Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP 3rd edition > Security and Risk Management Domain > Flashcards

Security and Risk Management Domain Flashcards

1
Q

What is a condition of (ISC)2 certification

A

Fully commit to the code of ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Protect society, the common good, necessary public trust and confidence and the infrastructure

A

First canon of ISC2 Code of Ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Act honorably, honestly, justly, responsibly and legally

A

Second canon of ISC2 Code of Ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Provide diligent and competent service to principals

A

Third canon of ISC2 Code of Ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Advance and protect the profession

A

Fourth canon of ISC2 Code of Ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who can make a complaint to ISC

A

Only an injured party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Code of Ethics: any member of public can complain

A

Canon I & II

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Code of Ethics: employer/contractor can complain

A

Canon III

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Code of Ethics: certified professional can complain

A

Canon IV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Who reviews Ethics Complaints

A

ISC2 Ethics Committee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How is complaint submitted

A

Sworn affidavit that specifies respondent, behavior, canon breached, standing of complainant and any corroborating evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who decides on discipline of members

A

ISC2 Board of Directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Perform duties in accordance with existing laws, exercising the highest moral principles

A

C3 Unified Principles - Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Perform all duties in a fair manner and without prejudice

A

C3 Unified Principles - Objectivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Perform services diligently and with professionalism

A

C3 Unified Principles - Professional Competence and Due Care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Respect and safeguard information and exercise due care to prevent improper disclosure

A

C3 Unified Principles - Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Clarifies an organization’s mission, values, and principles, linking them with standards of conduct

A

Organizational Code of Conduct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Number of mandatory canons in ISC2 Code of Ethics

A

`Four canons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Body that investigates and opines on ISC2 Code of Ethics Complaints

A

ISC2 Ethics Committee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Body that makes final decision regarding ISC2 Code of Ethics complaings

A

ISC2 Board of Directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Extreme action that can be taken against ISC2 member

A

Decertification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the fundamental information security principles

A

Confidentiality, Integrity, Availability CIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Assurance that information is not disclosed to unauthorized persons, processes, or devices

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Protection from unintentional, unauthorized, or accidental changes

A

Ìntegrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Information is known to be good and that the information can be trusted as being complete, consistent and accurate

A

Data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

A system will work as intended

A

System integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Information, systems and supporting infrastructure are operating and acccessible when needed

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The process of tracing actions to the source

A

Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The property of bein genuine and able to be verified iand trusted

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Protection against an individual falsely denying having performed a particular action

A

Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Measure of condidence that intended security controls are effective in their application

A

Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Expands traditional application of information security by recognizing that we can no longer look at protecting an organization in isolation

A

Cybersecurity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Process by which an organization protects information, people and infrastructure

A

Cybersecurity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Broad primary outcome

A

Goal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Approach taken to achieve a goal

A

Strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Measurable step(s)_ taken to achieve a strategy

A

Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

A tool used in support of an objective

A

Tactic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Align departmental strategies with business strategies to support organizational goals

A

Departmental Alignment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Mitigate risk to an acceptable level

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Optimize investments in support of business objectives

A

Value Delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Efficient and effective use of resources

A

Resource Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Achieve operational synergies and efficiencies

A

Process Integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Ensure customer and stakeholder satisfaction

A

Satisfaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Enhance organizaitonal reputation with stakeholders and the broader community

A

Reputation Enhancement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Reduce the likelihood of successful litigation by adhering to the principle of due care

A

Reduced Liability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Cybersecurity prerequisites for leadership, trust and commitment

A

Leadership, trust and commitment:
- Embraced throughout and embedded within an organization
- Cybersecurity professionals have access to C-suite and Board of Directors
- Included and recognized in organizational metrics and key performance indicators (KPIs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Management metrics used to inform decision making

A

Key Performance Indicators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

System by which organizations are directed and controlled

A

Corporate governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

State of security responsibility of leadership

A
  • Determine and articulate the organization’s desired state of security
  • Provide the strategic direction, resources, funding, and support to ensure that the desired state of security can be achieved and sustained
  • Maintain responsibility and accountability through oversight
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is in the governance ecosystem

A
  1. Board of Directors
  2. Executive Management
  3. Organizational Roles
  4. Functional Roles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Sets the tone and direction

A

Board of Directors / Trustees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Board of Directors responsibilities

A

Oversight and authorization
Fiduciary, legal and regulatory responsibilities
Standard of due care and due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Standard of care that a prudent person would have exercised under the same or similar conditions

A

Due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Investigation o a business or person before entering a contract and during the lifetime of the relationship

A

Due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

The first three duties of the board

A
  1. Promoting effective governance
  2. Determining organizational risk tolerance
  3. Contributing to and authorizing strategic plans
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Executive Management responsibilities

A
  1. Strategic alignment
  2. Risk management
  3. Value delivery
  4. Performance measurement
  5. Resource management
  6. Process assurance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Have authority to interpret the strategic direction and are held accountable for the success or failure of their area

A

Information Security Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Who should Information Security Management report to?

A

As high up ni the organization as possible to maintain visibility, limit distortion, and minimize conflict

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

ISM responsibilities

A
  1. Being a subject matter expert and cybersecurity champion
  2. Managing the cybersecurity program
  3. Communicating with executive management
  4. Coordinating the budget for cybersecurity activities
  5. Ensuring the development and upkeep of governance documents.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Responsible for developing, implementing, and administering all aspects of an organization’s privacy program

A

Privacy Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Responsible for identifying applicable statutory, regulatory and contractual requirements, as well as ensuring compliance thereof

A

Compliance Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Responsible for ensuring that appropriate physical security procedures have been established and physical security devices installed, commensurate with the identified risk exposures

A

Physical Security Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Responsible for ensuring that management has established a framework of specific internal controls commensurate with risk, regulation, and Board directives

A

Internal Audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Documenting roles and responsibilities in policies, job descriptions, employee manuals and supported by agreements

A

Codification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

The term used to describe the responsibility of leadership to determine, articulate, authorize and fund the desired state of cybersecurity

A

Security Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

The outcome when cybersecurity decision making is tied to organizational objectives

A

Strategic Alignment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

This group has fiduciary responsibility

A

Board of Directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Legal term applied to the standard of care exercised by a prudent person

A

Due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Logical structure intended to document and organize processes

A

Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

International Cybersecurity Framework

A

ISO 27000 family.
ISO 27001 Information Security Management Systems
ISO 27002 Code of Practice for Information Security Controls
ISO 27005 Information Security Risk Management
ISO 27014 Information Security, Cybersecurity and Privacy Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

US Framework for Cybersecurity

A

NIST Cybersecurity Framework (CSF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Non-profit dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment

A

Cloud Security Alliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Framework of cloud-specific security controls mapped to leading standards

A

Cloud Controls Matrix (CCM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Helps an organization identify their cybersecurity capabilities and initiatives and compare those efforts to peers or competitors of the same sector or size

A

Information Security Benchmarks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Creates consensus-based best practices for the secure configuration of a target system

A

Center for Internet Security (CIS)
https://www.cisecurity.org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

A logical structure to document and organize processes

A

Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

This US framework consists of standards, guidelines and practices to promote the protection of critical infrastructure

A

NIST Cybersecurity Framework (CSF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

This framework of cloud-specific security controls is mapped to leading standards, best practices and regulations

A

CSA Cloud Controls Matrix (CCM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Non-profit organization that publishes the “Top 10” web

A

OWASP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Acting in accordance with applicable rules, laws, policies and/or obligations

A

Compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

The power or right of a legal or political agency to exercise its authority over a person, subject matter, or territory

A

Jurisdiction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What is important for jurisdiction in relation to cybersecurity

A
  1. Location of data and systems (processing, transmission, storage)
  2. Type of data
  3. Residence of data owners
  4. Residence of data subjects
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Security and privacy of consumer financial records

A

Gramm-Leach-Bliley Act (GLBA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Security and privacy of patient medical records for covered entities and business associates (BA)

A

HIPAA & HITECH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

security and privacy of student educational records

A

Family Educational Rights and Privacy Act (FERPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

security and privacy related to the online collection and use of data for minors under 13

A

Children’s Online Privacy Protection Act (COPPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

requires federal agencies, U.S. federal agencies, to implement a program to provide security for their information and their information systems, including those provided by or managed by another agency on their behalf

A

Federal Information Security Management Act (FISMA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

first privacy regulation at the state level in the United States

A

California Consumer Privacy Act (CCPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Privacy regulation of the EU

A

General Data Protection Reglation (GDPR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Contractual obligation for any entity that accepts, processes, transmits, or stores payment cardholder data

A

Payment Card Industry Data Security Standard (PCI DSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Power or right of a legal or politial agency to exercise its authority over a person, subject matter, or territory

A

Jurisdiction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

US regulation that requires safeguarding consumer financial data

A

Gramm-Leach-Bliley Act (GLBA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Right of an individual to control the use of their personal information

A

Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

PII

A

Personally Identifiable Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

PHI

A

Personal Health Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

OECD Privacy Principles

A
  1. Collection Limitation: Collection limitation says that collection of personal data should be obtained by lawful and fair means.
  2. Data Quality: personal data should be relevant for the purposes being collected
  3. Purpose Specification: the purpose for which personal data is collected should be specified not later than at the time of data collection.
  4. Use Limitation: personal data should not be disclosed, made available or otherwise used for purposes other than specified except with the consent of the data subject or by the authority of law
  5. Security Safeguard: personal data must be protected
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Cybersecurity programs should support and compliment organizational goals

A

Strategic Alignment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Role of this position is primarily oversight and fiduciary

A

Board of Directors (or equivalent)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

The reasonable care taken before entering into and during the lifetime of a contract or agreement

A

Due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Identifies building and facility risks and mitigation

A

Physical security officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Manages the information security program

A

Information Security Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Role responsible for Managing and monitoring of protection mechanisms

A

Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Assesses the control environment

A

Internal Audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Regulation for patients

A

HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Regulation for Federal Agencies

A

FISMA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Regulation for Financial services customers

A

GLBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Regulation for EU citizens

A

GDPR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Regulation for minors

A

COPPA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

The second three duties of the board

A
  1. Allocating funds
  2. Approving policies and significant projects
  3. Ensuring appropriate monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

The last three duties of the board

A
  1. Ensuring compliance with laws, regulations and contracts
  2. Reviewing audit and examination results
  3. Honoring the legal constructs of due diligence and due care
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Resource intended to help an organization identify their cybersecurity capabilities and compare those efforst to peers or competitors of the same sector or size

A

Benchmark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Broad term given to criminal activity that involves the Internet, a computer network a computer system, or a digital device

A

Cybercrime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Incident in which legally protected or private data has been potentially viewed, stolen (exfiltrated) or used by an individual unauthorized to do so

A

Data breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Consulting legal counsel

A
  1. There is a possibility that legally or contractually protected information has been exposed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

Responsibility for damages that result from a security compromise in your business

A

Downstream Liability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Describes a wide variety of property created by musicians, authors, artists, designers, programmers, and inventors

A

Intellectual Property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

gives its owner the legal right to exclude others from making, using or selling an invention for aperiod of time in exchange for publishing a public disclosure of the invention

A

Patent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

intended to protect recognizable names, icons, shape, color, sound or any combination used to represent a brand, product, service or company

A

Trademark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

intended to allow the creator of certain types of original works to benefit from being credited and compensated for their work

A

Copyright

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

refer to proprietary business and technical information, processes, designs, or practices that are confidential and to a business

A

Trade Secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Criteria for trade secret

A
  1. Commercially valuable
  2. Be known only to a limited group of persons
  3. Be subject to reasonable steps taken by the owner of the information to keep it secret, including the use of confidentiality agreements for business partners and employees
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Copyrighted software that is available at no cost for unlimited usage. The developer retains all rights to the program and controls distribution

A

Freeware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

copyrighted software that’s available at no cost for unlimited usage and users are encouraged to share the software to promote larger distribution and maybe add-on sales

A

Shareware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

copyright holder grants users the rights to use, to study, to change, and to distribute the software to anyone for any purpose

A

Open Source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

copyrighted software that a company designs and develops to sell or license, and the company retains all rights to the program and controls distribution

A

Commrecial Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

contract between the owner and the end user that governs the use of intellectual property, in this case software licensing

A

End User License Agreement (EULA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

unauthorized copying or distribution of copyrighted software

A

software piracy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

law that makes it illegal to create products that circumvent copyright protections

A

Digital Millenium Copyright Act (DMCA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

the flow of data between countries inclusive of processing, storage and transmission

A

Transborder or cross-border data flow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

EAR

A

Export Administration Regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Legally enforceable software use agreement

A

EULA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

US law that makes it illegal to create products that circumvent copyright protections

A

DMCA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

Proprietary business and technical information that can be legally protected

A

Trade Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Formal inquiry or systematic study

A

Investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

Investigation pursued by the regulatory agency of a jurisdiction

A

Regulatory Investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

Maximum fine under GDPR

A

4% of annual revenue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

Investigation aligned with violation of contractual standards

A

Industry investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

Order that suspends the modification, deletion and/or destruction of records and media

A

Legal Hold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

any process in which electronic data is sought, located, secured and searched with the intent of using it as evidence in a civil or criminal legal case

A

eDiscovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

Individual who is knowledgeable about the facts of the case through direct participation or observations

A

Factual witness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

Person who has knowledge beyond that of an ordinary lay person enabling him/her to give testimony regarding an issue that requires expertise to understand

A

Expert witness. Experts can give an opinion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

The basis of this type of investigation is a dispute between parties

A

Civil investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

The burden of proof for this type of investigation is ‘beyond a reasonable doubt’

A

Criminal investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

Process of seeking electronic data for use in a civil or criminal legal case

A

eDiscovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

This type of trial witness can proffer an opinion

A

Expert witness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

Examples include investigations byt he US FTC or the UK Information Commisioners Office

A

Regulatory investigation

147
Q

Act of providing leadership and direction

A

Governance

148
Q

Communicates and codifies management’s requirements, and provides direction

149
Q

Who should approve policies

A

Board of Directors (or equivalent)

150
Q

Specifications for the implementation of a policy that dictate mandatory requirements

151
Q

Aggregate of standards for a specific category or grouping such as a platform, device type, ownership or location

152
Q

Document that helps people understand and conform to a standard

153
Q

This standard establishes security categories of information systems used by the federal government

154
Q

This standard lists mandatory security requirements for government systems.

155
Q

This is a US guide for applying risk management

A

NIST SP 800-37

156
Q

Instructions for how to carry out an action

A

Procedures

157
Q

What are the four commonly used formats for procedures

A
  1. Simple step: lists sequential actions
  2. Hierarchical: includes both generalized instructions for experienced users and detailed instructions for novice users
  3. Graphic: presented in pictorial or symbol form
  4. Flowchart: used to communicate a process and/or when decision making is required
158
Q

High-level governance documents

159
Q

Mandatory implementation requirements (related to policies)

160
Q

Specific instructions for carrying out a task

161
Q

This procedure format requires decision making

162
Q

A detailed roadmap for doing or achieving something

163
Q

the capability of a business to operate in adverse (disaster) conditions

A

business continuity

164
Q

disruptive events that significantly impact an organizations capability to operate

165
Q

What are the three types of disasters

A

Natural (flood, earthquake, fire, pandemic)
Environmental (loss of power, HVAC)
Human (workplace accidents, cyber attacks, civil disruption)

166
Q

Business Continuity Planning objective

A

to prepare for continued operation during disruption of normal operating conditions

167
Q

plan focusing on recovery and restoration of technology, physical plant and people

A

Disaster Recovery Plan (DRP)

168
Q

plan focusing on the overall strategy for sustaining the business during a disaster and the subsequent recovery period

A

Business Continuity Plan (BCP)

169
Q

Business Continuity Plan Workflow

A
  1. Project Initiation and Assignments
  2. Business Impact Analysis
  3. Plan Development
  4. Procedure Development
  5. Training
  6. Testing
  7. Auditing
  8. Maintenance Review and Update
170
Q

the capability of a business to operate in adverse (disaster) conditions

A

business continuity

171
Q

Business unit plan and procedures for operational activities

A

Continuity of Operations Plan (COOP)

172
Q

Group responsible for approval of BCP policies and oversight of strategies

A

Board of Directors (or equivalent)

173
Q

This type of plan describes the overall strategy for sustaining the business

A

Business Continuity Plan

174
Q

This type of plan includes procedures for internal and external communications

A

Crisis Communication Plan (CCP)

175
Q

This type of plan describes plans and procedures for recovering technology and facilities

A

Disaster Recovery Plan

176
Q

This type of plan includes procedures for minimizing loss of life and property

A

Occupancy Emergency Plan

177
Q

analysis to identify essential services, systems and infrastructure

A

Business Impact Analysis

178
Q

Maximum time a process / service can be unavailable without causing significant harm to the business

A

Maximum Tolerable Downtime (MTD)
Maximum Tolerable Outage (MTO)

179
Q

Amount of time allocated for system recovery

A

Recovery Time Objective (RTO)

180
Q

Acceptable data loss: the point in time, prior to a disruption or system outage that data can be recovered

A

Recovery Point Objective (RPO)

181
Q

Average time to repair a failed component or device

A

Mean Time to Repair

182
Q

Measure of reliability (usage stated in hours)

A

Mean Time Between Failures

183
Q

Business Impact Analysis Process

A
  1. Identify Essential Services & Dependencies
  2. Determine Maximum Tolerable Downtime
  3. Determine Recovery Point Objective
  4. Identify Infrastructure and Dependencies (including SPoF)
  5. Determine Current RTO & RPO
  6. Gap Analysis
  7. Report to Management
184
Q

In a BIA context, this describes services that “the absence or disruption of” would cause significant harm

A

Essential services

185
Q

Metric related to acceptable data loss

186
Q

A part of a system that, if it fails, will stop the entire system from working

A

Single Point of Failure (SPoF)

187
Q

the capability of a business to operate in adverse (disaster) conditions

A

business continuity

188
Q

Document written for the user community containing policies and standards that specifically pertain to them

A

Acceptable Use Policy

189
Q

What should AUP introduction do?

A

Set the tone of the policy, highlight leadership commitment, and emphasize user responsibility

190
Q

AUP Common Elements

A
  1. Data protection: Data classifications and handling standards
  2. Authentication: login requirements incluiding password standars and use of tokens and/or biometrics
  3. Application: procurement, installation, and licensing
  4. Communication: Written and verbal communication use and limitations (including personal email)
  5. Internet: Use, activity, and engagement (including social meia)
  6. Mobile Device: Use, configuration, activity and device protection
  7. Remote Access: Use, configuration, activity, and physical security
  8. Incident Reporting: Instructions on how to spot and report suspicious activity
191
Q

By signing this policy the user acknowledges that they understand, and agree to abide by the rules and standards including monitoring and limitations of privacy

A

Acceptable Use Policy

192
Q

Establishes data ownership and reason data is being provided

A

Confidentiality / Non-disclosure agreement (NDA)

193
Q

Relationships including service providers, business partners, consultants, and contractors

A

Non-employee relationships

194
Q

Document that details user-focused policies and standards

A

Acceptable Use Policy (AUP)

195
Q

The section of the AUP that documents login requirements including password standards and use of tokens and/or biometrics

A

Authentication

196
Q

Agreement that should be executed prior to being granted access to information and information systems

A

Acceptable Use Agreement

197
Q

Agreement used to establish data ownership and protect data from unauthorized use and/or disclosure

A

Confidentiality / Non-disclosure agreement (NDA)

198
Q

Stages of the employee life cycle

A
  1. Hiring Process
  2. Onboarding
  3. Employment
  4. Offboarding
199
Q

Process of integrating a new employee with a company and culture as well as getting the tools and information they need to be successful

A

Onboarding

200
Q

Assigning the minimal rights and permissions needed to accomplish a task

A

Least Privilege

201
Q

Rotating assignments (fraud deterrent and detection)

A

Job rotation

202
Q

Requiring employees to take a set amount of vacation time (fraud deterrent and detection)

A

Mandatory Vacation

203
Q

Breaking tasks into separate processes to that no one subject is in complete control

A

Separation of Duties

204
Q

Requiring more than one subject or key to complete a specific task

A

Dual Control

205
Q

Requirement to never leave confidential data (paper, monitor, whiteboard) unattended or within view of unauthorized personnel

A

Clean Desk

206
Q

Process for transitioning employees out of an organization

A

Offboarding

207
Q

Process of integrating a new employee

A

Onboarding

208
Q

Primary reasons for job rotation and mandatory vacation

A

Fraud deterrent and detection

209
Q

This process includes creating user accounts and assigning credentials

A

Provisioning

210
Q

Requiring more than one user to complete a specific task

A

Dual Control

211
Q

Termination that has been mutually agreed to

A

Friendly termination

212
Q

Case where burden of proof is beyond a reasonable doubt

A

Criminal case

213
Q

The distinguishing feature of this type of intellectual property is that it remains undisclosed

A

Trade Secret

214
Q

These are high level statements intended to communicate rules and expectations

215
Q

In which type of governance document would you most likely find the statement “password complexity must include uppercase, lower case and at least one symbol”?

216
Q

This type of procedure is generally used if decision making is required

217
Q

This plan addresses the overall strategy and plan for sustaining a business

218
Q

During the BIA process, a business unit stated that they could nto afford to lose more than 30 minutes of data. Which statement best expresses this requirement?

A

RPO (Recovery Point Objective) = 30 minutes

219
Q

This group is responsible for determining the maximum tolerable downtime (MTD)
1. Information Security department
2. Board of Directors
3. IT department
4. Business Unit

A

Business unit

220
Q

This agreement should clearly state monitoring and limitations of privacy.
1. Service Level Agreement
2. Nondisclosure Agreement
3. Remote Access Agreement
4. Acceptable Use Policy Agreement

A
  1. Acceptable Use Policy agreement
221
Q

Uncertainty of outcome, whether positive opportunity or negative threat of actions and events

222
Q

Level of risk that an organization is comfortable with

A

Risk appetite

223
Q

Risk category that relates to activities that can affect the institutions overall mission, objectives and viability

A

Strategic Risk

224
Q

Risk category that relates to the confidence and trust of stakeholders, customers, and community

A

Reputational risk

225
Q

Risk category that relates to overall capacity and capability to deliver products and services

A

Operational risk

226
Q

Risk category that relates to short- and long-term impact on capital

A

Financial risk

227
Q

Risk category that relates to conformity with policies, laws, and regulatory requirements

A

Compliance risk

228
Q

Risk category that relates tothe capacity to withstand adverse and/or unexpected conditions

A

Resilience risk

229
Q

Evaluation of the combination of the likelihood of something happening, and the impact if it does happen

A

Risk assessment

230
Q

risk assessment using descriptive terminology

A

Qualitative risk assessment

231
Q

Risk assessment assigning numeric and monetary values to all elements of the assessment

A

Quantitative risk assessment

232
Q

Taking actions to mitigate the impact of an unfavorable outcome and/or enhance the likelihood of a positive outcome

A

Risk management

233
Q

Risk Management steps

A

Risk Identification (Assessment)
Risk Treatment
Risk Monitoring
Repeat the process

234
Q

Act as if the risk doesn’t exist

A

Ignore the risk

235
Q

Acknowledge and accept the level of risk and monitor it

A

Accept the risk

236
Q

Reduce the impact or likelihood by implementing controls or safeguards

A

Mitigate the risk

237
Q

Spread the risk among multiple parties

A

Share the risk

238
Q

Assign the risk to another party via insurance or contractual agreement (subject to legal and regulatory constraints)

A

Transfer the risk

239
Q

Eliminate the cause or terminate the associated activity

A

Avoid the risk

240
Q

Insurance to mitigate financial losses from a variety of cyber incidents

A

Cyber Insurance

241
Q

Track known risks, evaluate treatment effectiveness, identify new risks, and schedule on-going assessments

A

Risk Monitoring

242
Q

Uncertainty of outcome

243
Q

Level of risk an organization is willing to accept

A

Risk Appetite

244
Q

Process used to identify and measure risk

A

Risk Assessment

245
Q

Assign risk to another party

A

Risk transfer

246
Q

Tool used to document organizational risks

A

Risk register

247
Q

A disciplined and structured approach used to oversee and manage risk for an enterprise

A

Risk Management Framework (RMF)

248
Q

Risk Management components

A

Governance
Identification
Assessment
Mitigation
Reporting and monitoring

249
Q

Who are responsible for ensuring that risk-related considerations are viewed from an organization-wide perspective

A

Executives (e.g., CEO) as an individual or as a group

250
Q

US Risk Management Framework

A

NIST Risk Management Framework

251
Q

International Risk Management Framework

A

ISO 27005 Information Security Risk Management

252
Q

NIST RMF Steps

A
  1. Categorize: categorize the systems and the information processed, stored and transmitted
  2. Select: select an initial set of baseline security controls for the system based on the security categorization.
  3. Implement: implement the security controls and document how the controls are deployed within the system and environment of operation.
  4. Assess: assess the security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome.
  5. Authorize: authorize system operation based upon a determination of residual risk.
  6. Monitor: monitor and assess selected security controls in the system on an ongoing basis.
253
Q

model designed to assess strength and weaknesses of the risk program, set goals, and plan for improvement

A

Risk Maturity Model
1. Initial
2. Fragmented
3. Top-down
4. Integrated
5. Risk Intelligent

254
Q

Structured and disciplined approach

255
Q

United State agency tasked with developing federal government RMF

A

National Institute of Standards and Technology (NIST)

256
Q

Measurement of continuous improvement

A

Maturity Model

257
Q

Risk maturity stage that reflects individual actions and capabilities

A

Initial (Ad hoc)

258
Q

Evaluation of the combination of the likelihood of something happening, and the impact if it does happen

A

Risk Assessment (Risk Analysis)

259
Q

The level of risk before controls or safeguards have been implemented

A

Inherent risk

260
Q

The level of risk after controls or safeguards have been implemented

A

Residual risk

261
Q

Risk Assessment workflow

A
  1. Determine the risk assessment approach (qualitative, quantitative, hybrid)
  2. Identify the inherent risk based on relevant threats and related vulnerabilities
  3. Assess the impact if the threat source was successful
  4. Identify applicable controls and their effectiveness
  5. Assess the likelihood of occurence, taking into consideration the control environment
  6. Determine the level of residual risk
262
Q

Risk assessment using descriptive terminology such as high, medium and low

A

Qualitative risk assessment

263
Q

Risk assessment assigning numeric values to all elements

A

Quantitative risk assessment

264
Q

Data visualization tool used to communicate qualitative risk levels and prioritization requirements

A

Risk Matrix (Heat Map)

265
Q

Worth of a resource to the organization

A

Asset Value (AV)

266
Q

Percent of asset value that would be lost

A

Exposure Factor (EF)

267
Q

Monetary impact for a single event

A

Single Loss Expectancy (SLE)

268
Q

How often in a single year wil the event occur

A

Annualized Rate of Occurrence (ARO)

269
Q

The annualized monetary impact

A

Annualized Loss Expectancy (ALE)

270
Q

Quantitative Risk Assessment workflow

A
  1. Determine Asset Value (AV)
  2. Determine Exposure Factor (EF)
  3. Calculate Single Loss Expectancy (SLE) = AV * EF
  4. Determine Annualized Rate of Occurrence (ARO)
  5. Calculate Annualized Loss Expectancy (ALE) = ARO * SLE
271
Q

Level of risk after treatment

A

Residual Risk

272
Q

Risk assessment approach that uses descriptive terminology

A

Qualitative

273
Q

AV x EF =?

A

Single Loss Expectancy (SLE)

274
Q

SLExARO=?

A

Annualized Loss Expectancy (ALE)

275
Q

Data visualization tool used to communicate risk level

A

Risk Matrix or Heat Map

276
Q

A tactic, mechanism, or strategy that accomplishes one or more of:
- Reduces or eliminates a vulnerability
- Reduces or eliminates the likelihood that a threat agent will be able to exploit a vulnerability
- Reduces or eliminates the impact of an exploit

A

Control (countermeasure)

277
Q

What a control does

A

Functionality

278
Q

How well a control works

A

Effectiveness.

279
Q

Controls applied in multiple layers

A

Defense-in-depth
Layered security

280
Q

Statement of desired result or purpose to be achieved by implementing a control or set of controls

A

Control Objective

281
Q

Controls relating to decision making, oversight, strategic alignment and compliance

A

Administrative (Management)

282
Q

Controls that can have a material structure (seen, heard, touched)

283
Q

Controls provided using technology

A

Technical (Logical)

284
Q

Control that discourages a threat agent from acting

A

Deterrent control

285
Q

Control that stops a threat agent from being successful

A

Preventative control

286
Q

Control that identifies and reports a threat agent or action

A

Detective control

287
Q

Control that minimizes the impact of a threat agent or modify or fix a situation (recovery)

A

Corrective control

288
Q

Controls that are alternate measures that organizations can use to fulfill a compliance standard, policy, or contractual requirements

A

Compensating controls

289
Q

Control category relating to oversight, decision making, strategic alignment, and compliance

A

Management control (administrative control)

290
Q

Control that minimizes the impact of a threat agent

A

Corrective control

291
Q

Control designed to accomplish the intent of recommended control as closely as possible

A

Compensating control

292
Q

Control that discourages a threat agent from acting

A

Deterrent control

293
Q

Term used to describe how well a control works

A

Effectiveness

294
Q

Potential danger

295
Q

Adversary with malicious intent

A

Threat actor

296
Q

A weakness in a system, process or person

A

Vulnerability

297
Q

Successfully taking advantage of a vulnerability

298
Q

Threat actor choosees a target for a specific objective
- Influence by perceived value of outcome

A

Targeted Attack

299
Q

Threat actor takes advantage of a vulnerable target (not previously known to them - influenced by workfactor

A

Opportunistic Attack

300
Q

Threat actor motivated by bragging rights, notoriety

A

Script kiddies

301
Q

Threat actor motivated by financial gain

A

Criminal Syndicate

302
Q

Threat actor motivated by political statement

A

Hacktivist

303
Q

Threat actor motivated by grievance, perceived morality, blackmail, external pressure

304
Q

Threat actor motivated by espionage, disruption, IP theft

A

Competitors

305
Q

Threat actor motivated by surveillance, espionage, targeting critical infrastructure, tactical advantage, data collection

A

Nation-States

306
Q

Security practitioner or hobbyist whose motivation is to identify security vulnerabilities and exploits; and responsibly disclose them to a manufacturer or client organization

A

Authorized “Ethical Hacker”

307
Q

Individuals whose motivation is to identify security vulnerabilities and exploits for personal or financial gain

A

Unauthorized hacker

308
Q

Individuals whose motivation is to identify security vulnerabilities and exploits for a reward or recognition
- Research is conducted without permission
- They may publicly disclose the vulnerabilities if the entity does not respond in line with their expectations

A

Semi-authorized hacker

309
Q

Those with the most advancded, accurate, and agile tools.

A

Established Actors

310
Q

Those with defined processes and targetted operations

A

Emerging Actors

311
Q

Generally, those associated with low-level cybercriminal activity

A

Opportunistic Actors

312
Q

Successfully taking advantage of a vulnerability

313
Q

Characteristic of this attack is a threat actor taking advantage of a vulnerable target not previously known to them

A

Opportunistic Attack

314
Q

Espionage and IP theft are their motivation

A

Competitor

315
Q

The focus of this activity is financial gain

A

Cybercrime

316
Q

A security professional who works to identify vulnerabilities with the permission of the system owner

A

Ethical Hacker

317
Q

a structured process by which potential threats can be identified, enumerated and prioritized

A

Threat modeling

318
Q

What are the three threat modeling approaches

A
  1. Asset-centric (WHAT/WHY) - identifies valued assets
  2. Architecture-centric (HOW) - identifies system design, component strength and vulnerabilities
  3. Attacker-centric (WHO) - identifies adversaries
319
Q

Are we aware of the latest threats, tools, and techniques

A

Threat Intelligence

320
Q

How hard would it be for an adversary to achieve their objective

A

Work factor

321
Q

the time, effort and resources needed for an attacker to successfully achieve their objective

A

Workfactor

322
Q

evidence-based knowledge about an emerging threat that can be used to inform control decisions

A

Threat intelligence

323
Q

trusted, sector=specific entity that facilitates sector-specific and/or geographic-specific information sharing about vulnerabilities, threats, and incidents

A

Information Sharing and Analysis Center (ISAC)

324
Q

standardized language by MITRE and OASIS for describing cyber threat information

A

Structured Threat Information Expression (STIX)

325
Q

defines how cyber threat information can be shared via services and message exchanges

326
Q

TIme, effort and talent needed to achieve an objective

A

Workfactor

327
Q

Threat model that focuses on system design

A

Architecture-centric

328
Q

Sector-specific member-driven information sharing organizations

A

Information Sharing and Analysis Center (ISAC)

329
Q

a method or pathway used by an attacker to access or penetrate the target system or environment

A

attack vector

330
Q

Disruption, manipulation, or compromise of Information Technology (IT) or operational technology (OT) systems or software

A

Digital Infrastructure attack

331
Q

Disruption, manipulation, or compromise of people

A

Human attack

332
Q

Disruption or destruction of physical structures and facilities

A

Physical Infrastructure attack

333
Q

Attacker chooses a target for a specific objective

A

Targeted attack

334
Q

Attacker takes advantage of a vulnerable target (not previously known to them)

A

Opportunistic attack

335
Q

Attacker uses an amplification factor to multiply its power

A

Amplification attack

336
Q

Attack on a previously unknown vulnerability for which a fix is not yet available

A

Zero-day attack

337
Q

Impersonating an address, system, or person

A

Spoofing:
- IP address spoofing
- MAC address spoofing

338
Q

Manipulating a trusted source of data

A

Poisoning:
- ARP cache poisoning
- DNS poisoning

339
Q

Intercepting communication between two systems

A

Hijacking:
- Man-in-the-Middle (MitM) - Spoofing and/or poisoning exploiting real-time processing of transactions, conversations or data transfer
- Man-in-the-Browser (MitB) - Manipulating the browser to control a session including what is displayed
- Session Hijacking: stealing session cookies to “take over” a user’s active session
- Domain Hijacking: unauthorized modification of domain name registration
- URL Squatting: registering or using an Internet domain name belonging to someone else
- Typo squatting: taking advantage of common typos (in domains) to create fraudulent websites

340
Q

Overwhelming system resources

A

Denial of Service:
- DoS: Transmitting malformed packets or unusual requests
- DDoS: massive volume of service requests from multiple sources, often “bots” configured in a botnet

341
Q

Exploiting weaknesses in server- or client-side code or applications

A

Code attack:
- Injection: tricking an application into including unintended commands
- Buffer Overflow: writing excess data into system memory that overruns the buffers boundary and overwrites adjacent memory locations
- Refactoring: restructuring code without changing external behavior, manipulating code with malicious intent
- Cross-site scripting (XSS) - injection of malicious code that executes in a browser
- Cross-site Request Forgery (CSRF) - Exploiting the trust relationship between a website and a browser

342
Q

Impersonating an address, system or person

343
Q

Manipulating a trusted source of data

344
Q

Intercepting communications between two or more systems

345
Q

Attack designed to overwhelm system resources

A

Denial of Services

346
Q

Tricking an application into including unintended commands

347
Q

evidence-based knowledge about emerging threats that can be used to inform control decisions

A

Threat intelligence

348
Q

Four properties of useful threat intelligence

A
  1. Aggregated from reliable sources and cross-correlated for accuracy
  2. Analyzed by trained specialists
  3. Assessed for relevancy
  4. Actionable. Often includes context, mechanisms, indicator of compromise (IOC), implications and response / remediation advice
349
Q

Artifacts that identify potentially malicious activity on a system or network

A

Indicators of Compromise (IOC) - clue about an event that has already happened

350
Q

Real-time behaviors and artifacts relating to something that is happening or has happened

A

Indicators of Attack (IOA)

351
Q

term used to refer to the data collected from publicly available soiurces to be used in an intelligence context

A

Open Source Intelligence (OSINT)

352
Q

Structured collection of OSINT tools

A

OSINT framework

353
Q

Intelligence data collected from publicly available sources

A

Open Source Intelligence (OSINT)

354
Q

Accessing this “area” requires an anonymizing browser

355
Q

Visualization of Cyber Attacks

A

Cyber Threat Map

356
Q

ecosystem of organizations, processes, people and resources involved in providing a product or service

A

Supply Chain

357
Q

the reliance on a source to provide a product or service

A

Supply chain dependency

358
Q

a disturbance of the normal flow of goods, materials and services in a supply chain

A

Supply Chain disruption

359
Q

attack that occurs when a system is infiltrated through a supply chain partner or provider with access to the systems and data

A

Supply chain attack

360
Q

the implementation of strategies to manage uncertainty, identify vulnerabilities, and ensure continuity in the supply chain

A

Supply chain risk management

361
Q

Term used to describe reliance on a source to provide a product or service

A

Supply chain dependency

362
Q

Term used to describe the disruption of the normal flow of goods, material and services

A

Supply chain disruption

363
Q

When a system is infiltrated through a supply chain partner

A

Supply chain attack

CISSP 3rd edition (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions