Section 2 - ISC2 Flashcards by Paul Wartenberg

Confidentiality, Integrity and Availability are referred to as

the CIA Triad

How well did you know this?

Not at all

Perfectly

PII Stands for
PHI Stands for

Personal Identifiable Information
Protected Health Information

How well did you know this?

Not at all

Perfectly

What is the measure of the importance assigned to information by its owner

Sensitivity

How well did you know this?

Not at all

Perfectly

What term is Availability typically associated with

Criticality

How well did you know this?

Not at all

Perfectly

What is the process called of verifying or providing the users identification is know as

Authentication

How well did you know this?

Not at all

Perfectly

Name 3 Common methods of Authentication

Something you know - passwords or phrases (Knowledge Base)
Something you have - Token, cards (Token-Base)
Something you are - Biometrics (Characteristics Base)

How well did you know this?

Not at all

Perfectly

True or False - Best practice is to use all 3 of the common methods of communication

False - 2 at least two is recommended

How well did you know this?

Not at all

Perfectly

Name the legal term as defined as the protection against an individual falsely denying having performed a particular action

Non-repudiation

How well did you know this?

Not at all

Perfectly

Name 3 Risk Management Terminology and their definitions

Asset - something that needs protection
Vulnerability - is a gap or weakness
Threat - something or someone that aims to exploit a vulnerability

How well did you know this?

Not at all

Perfectly

Name Threat Actors

Insiders
Outside Individuals
Formal Entities
Nation States
Technology such as bots

How well did you know this?

Not at all

Perfectly

Threat Vector is

the approach and technique

How well did you know this?

Not at all

Perfectly

The magnitude of the harm that can be expected and can result in a chain reaction is called

Impact

How well did you know this?

Not at all

Perfectly

Name the 4 Risk Treatments

Avoidance - exit the service due to high risks
Acceptance - risk averse or low likelihood
Mitigation - Most common taking steps to minimize
Transfer - insurance for eg

How well did you know this?

Not at all

Perfectly

Name the 3 Security Controls

Physical Controls
Administrator Controls
Technical Controls (logical controls)

How well did you know this?

Not at all

Perfectly

What is the detailed steps to complete a task that supports departmental or organizational policies

Procedure

How well did you know this?

Not at all

Perfectly

Used by governance teams to provide a framework to introduce policies and procedures in support of regulations

Standard

How well did you know this?

Not at all

Perfectly

Put in place by organizational governance such as executive management to provide guidance

Policies

How well did you know this?

Not at all

Perfectly

in form of laws typically from government and can carry financial penalties

Regulations

How well did you know this?

Not at all

Perfectly

Name the Code of Ethics Cannons

Protect Society, the common good, necessary public trust and confidence in the infrastructure

Act honorably, honestly, justly, responsibility and legally

Provide diligent and competent services to principles

Advance and protect the profession

How well did you know this?

Not at all

Perfectly

The process and act of converting the message from plaintext to ciphertext sometimes referred to as enciphering

Encyrption

How well did you know this?

Not at all

Perfectly

The process of how an organization is managed, usually includes all aspects of how decisions are made for that organization, such as policies, roles and procedures

Governance

How well did you know this?

Not at all

Perfectly

Define Likelihood of Occurrence

based on a weighted factor on subjective analysis of the probability that a given threat is capable of exploiting a given vulnerability

How well did you know this?

Not at all

Perfectly

What Department is NIST part of?

US Dept. of Commerce

How well did you know this?

Not at all

Perfectly

Qualitative Risk vs Quantitative Risk Analysis

Qualitative - assignment based on low, medium and high
Quantitative - numerical values are assigned to both impact and likelihood based on stats and monetized

How well did you know this?

Not at all

Perfectly

Is BCP an Incident Response Plan

Yes

Name the Components of an Incident Response Plan

Preparation - policy, identify critical data, train staff on response, ERT, Roles and responsibilities, Communication between stakeholders Detection and Analysis - monitor attack vectors, Analyze incidents, prioritize, standard incident docs Containment , Eradication and Recovery Post Incident Activity - identify evidence, document lessons learned

T or F Business Continuity is to bring all systems fully operational

Fales - just critical systems

What is the nickname of the book of procedures for BCP

RedBook

True or False DR starts where BC leaves off

True

What part of the CIA Triad is Incident Response, Business Continuity and Disaster Recovery

Availablity

What is the mitigations of violations of security policies and recommended practices

Incident Handling/Incident Response

Is a Firewall considered a Security Control

Yes

for Access Controls Subjects constitute the following

User, a process, a procedure, client or server, program, workstations,

What is the term for anything that the subject is trying to access referred to

Objects Note: Objects are passive and do not contain their own access control logic and need to be protected

What is the term for an instruction developed to allow or deny access to an object by comparing the validated identity of the subject to an access control list

Rule

What are the implementations of access control and are part of a _________ strategy

Layered Defense also know as defense in depth

It is acceptable to do profile user copies to save time T or F

False

An entrance to a building where two doors with only one open at a time

Mantrap

What is CPTED

Crime Prevention Through Environmental Design

What are the common two types of Biometics

Physiological - Fingerprint, Iris (colored portion around the outside of the pupil), retinal (blood vessels in the back of the eye) Behavioral - how a person acts by measuring voiceprints, signature dynamics and keystroke dynamics.

What is DAC

Discretionary Access Control Most common access control giving the user rights to pass the information, grant privilege's, change security attributes They are controlled by each individual object owner and not scalable

Which Access Control is uniformly enforced across all data subject and provide detail

Mandatory Access Control Only properly designated security administrators as trusted subjects can modify any of the security rules

What is RBAC

Role Based Access Controls Assigned by roles to each of the applicable systems

True or False that encapsulation occurs when data moves down the OSI Model

True This is coming from the previous layers header address

As data moves up the OSI model what is that process called

de-encapsulation header and footer are discarded

What Layer in the TCP/IP Stack is ICMP and what is its function

Internet Layer Used to determine the health of the network or specific link. Used by Ping, traceroute and other network management tools

What is FTP's insecure Port and SFTP Secure Port

21 - FTP 22 - SFTP

What is Telnets Port and it Secure Counterpart

Telnet - 23 SSH - 22

What is SMTP port and its secure counterpart

SMTP - 25 SMTP with TLS - 587

What is time's port and replaced by what

Time - 37 Network Time Protocol (NTP) - 123

What is DNS port and replaced by what

DNS - 53 DNS over TLS - 853

True or False - communication between endpoint and server requires a 3 way handshake

True

What is the type of threat that places themselves between two devices such as a web browser and web server

On-Path Attack

What is a passive, noninvasive attack to observe the operation of a device

Side-channel power monitoring, timing and fault analysis attacks

Which attack refers to threats that demonstrate an unusually high level of technical and operational sophistication spanning months or even years.

Advanced Persistent Threat (APT) performed by organized groups such as Nation states

True of False a Host-Based Intrusion System will monitor multiple servers and networks

False - it monitors activity on a single computer and is more detailed than a Network IDS. They are more costly to manage since they require administration on each of the systems they reside on

True or False Network Intrusion Systems can monitor encrypted traffic

False - it can monitor other package details. a NIDS can monitor a large network by using remote sensors to collect data at key network locations and send to centralized console

What refers to the process of designing, using our operating different process in ways that isolate high-risk activities from lower risk ones.

Firewalling

Traditionally what OSI layer do firewalls operate at

Layer 4 - session

What are Joint Operating Agreements and name them

Memo of Understanding and Memo of Agreement between organizations sometimes competitors that can work together in a disaster

Micro segmentation of networks with firewalls at every connecting point is referred to as ________

Zero Trust

True or False Network Access Control (NAC) can create policies along with enforcing them

False - they only enforce the polices that are in place.

What type of devices would NAC enforce

Medical Devices IoT Devices BYOD such as phones and tablets Guest users and contractor example would be Hotel based Internet access. Logging in and validating room number and name

True of False a DMZ is an example of Network Segmentation

True

What is a Web-Application Firewall used for and can replace

It is used to control both internal and external traffic including encrypted like a traditional firewall. It can replace a DMZ

Key reason to segment Embedded Systems and IoT

These systems often control mechanisms such as AC, power, medical devices special care should be taken to isolate them from other devices on the network

VLAN is a form of Micro segmentation - T or F

True VPN and Security Groups are other examples

What is the term when a malicious user can see traffic on other VLAN's

VLAN Hopping

True of False - All VPN are encrypted

False

Name the 6 Major Sets of the Data Life Cycle

Create Store Use Share Archive Destroy/Delete

True of False - OSHA Requires if there is a claim that employee data is kept for 30 years

True

Degausing is ____________

using magnets to erase data on hard drives

What is the definition of Classification in Data Handling

Identifies the degree of harm that that asset if exposed would cause to the organization. Focused on maintaining confidentiality of the data based on sensitivity

What type of data classification control of assigning a level of sensitivity

Labeling

True of False it is acceptable to apply the longest retention period to all types of information in an orginization

False

What is the term for any data that is left on media after deleting? What can be done to remediate

Remanence Clearing the device using Random values also called overwriting or zeroing Purging the device such as degaussing Physical Destruction

True of False Ingress Monitors the outbound traffic

False - Egress is the monitoring of outbound traffic

What is part of Egress Monitoring

Data Loss/Leak Prevention (DLP)

What are the two functions that provide Integrity with Encryption

Hash Functions - a finger print of the file Digital Signatures - electronic signature providing non-repudiation

True of False - all plaintexts are fully readable by humans

False -

_______ Encryption is where both sender and receiver have the same Key.

Symmetric Encryption Note- not very scalable if every person needs a key to communicate with each other

Which type of Encryption requires out of band key distribution

Symmetric

Same Key Single Key Shared Key Secret Key and Session Key are all names for what Encryption

Symmetric

________ Encryptions uses one key to encrypt and a different key to decrypt

Asymmetric Encryption

List some key benefits of Asymmetric Encryption

More scalable with no overhead of key exchange Non-Repudiation of origin and delivery, access control and data integrity More Secure

Which Encryption has the best performance. Asymmetric or Symmetric

Symmetric. The amount of processing espeically with large amounts of data is not practical for Asymmetric

Who performs the study the mathematical techniques to attempting to defeat cryptography

CryptAnalysts

What is the process where it takes an input set of data and returns a fixed length result called ______

Hash Value - most common method of ensuring message integrity today

What is the term of comparing the digest code to the original called

Checksum

Using a rogue interactive voice response (IVR) to recreate legitimate sounding bank or other institutions is called

Phone Phishing or Vishing

The human equivalent of phishing where someone impersonates an authority or trusted figure

Pretexting

Quid pro quo in Social Engineering is

request for information in exchange for something