Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Practice Test 1 > Flashcards

Practice Test 1 Flashcards

1
Q

Packets with internal source addresses entering the network

A

Packets with internal source addresses should never originate from outside the network; block them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Packets with external source addresses leaving the network

A

Packets with external source addresses should never be found on the internal network; block from leaving the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Packets with private IP addresses exiting the network

A

Private IP addresses should never be used on the internet; block from leaving the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Packets with public IP addresses entering the network

A

Packets with public IP addresses will routinely be allowed to enter the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CDN

A

content distribution network: provides reliable, low-latency, geographically distributed content distribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Four functions of a forensic disk controller

A

Write blocking: intercepts write commands sent to the device and prevents them from modifying data on the device. Returning data requested by a read operation. Returning access-significant information from the device. Reporting errors from the device back to the forensic host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

RAID 1

A

Disk mirroring; requires two physical disks that will contain copies of the same data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

TGS

A

ticket-granting service; receives and validates a TGT from the client, then issues a ticket and session keys to the client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

KDC

A

Key distribution center; does not communicate directly with the client as part of Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

AS

A

Authentication server forwards the username to the KDC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

TGT

A

ticket-granting ticket; provided by the client to the TGS for validation and in return, receives user’s rights to access the service requested

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

breach of contract by a vendor to protect sensitive data

A

civil investigation; contract dispute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Administrative investigation

A

for internal purposes and not applicable when a third party is being investigated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Criminal and regulatory investigation

A

initiated by those with regulatory authority, typically government agencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Wave pattern motion detectors

A

Transmit ultrasonic or microwave signals into the monitor area, watching for changes in the returned signals bouncing off objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Infrared head-based detectors

A

Watch for unusual heat patterns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Capacitance detectors

A

Work based upon electromagnetic fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Stateful packet inspection firewall

A

Dynamic packet filtering firewalls; track the state of a conversation and allow a response from a remote system based on an internal system being allowed to start the communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Static packet filtering and circuit-level gateways

A

Only filter based on source, destination, and ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Application-level gateway firewalls

A

Proxy traffic for specific applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

captive portal

A

provides access control for customers using wifi without provisioning user IDs while also gathering useful contact info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Business devices on open (unencrypted) wireless network

A

Wireless routers can provide multiple SSIDs. Separate SSID using WPA3 to create a private, secure network that is firewalled or logically separated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Hijacking customer web traffic including usernames and passwords

A

Open networks are unencrypted; traffic easily sniffable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Guideline

A

best practices, not mandatory; general, not specific

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Clipping

A

analysis technique that only reports alerts after they exceed a set threshold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

RADIUS

A

common AAA tech used to provide services for dial-up, wireless networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

OAuth

A

authentication protocol used to allow applications to act on a user’s behalf without sharing the password and is used for web applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

XTACACS; TACACS+

A

AAA technology; authentication, authorization, and accounting server for wireless network services using Cisco proprietary protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Inference

A

attacker uses several pieces of generic nonsensitive information to determine a specific sensitive value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Salami slicing attack

A

attacker siphons off minute quantities of money many times to accumulate a large amount of funds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Data diddling attack

A

attacker alters the contents of a database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Take-Grant protection model

A

Take rule allows a subject to take the rights belonging to another object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Brute-force attack

A

attack tries every possible password; password attempts change by one letter at each attempt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Dictionary attack

A

Uses dictionary words for the attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Man-in-the-middle or pass-the-hash

A

attacks would not be visible in an authentication log except as a successful login

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Isolation

A

database transactions operate separately from each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Atomicity

A

ensures that if any part of a database transaction fails, the entire transaction must be rolled back as if it never occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Consistency

A

ensures all transactions are consistent with the logical rules of the database, such as having a primary key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Durability

A

requires that once a transaction is committed to the database it must be preserved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

ACID model

A

database properties; Atomicity, Isolation, Consistency, Durability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Worm

A

built-in propagation mechanisms that do not require user interaction, scanning for systems containing known vulnerabilities and then exploiting those vulnerabilities to gain access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Viruses and Trojan horses

A

Require user interaction to spread

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Logic bomb

A

Lie in wait until certain conditions are met, triggering the delivery of their payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

HIPAA

A

Health Insurance Portability and Accountability Act; US law governing the healthcare sector that does provide for criminal penalties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

FERPA

A

Family Educational Rights and Privacy Act; US law governing educational records that does not provide for criminal penalties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

PCI DSS

A

Payment Card Industry Data Security Standard; industry standard for credit card operations and handling; it is not a law, so violations cannot incur criminal sanctions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

SOX

A

Sarbanes-Oxley Act; governs publicly traded corporations and also provides for criminal penalties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

TCP three-way handshake

A
  1. SYN (synchronize flagged packet) receives a response with a 2. SYN/ACK (synchronize and acknowledge flagged packet) and is acknowledged by the original sender with a 3. ACK (acknowledge packet)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

RST

A

Used in TCP to reset a connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

PSH

A

Used to send data immediately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

FIN

A

Used to end a connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

MDM capabilities

A

Mobile device management: manage device backups, enforce the use of encryption, and remotely wipe the contents of mobile devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

IDaaS

A

Identity as a service; provides an identity platform as a third party service. Provides integration with cloud services and removes overhead of traditional on-premises identity systems, but creates risk due to third-party control of identity services and reliance on off-site identity infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

ISC2 Code of Ethics

A

Advance and protect the profession (do not publicly share the exam questions); Act honorably, honestly, justly, responsibly, and legally; Protect society; Provide diligent service to principals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

ALE

A

annualized loss expectancy; the amount of damage the org expects to occur each year as the result of a given risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Whitelisting

A

approach to application control; allows users to install only those software packages specifically approved by administrators (tightly controlled)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Denial of service

A

attack that denies legitimate users authorized access to the system through the use of overwhelming traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Compromise

A

attack where the attacker attempts to gain access to the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Primary key

A

unique identifier in a database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

PII

A

personally identifiable information; data that can be used to distinguish or trace that person’s identity and also includes information like their medical, education, financial, and employment information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

PHI

A

personal health information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

EDI

A

electronic data interchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Proprietary

A

data used to maintain and organization’s competitive advantage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Public IP address

A

129.53.44.124; valid public IP address and legitimate destination for traffic leaving a network; 10.8.15.9 and 192.168.109.55 are both private IP addresses that should not be routed to the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Result of increasing length of cryptographic key by 8 bits

A

Increase size of the keyspace; binary keyspaces contain a number of keys equal to 2 raised to the power of the number of bits. 2 to the eighth power is 256, so the keyspace will increase by a factor of 256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Types of data assets disposed by shredding

A

Traditional office shredding for paper records and credit cards; Industrial shredders for equipment including removable media and hard drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Risk Mitigation Strategy

A

Reduces the probability of the risk (encryption reduces probability the data will be successfully stolen)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Risk avoidance

A

Avoid the risk (delete sensitive files and do not store them)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Risk transference

A

Purchase cyber-liability insurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Risk Acceptance

A

Taking no action on a risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Sampling

A

Should be done on a truly randomly to avoid human bias and on a sample of a sufficient size to provide effective coverage of the userbase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Involuntary termination under adverse circumstances

A

User is being fired and may have a negative and potentially hostile reaction. Important to terminate access immediately upon the user being informed of the termination. Terminating access prior to notification may tip the user off to the termination in advance. Leaving access privileges available after termination poses a risk of malicious insider activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Application log from an HTTP server

A

Log file with HTTP requests, evidenced by GET commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

CVSS

A

Common Vulnerability Scoring System; standardized approach to rating the severity of vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

STRIDE and ATT&CK

A

models used to classify the nature, not the severity, of threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

PASTA

A

model designed to help with countermeasure selection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Social engineering

A

Exploits humans to allow attacks to succeed; typically target help-desk employees posing as legitimate employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Trojans

A

type of malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Phishing

A

targeted attack via electronic communication methods intended to capture passwords or other sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Whaling

A

type of phishing aimed at high-profile or important targets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Supply Chain Risk to equipment

A

Interception and tampering of devices in transit from vendor to organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Single-level security environment

A

Classify information systems with the highest classification of information they are ever expected to process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Availability of authentication services is the priority

A

Identity platform should be hybrid to provide services both in the cloud and on-premises, ensuring service outages due to interrupted links are minimized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

On-site authentication service

A

Would continue to work during an internet outage but would not allow the e-commerce website to authenticate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Cloud authentication service

A

Would leave the corporate location offline during an outage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Federation

A

Links identity information between organizations. Federating with a business partner allows identification and authorization to occur between them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Single sign-on

A

Reduces the number of times a user has to log in but does not facilitate the sharing of identity information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

MFA

A

Multifactor authentication secures authentication but does not help integrate with a third party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

SAML

A

Security Assertion Markup Language (SAML) used to integrate cloud services and provides ability to make authentication and authorization assertions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

SPML

A

Service Provisioning Markup Language (SPML) used to provision users, resources, and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Rainbow tables

A

precomputed password hashes to conduct cracking attacks against password files. frustrated by use of salting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Salting

A

Adds a specified value to the password prior to hashing, making it much more difficult to perform precomputation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Honeypot

A

decoy computer system used to bait intruders into attacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Honeynet

A

a network of multiple honeypots that creates a more sophisticated environment for intruders to explore

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Pseudoflaw

A

False vulnerability in a system that may attract an attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Darknet

A

segment of unused network address space that should have no network activity and may be easily used to monitor for illicit activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

FAR

A

false acceptance rate; rate at which the system inadvertently admits an unauthorized user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

FRR

A

false rejection rate; rate at which the system inadvertently rejects an authorized user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

CER

A

crossover error rate; point where both the false acceptance rate and the false rejection rate cross; less subject to manipulation and thus the best metric to use for evaluating systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Steganography

A

the art of using cryptographic techniques to embed secret messages within other content. algorithms make invisible alterations to files by modifying the least significant bits of the many bits that make up image files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

VPN

A

Virtual Private Network; provide protection in transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Watermarking

A

embed information in an image with the intent of protecting intellectual property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

JavaScript

A

interpreted language so the code is not compiled prior to execution; code is human-readable in its final form allowing for inspection of the content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

C, C++, Java

A

compiled languages; compiler produces an executable file that is not human-readable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Shadow passwords in an /etc/passwd file

A

password field contains x; no password in plaintext, encrypted, or hashed form

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

EOL

A

end-of-life date for a product is normally the date the vendor will stop selling a product

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

EOS

A

end-of-support; date the vendor will stop supporting the product

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Due Care

A

Principle states that an individual should react in a situation using the same level of care that would be expected from any reasonable person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Due Diligence

A

Principle is a more specific component of due care that states that an individual assigned a responsibility should exercise due care to complete it accurately and in a timely manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Least Privilege

A

Principle states an individual should have the minimum set of permissions necessary to carry out their work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Separation of duties

A

Principle states that no single person should have the right to perform two distinct tasks which when combined constitute a highly privileged action

112
Q

Primary Driver for data classification

A

Sensitivity; the value of the information to the org, the damage caused if lost of compromised

113
Q

Risk of interception

A

Require the use of transport encryption; anyone intercepting the information would be unable to read its contents

114
Q

Tangible asset inventories

A

Physical items owned by the organization; server hardware, mobile devices

115
Q

Intangible asset inventory

A

non-physical items owned by the organization; intellectual property and files stored on a server

116
Q

Physical Layer; Fiber-Optic Cable

A

Layer of the OSI Model that deals with the electrical impulses or optical pulses sent as bits to convey data; cable tapping: attacker installs a tap on a cable

117
Q

Data Link, Network, or Transport layer attack

A

Higher levels of activity in the OSI model, compromising a device and using a protocol analyzer to sniff network traffic

118
Q

Vendor responsibility in IaaS

A

Responsible for all security mechanisms at the hypervisor layer and below; maintaining the hypervisor

119
Q

Customer Responsibility for IaaS

A

Responsible for server security operations; managing OS security settings, maintaining host firewalls, and configuring server access control

120
Q

Type I Hypervisor

A

Bare metal; acts like a lightweight operating system and runs directly on the host’s hardware; cloud service providers use Type I hypervisors, Hyper-V

121
Q

Type II Hypervisor

A

Hosted; runs as a software layer on an operating system like other computer programs; VirtualBox on my laptop

122
Q

Proactive monitoring

A

synthetic monitoring; uses recorded or generated traffic to test systems and software

123
Q

Passive monitoring

A

Uses a network span, tap, or other device to capture traffic to be analyzed

124
Q

Proximity Card

A

Uses an electromagnetic coil inside the card

125
Q

Parallel test

A

team activates the disaster recovery site for testing, but the primary site remains operational

126
Q

Full interruption test

A

team takes down the primary site and confirms that the disaster recovery site is capable of handling regular operations; most thorough but also most disruptive

127
Q

Checklist review

A

least disruptive disaster recovery test; team reviews the contents of their disaster recovery checklists on their own and suggest any necessary changes

128
Q

Tabletop exercise

A

team comes together and walks through a scenario without making any changes to information systems

129
Q

Agile approach to software development

A

12 principles; best architecture, requirements, and designs emerge from self-organizing teams; teams should welcome changing requirements at any step in the process; simplicity is essential; emphasis on delivering software frequently

130
Q

Hand geometry scanners

A

Assess the physical dimensions of an individual’s hand but do not verify other unique factors about the individual or even verify if they are alive; should not be implemented as the sole authentication factor for secure environments

131
Q

MTD

A

maximum tolerable downtime; the amount of time that a business may be without a service before irreparable harm occurs; MTO maximum tolerable outage; MAD maximum allowable downtime

132
Q

CASB

A

Cloud access security brokers; designed to enforce security policies consistently across cloud services

133
Q

DLP

A

Data loss prevention; detects, blocks, and controls use of information in the cloud

134
Q

DRM

A

digital rights management; detects, blocks, and controls use of information in the cloud

135
Q

IPS

A

Intrusion prevention systems; designed to detect and block malicious activity

136
Q

Replay attack

A

Specific type of masquerading attack that relies on captured authentication tokens, such as from a user’s web session to impersonate the user on the site

137
Q

Masquerading (or impersonation) attacks

A

Use stolen or falsified credentials to bypass authentication mechanisms

138
Q

Spoofing attack

A

Relies on falsifying an identity like an IP address or hostname without credentials

139
Q

Modification attacks

A

Occur when captured packets are modified and replayed to a system to attempt to perform an action

140
Q

OpenID Connect

A

An authentication layer that works with OAuth 2.0 as its underlying authorization framework; widely adopted by cloud service providers and widely supported; seamless integration with OAuth

141
Q

Kerberos

A

authentication technology

142
Q

Two-person control

A

Action requires the concurrence of two users

143
Q

Job rotation

A

Move people through jobs on a periodic basis to deter fraud

144
Q

Parol evidence rule

A

States that when an agreement between two parties is put into written form, it is assumed to be the entire agreement unless amended in writing

145
Q

Best evidence rule

A

States that a copy of a document is not admissible if the original document is available

146
Q

Real evidence and testimonial evidence

A

types of evidence

147
Q

NAT

A

Network Address Translation; translates an internal address to an external address

148
Q

VLANs

A

virtual local area networks; used to logically divide networks

149
Q

BGP

A

routing protocol

150
Q

SSAE-18

A

Reviews the use and application of controls in an audited organization; An attestation standard used for external audits, forms part of the underlying framework for SOC 1, 2, and 3 reports; DOES NOT ASSERT SPECIFIC CONTROLS

151
Q

Creating a digital signature

A

Sender of a message always encrypts the message with their own private key. Recipient verifies the digital signature by decrypting it with the sender’s public key and comparing that decrypted signature with a message digest that the recipient computes themselves

152
Q

RTO

A

Recovery time objective; amount of time expected to return an IT service or component to operation after a failure; amount of time it should take to restore an IT service after an outage

153
Q

RPO

A

Recovery Point Objective; maximum amount of data, measured in time that may be lost during a recovery effort

154
Q

SLA

A

service-level agreement; written contracts that document service expectations

155
Q

Change management

A

Business process that requires sign-off from a manager or supervisor before changes are made to ensure proper awareness and communication

156
Q

SDN

A

software-defined networking

157
Q

Release Management

A

the process that new software releases go through to be accepted

158
Q

Versioning

A

Used to differentiate versions of software, code, or other objects

159
Q

Wet pipe

A

Wet pipe suppression systems have water present in the pipes at all times, posing an unacceptable level of risk for a data center containing electronics that might be damaged if a pipe leaks

160
Q

Dry pipe and pre-action

A

Suppression systems only contain water when triggered in the event of a possible fire

161
Q

FM-200

A

a chemical suppressant commonly used in place of water in data centers

162
Q

Directive control

A

Notifications and procedures like the signs posted on the company doors reminding employees to be careful to not allow people to enter when they do

163
Q

Detective control

A

Designed to operate after the fact; Motion detectors

164
Q

Physical control

A

the doors and the locks on the doors of the company

165
Q

Preventive control

A

Designed to stop an event and could also include the locks on the doors; Mantraps intended to deny intruders access

166
Q

Deterrent control

A

Prevent an intruder from attempting an attack in the first place; Guard dogs, Lighting

167
Q

PaaS

A

Platform as a service; an example of function as a service (FaaS) computing; cloud provider is managing the infrastructure and only making the platform available to customers

168
Q

IaaS

A

Infrastructure as a service; cloud provider provides the infrastructure but the customer manages the infrastructure

169
Q

Frequency analysis

A

cryptanalytic attack against a large volume of encrypted ciphertext

170
Q

Brute-force attack

A

Cryptanalytic attack against a large volume of encrypted ciphertext

171
Q

Known plaintext attack

A

access to plaintext information

172
Q

Chosen ciphertext attack

A

attacker has the ability to encrypt information

173
Q

Workflow-based account provisioning

A

provisioning that occurs through an established workflow, such as through an HR process

174
Q

Discretionary account provisioning

A

Individual (owner) set up accounts for a new hire on systems they manage

175
Q

Self-service account provisioning

A

the provisioning system allowed the new hire to sign up for an account on their own

176
Q

Automated account provisioning

A

a central, software-driven process to provision an account, rather than HR forms

177
Q

Privilege creep

A

as individuals change roles, they may retain access to systems that they no longer administer.

178
Q

User changes roles

A

Provisioned based on the role and other access entitlements. de-provisioning and re-provisioning are time-consuming and lead to problems with changed IDs and how existing credentials work

179
Q

EAL2 evaluation assurance level

A

EAL2 assurance applies when the system has been structurally tested. It is the second-to-lowest level of assurance under the Common Criteria

180
Q

Prior to granting any user access to information

A

Verify appropriate security clearance and need to know

181
Q

Preservation phase of the e-discovery reference model

A

Ensures information related to the matter at hand is protected against unintentional alteration or deletion

182
Q

Identification phase

A

Locates relevant information but does not preserve it

183
Q

Collection phase

A

Occurs after preservation and gathers responsive information

184
Q

Processing phase

A

Performs a rough cut of the collected information for relevance

185
Q

Hash algorithms with known vulnerabilities

A

RIPEMD and MD5

186
Q

SHA-2

A

cryptographically strong hash with speed and efficient; SHA-3 is also secure but less efficient

187
Q

subject/object model

A

object of the resource request is the resource being requested by a subject. Requesting access to a document would make the document the object of the request

188
Q

De-encapsulation

A

the process of removing a header (and possibly a footer) from the data received from a previous layer in the OSI model

189
Q

Encapsulation

A

process when the header and/or footer are added

190
Q

Payload

A

part of a virus or malware package delivered to a target

191
Q

CPTED framework

A

Crime Prevention Through Environmental Design; implements three strategies: natural access control, natural surveillance, and natural territorial reinforcement

192
Q

Natural access control

A

uses barricades and other physical elements to create a separation between secure and insecure spaces

193
Q

Natural surveillance

A

designs the environment to expose potential intruders to natural scrutiny by legitimate occupants

194
Q

Natural territorial reinforcement

A

Uses fences, signs, and other elements to clearly define secure spaces

195
Q

SPML

A

Service Provisioning Markup Language; uses requesting authorities to issue SPML requests to a provisioning service point

196
Q

Provisioning service targets

A

Often user accounts and are required to be allowed unique identification of the data in its implementation

197
Q

SAML

A

used for security assertions

198
Q

SAMPL

A

an algebraic modeling language

199
Q

XACML

A

an access control markup language used to describe and process access control policies in an XML format

200
Q

Qualitative risk assessment

A

uses probability/impact matrix and subjective measures of probability and impact, such as “high” and “low” in place of quantitative measures

201
Q

MAC

A

mandatory access control systems are hierarchical, compartmentalized, or hybrid.

202
Q

Hierarchical

A

each domain is ordered and related to other domains above and below it

203
Q

Compartmentalized

A

where there is no relationship between each domain

204
Q

Asymmetric encryption algorithm application

A

Require two keys per user, regardless of the number of participants. (6-member team would require 12 keys)

205
Q

Symmetric cryptography

A

require (n*(n-1))/2 keys

206
Q

Cat 5e

A

Category 5e, cable rated to 1000Mbps

207
Q

Cat 6

A

Category 6 UTP cable rated to 1000Mbps

208
Q

Cat 5

A

Category 5; rated to 100Mbps

209
Q

Cat 7

A

Category 7; rated to 10Gbps

210
Q

CDN

A

content delivery network; distribute content to many remote endpoints where it may be quickly loaded by local users

211
Q

Smurf attack

A

a distributed attack approach to send ICMP echo replies at a targeted system from many different source addresses.

212
Q

Most effective way to block smurf attacks

A

block inbound ICMP traffic

213
Q

Static packet filtering firewalls

A

first-generation firewalls that do not track connection state; do not have the ability to track connection status between different packets

214
Q

Firewalls with connection state tracking capability

A

Stateful inspection, application proxying, and next-generation firewalls

215
Q

Dual power supplies

A

Address hardware issues (equipment failures) within a server, allowing it to continue to operate if one of the power supplies fails

216
Q

Increase the reliability of power flowing to a server

A

redundant power sources, backup generators, and uninterruptible power supplies (UPS)

217
Q

Remote access technologies with built-in encryption

A

RDP, Remote Desktop Protocol; SSH Secure Shell

218
Q

Telnet and Dial-up

A

Outdated remote access tech that does not provide encryption for secure access

219
Q

Latency

A

a delay in the delivery of packets from their source to their destination

220
Q

Jitter

A

a variation in the latency for different packets

221
Q

Packet loss

A

disappearance of packets in transit that requires retransmission

222
Q

Interference

A

electrical noise or other disruptions that corrupt the contents of packets

223
Q

Internal auditor report recipients

A

Internal reports for remediating issues: managers, individual contributors, and board members for oversight

224
Q

Interface testing

A

web applications communicate with web browsers via an interface; ensure it is accessible from all commonly used web browsers

225
Q

Regression testing

A

re-runs functional and non-functional tests to ensure that a software application works as intended after any code changes, updates, revisions, improvements, or optimizations

226
Q

White-box testing

A

full knowledge test

227
Q

Fuzzing

A

tests unexpected inputs, rather than functionality

228
Q

Role-based access control

A

Gives users an array of permissions based on their position in the organization; reviewer, editor, submitter

229
Q

Rule-based access control

A

Use rules that apply to all subject; firewalls and routers

230
Q

Discretionary access controls

A

Gives object owners rights to choose how the object they own are accessed

231
Q

Impact

A

Fire suppression system does not stop a fire but reduces the damage that fires cause (reduce risk by lowering the impact of an event)

232
Q

Patent

A

intellectual property in the form of a process; Require public disclosure and have expiration dates

233
Q

Trade Secret

A

intellectual property in the form of a process; remain in force for as long as they remain secret

234
Q

SCAP

A

Security Content Automation Protocol; a suite of specifications used to handle vulnerability and security configuration information; The National Vulnerability Database provided by NIST uses SCAP

235
Q

XACML

A

eXtensible Access Control Markup Language; an OASIS standard used for access control decisions

236
Q

BAS

A

Breach and attack simulation platforms automate aspects of penetration testing; these systems are designed to inject threat indicators onto systems and networks in an effort to trigger other security controls; white-box, gray-box, and black-box testing involve more manual effort

237
Q

Simple Security Property

A

prevents an individual from reading information at a higher security level than their clearance allows; “no read up” rule

238
Q

Simple Integrity Property

A

a user can’t write data to a higher integrity level than their own

239
Q

*-Security Property

A

Users can’t write data to a lower security level than their own

240
Q

Discretionary Security Property

A

allows the use of a matrix to determine access permissions

241
Q

WBS

A

work breakdown structure; project management tool that divides the work done for a large project into smaller components.

242
Q

Project plan

A

describes timing and resources

243
Q

Test analysis reports

A

used during later phases of the development effort to report test results

244
Q

Functional requirements

A

May be included in a work breakdown structure

245
Q

NAC

A

Network Access Control system; used to authenticate users (using identities) and validate their system’s compliance with a security standard before they are allowed to connect to the network; enforcing security policies can help reduce zero-day attacks

246
Q

Firewall vs NAC

A

firewall can’t enforce system security policies

247
Q

IDS vs NAC

A

intrusion detection system; only monitor for attacks and alarm when they happen; IDS can’t enforce system security policies

248
Q

Port security

A

MAC address-based security feature that can only restrict which systems or devices can connect to a given port

249
Q

Application running under a service account with full admin rights to the web server

A

Violation of least privilege principle; an application should never require full admin rights to run; service account should only have the privileges necessary to support the application

250
Q

Key performance and risk indicators of security program

A

Time to resolve vulnerabilities, number of account compromises, number of attempts by users to visit malicious sites, number of repeat audit findings

251
Q

True positive

A

Scan detected the vulnerability and the vulnerability actually existed

252
Q

True negative

A

Scan correctly notes the absence of a vulnerability

253
Q

False positive

A

Scan reports the presence of a vulnerability that does not actually exist

254
Q

False negative

A

Scan reports that no vulnerability exists when one does, in fact, exist

255
Q

/test directory

A

Test directories often include scripts that can be misused and have poor protections or may have other data that can be misued.

256
Q

Issue of directory indexing

A

Knowing the name and location of files can provide an attacker with quite a bit of information about an org and a list of potentially accessible files; it is not a clear sign of attack

257
Q

XST

A

Cross-site tracing; leverages the HTTP TRACE or TRACK methods and could be used to steal a user’s cookies via cross-site scripting (XSS)

258
Q

Supervisor of an org’s chief audit executive (CAE)

A

Should report to the most senior possible leader to avoid conflicts of interest; CEO or board of directors to provide a degree of independence

259
Q

DLS

A

Data loss prevention systems; identify sensitive information

260
Q

Network-based DLP

A

detects sensitive information if the user transmits it over the network; not stored on an endpoint

261
Q

IPS

A

Intrusion prevention systems; designed to detect and block attacks in progress

262
Q

Private cloud

A

cloud computing model where customer builds a cloud environment in their own data center or build an environment in another data center that is for the customer’s exclusive use (by a vendor at a co-location site); dedicated to a single organization and does not follow the shared tenancy model

263
Q

Load balancing

A

designed to prevent a web server going offline from becoming a single point of failure; helps to ensure a failed server will not take a website or service offline

264
Q

Dual-power supplies

A

prevent failure of a power supply or power source

265
Q

RAID

A

prevent a disk failure from taking a system offline

266
Q

Star topology

A

uses a central connection device

267
Q

Ethernet networks

A

may look like a star; actually a logical bus topology that is sometimes deployed in a physical star

268
Q

Input validation

A

ensures that the data provided to a program as input matches the expected parameters

269
Q

Limit check

A

a special form of input validation; ensures that the value remains within an expected range

270
Q

Options when planning for possible system failures

A

fail open; fail secure

271
Q

Black box

A

No prior knowledge of the system

272
Q

White box

A

full knowledge of the system

273
Q

Gray box

A

Partial or incomplete knowledge

274
Q

Something you know

A

PIN, password, security question/answer

275
Q

Something you have

A

token, smartcard

276
Q

Something you are

A

fingerprint, retinal scan

CISSP (29 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions