Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Operations > Flashcards

Operations Flashcards

1
Q

Administrative Personnel Controls examples

A 
Administrative Personnel Controls
•	Compartmentalization
•	Separation of Duties
•	Collusion
•	Rotation of duties
•	Mandatory Leave 
•	Non-disclosure agreement (NDA)- 
•	Background checks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Least Privilege

A

• Least Privilege- (aka minimum necessary access) subject has no more access than is strictly required to perform duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Need to Know

A

Need to Know- deals with sensitive data; leverage Mandatory Access Control; access is based on security clearance of subject and data classification of object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Compartmentalization

A

Compartmentalization- a method for enforcing Need to Know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Rotation of duties

A

Rotation of duties- one person does not perform critical functions without interruption; helps mitigate fraud (cost is always a consideration and can trump some controls)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Compartmentalization

A

Compartmentalization- a method for enforcing Need to Know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

3 types of controls

A

Administrative, Technical, Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data remanence

A

Data remanence- data that persists beyond non-invasive means to delete it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Wiping

A

Wiping (aka overwriting)- writes new data over each bit or block; disk damage may prevent successful overwriting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Shredding

A

Shredding- physical destruction; most secure; incineration or pulverization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Configuration Management

A

Configuration Management
• Defined by ISC2 as “a process of identifying and documenting hardware components, software and the associated settings.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Baselining

A

Baselining- capturing a point in time of the current system security config
o Necessitates monitoring config over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Vulnerability scanning

A

Vulnerability scanning- discovers poor configs and missing patches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Vulnerability management

A

Vulnerability management- prioritization and remediation of vulnerabilities; prioritization based on risk to org and ease of remediation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Full Backup

A

Full Backup- replica of all data; coupled with incremental or differential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Incremental Backup

A

Incremental Backup- backup files changed since last incremental backup. Odds of failed restoration due to tape integrity increase with each incremental backup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Differential Backup

A

Differential Backup- backup files changes since the last full backup (does not change the archive bit)

18
Q

Copy Backup

A

Copy Backup- Same as full backup, but Archive Bit is not reset; Use before upgrades, or system maintenance

19
Q

Mirroring

A

Mirroring- full data redundancy

20
Q

Striping

A

Striping- increases read/write performance by spreading data across multiple disks

21
Q

Parity

A

Parity- data redundancy without the same costs of mirroring. One or more disk drives contain parity information that allows them to rebuild data if a drive failure occurs.

22
Q

RAID 0

A

RAID 0- Striped Set; increases performance, not data redundancy

23
Q

RAID 1

A

RAID 1- Mirrored Set; duplicate data on added disk; write performance decreased; read performance increased

24
Q

RAID 5

A

RAID 5- striped set with distributed parity (block level); one of the most popular; distributes parity across disks

25
Q

RAID 1 + 0

A

RAID 1 + 0 (aka RAID 10)- striped set of mirrors

26
Q

Clustering

A

Clustering is a fault tolerant server technology that is similar to redundant servers, except each server takes part in processing services that are requested.

27
Q

Traffic Analysis

A

Traffic Analysis (aka Side Channel Analysis)- Watching traffic and its patterns to try and determine if something special is taking place

28
Q

Traffic Padding

A

Traffic Padding- Generating spurious data in traffic to make traffic analysis more difficult

29
Q

Protocol Analyzers

A

Protocol Analyzers (Sniffers)- run on switches in promiscuous mode using port span

30
Q

Types of IDS

A 
IDS (Intrusion Detection System)- 
Pattern Matching:
•	Rule-Based Intrusion Detection
•	Signature-Based Intrusion Detection—MOST COMMON
•	Knowledge-Based Intrusion Detection

Profile Comparison:
• Statistical-Based Intrusion Detection
• Anomaly-Based Intrusion Detection
• Behavior-Based Intrusion Detection

31
Q

Signature-Based Intrusion Detection

A

Signature-Based Intrusion Detection
o IDS has a database of signatures which are patterns of previously identified attacks
o Cannot identify new attacks
o Database needs continual updates

32
Q

Behavior-Based Intrusion Detection

A

Behavior-Based Intrusion Detection
o Compares audit files, logs, and network behavior, and develops and maintains profiles of normal behavior
o Better defense against new attacks
o Creates many false positives

33
Q

NIST Computer Security Incident Handling Guide has 4 steps in incident lifecycle

A

NIST Computer Security Incident Handling Guide has 4 steps in incident lifecycle:
1. Preparation- training, defining policies & procedures, tools
2. Detection and Analysis (aka identification)- determine if events are an incident
3. Containment- keep further damage from occurring
o Eradication- understanding cause so that the sys can be cleaned; root cause analysis; timeline developed to know when latest backup/image is good
o Recovery- system restoration; monitor closely after returning to production
4. Post-incident activity (aka lessons learned, remediation, post mortem, reporting)- most likely to be neglected; feeds back to preparation.

34
Q

Threat vectors (and examples)

A

Threat vectors- mediums that allow a threat agent to potentially exploit a vulnerability. e.g.:
o Network- attack against ports open through network and firewalls; most commonly defended against
o Web applications- attack against web app, associated server, and content
o Email attachment- malicious files that exploit client-side app vulnerabilities
o Phone lines- oldest and often overlooked
o Browser- hosts a malicious website or leverages a compromised trusted site
o Pivot attack- leverages and internal client (already compromised) to attack internal servers
o Insider threat- employee or contractor

35
Q

Security Assessment

A

Security Assessment- a physical, administrative, and logical holistic approach to assessing effectiveness of security controls.

36
Q

Penetration Testing

A

Penetration Testing- Ethical hacking to validate discovered weaknesses; Red Teams (Attack)/Blue Teams (Defend)

37
Q

NIST SP 800-42

A

NIST SP 800-42 Guideline on Security Testing

38
Q

Blind test

A

Blind test: The assessors have only publicly available knowledge. The network team knows that testing is taking place

39
Q

Double Blind test

A

Double Blind test: The assessors have only publicly available knowledge, but in this instance the network teams do NOT know the test is taking place. This will allow evaluation of incident response.

40
Q

Targeted test

A

Targeted test: External consultants work with internal staff to focus on specific systems or applications

41
Q

Test Attack Phases

A

Test Attack Phases:

  1. Planning
  2. Reconnaissance- WhoIs Database, Company Website, Job Search Engines, Social Networking
  3. Footprinting- Mapping the network (Nmap); ICMP ping sweeps; DNS zone transfers
  4. Fingerprinting- Identifying host information; Port scanning
  5. Vulnerability assessment- Identifying weaknesses in system configurations; discovering unpatched software
  6. The “attack”- Penetration; Privilege escalation; Root kits; Cover tracks with Trojaned Programs and Log Scrubbers
  7. Reporting
42
Q

Vulnerability Testing

A

Vulnerability Testing- Aka vulnerability scanning; Scans sys or network for list of predefined vulnerabilities

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions