risks, threats, and vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the Seventh (7th) CISSP Security Domain?

A

7) Security Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define (7) Security Operations

A

Conducting investigations and implementing preventative measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the Eighth (8th) CISSP Security Domain?

A

8) Software Development Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define (8) Software Development Security

A

Uses secure coding practices, which are a set of recommended guidelines that are used to create secure applications and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define Firewall

A

A device used to monitor and filter incoming and outgoing computer network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are some additional methods of attacks (6)?

A

Password Attack
Social Engineering Attack
Physical Attack
Adversarial Artificial Intelligence
Supply-Chain Attack
Cryptographic Attack

23
Q

Define Password Attack

A

An attempt to access password-secured devices, systems, networks, or data

24
Q

What are some forms of Password Attacks (2)?

A
  • Brute Force
  • Rainbow Table
25
Q

What CISSP Security Domain does Password Attacks fall under?

A

Communication and Network Security Domain

26
Q

Define Social Engineering Attack

A

A manipulation technique that exploits human error to gain private information, access, or valuables

27
Q

What are some forms of Social Engineering Attack (10)?

A
  • Phishing
  • Smishing
  • Vishing
  • Spear Phishing
  • Whaling
  • Social Media Phishing
  • Business Email Compromise (BEC)
  • Watering Hole Attack
  • USB (Universal Serial Bus) Baiting
  • Physical Social Engineering
28
Q

What CISSP Security Domain does Social Engineering Attacks fall under?

A

Security and Risk Management Domain

29
Q

Define Physical Attack

A

A security incident that affects not only digital but also physical environments where the incident is deployed

30
Q

What are some forms of Physical Attack (3)?

A
  • Malicious USB Cable
  • Malicious Flash Drive
  • Card Cloning and Skimming
31
Q

What CISSP Security Domain does Physical Attack fall under?

A

Asset Security Domain

32
Q

Define Adversarial Artificial Intelligence

A

A technique that manipulates artificial intelligence and machine learning technology to conduct attacks more efficiently

33
Q

What CISSP Security Domain does Adversarial Artificial Intelligence fall under (2)?

A
  • Communication and Network Security Domain
  • Identity and Access Management Domain
34
Q

Define Supply-Chain Attack

A

Targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed

35
Q

What CISSP Security Domain does Supply-chain attack fall under (3)?

A

Supply-chain attacks can fall under several domains, including but not limited to the:

  • Security and Risk Management,
  • Security Architecture and Engineering, and
  • Security Operations Domains.
36
Q

Define Cryptographic Attack

A

Affects secure forms of communication between a sender and intended recipient

37
Q

What are some forms of Cryptographic Attack (3)?

A
  • Birthday
  • Collision
  • Downgrade
38
Q

What CISSP Security Domain does Cryptographic Attack fall under?

A

Communication and Network Security Domain

39
Q

Define Threat Actor

A

Any person or group who presents a security risk

40
Q

What are some Threat Actor types (3)?

A
  • Advanced Persistent Threats
  • Insider Threats
  • Hacktivists
41
Q

What does APTs stand for?

A

Advanced Persistent Threats (APTs)

42
Q

Define APTs

A

Advanced Persistent Threats (APTs) have significant expertise accessing an organization’s network without authorization.
APTs tend to research their targets in advance and can remain undetected for an extended period of time.
Their intentions and motivations can include:
* Damaging critical infrastructure, such as the power grid and natural resources
* Gaining access to intellectual property, such as trade secrets or patents

43
Q

Define Insider Threats

A

Abuse their authorized access to obtain data that may harm an organization.
Their intentions and motivations can include:
* Sabotage
* Corruption
* Espionage
* Unauthorized data access or leaks

44
Q

Define Hacktivists

A

Threat actors that are driven by a political agenda.
They abuse digital technology to accomplish their goals, which may include:
* Demonstrations
* Propaganda
* Social change campaigns
* Fame

45
Q

Define Hacker

A

Any person who uses computers to gain access to computer systems, networks, or data

46
Q

What are some Hacker types (3)?

A
  • Authorized Hackers are also called Ethical Hackers
  • Semi-Authorized Hackers are considered Researchers
  • Unauthorized Hackers are also called Unethical Hackers
47
Q

Define Authorized Hackers
(Ethical Hackers)

A

They follow a code of ethics and adhere to the law to conduct organizational risk evaluations. They are motivated to safeguard people and organizations from malicious threat actors.

48
Q

Define Semi-Authorized Hackers
(Researchers)

A

They search for vulnerabilities but don’t take advantage of the vulnerabilities they find.

49
Q

Define Unauthorized Hackers
(Unethical Hackers)

A

They are malicious threat actors who do not follow or respect the law. Their goal is to collect and sell confidential data for financial gain.

50
Q

Examples of security _____ include security and risk management and security architecture and engineering.

A

domains

Examples of security domains include security and risk management and security architecture and engineering.

51
Q

A security professional is asked to destroy and dispose of old hard drives that include confidential customer information. Which security domain is this task related to?

A

Asset security

This task is related to the asset security domain. This domain focuses on managing and securing digital and physical assets, as well as the storage, maintenance, retention, and destruction of data.

52
Q

Your supervisor asks you to audit user permissions for payroll data to ensure no unauthorized employees have access to it. Which security domain is this audit related to?

A

Security assessment and testing

This is related to security assessment and testing, which often involves regular audits of user permissions to make sure employees and teams have the correct level of access.

53
Q

You are asked to investigate an alert related to an unknown device that is connected to the company’s internal network. After you complete your investigation, you follow company policies and procedures to implement preventative measures that will stop the potential threat posed by the device. Which security domain is this scenario related to?

A

Security operations

This is related to the security operations domain, which is focused on conducting investigations and implementing preventative measures. In this scenario, following company policies and procedures to stop the potential threat is an example of taking preventative measures.

Course 001 - Foundations of Cybersecurity (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions