Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP rvnsquad > Security Operations > Flashcards

Security Operations Flashcards

1
Q

¿Qué es un evento?

A

An observable change in state (en forma positiva). P. ej. cuando un sistema se prende

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

¿Qué es una alerta?

A

Flagged events that may require further investigation to determine if an incident has taken place (en forma negativa).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

¿Qué es un incidente?

A

Adverse impact to the system or network. Primary goal is to really containt the damages and correct the system. Multiple negative events make an incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Para efectos del examen, ¿cómo se debe pensar en el término Incident Reponse?

A

Always think as an attack, as malicious intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What’s considered an inappropiate usage?

A

A violation of the acceptable use of a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

¿Cuáles son los 4 pasos de la respuesta a incidentes?

A
    • Preparation
    • Detection and analysis (what was the nature of the attack)
    • Containment, erradication and recovery.
    • Post-incident review.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

¿Qué es un problema?

A

An incident with an unknown cause is referred to as a problem.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

¿Cuáles son los pasos del “problem management”?

A
    • Incident notification
    • Root cause analysis
    • Solution determination
    • Request for change
    • Implement solution
    • Monitor and report
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

¿Cuál es el objetivo del cómputo forense?

A

Collect evidences in such manner that it be admissible in court.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

¿Cuáles son algunos de los principios establecidos por la IOCE y la SWGDE?

A
  • Evidence should not be altered as a result of collection.
  • If a person is to access original digital evidence, that person must be trained for such purpose.
  • Si la cadena de custodia es rota, puede resultar en que la evidencia sea inadmisible.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Digital evidence must (5 concepts):

A
  • Authentic, garantizar su orígen, que no haya sido modificada.
  • Accurate, garantizar su exactitud.
  • Complete, needs to tell the history complete.
  • Convincing, convincente
  • Admissible
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

¿Cuáles son los pasos del proceso de investigación forense?

A

1) Identificación
2) Preservación
3) Collection
4) Examination
5) Analysis
6) Presentation
7) Decision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

¿Qué dice el principio de Lockard?

A

When a crime is committed, the attacker takes something and leaves something behind.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

¿A que se refiere el término Preservation?

A

Chain of custody must be well documented. A history of how the evidence was, collected, analyzed, transported, preserved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

¿A que se refiere el término Collection?

A
  • Minimize handling/corruption of evidence
  • Keep detailed logs of your actions
  • Capture an accurate image of the system
  • Work fast, work from volatile to persistence evidence.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

¿A que se refiere el término Examination?

A
  • Collecting data
  • Look for signatures of known attacks
  • Review audit logs
  • Hidden Data recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

¿A que se refiere el término Analysis?

A
  • Primary image (original) vs. working copy (copy)
  • Working image should be a bit by bit copy of original
  • Analizamos sobre la copia, obtenemos el HASH y debe ser igual al que se obtuvo para la copia en un principio.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

¿A que se refiere el término Presentation?

A
  • Interpreting the results of the investigation and presenting the findings in an appropiate format.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

¿A que se refiere el término Decision?

A
  • What’s the result of the investigation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

¿Cuáles son los tipos de evidencia que existen?

A
  • Direct evidence
  • Real evidence
  • Best evidence
  • Secondary evidence
  • Corroborative evidence
  • Evidencia circunstancial
  • Hearsay
  • Demonstrative
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

¿Qué es la EVIDENCIA DIRECTA?

A

Can prove a fact by itself and does not need backup information. P. ej. Testimonio de testigos.

22
Q

¿Qué es la EVIDENCIA REAL?

A

Physical evidence. Los objetos usados en el crimen.

23
Q

¿Qué es la BEST EVIDENCE?

A

Most reliable, for instance: a signature contract

24
Q

¿Qué es la SECONDARY EVIDENCE?

A

Not strong enough to stand alone, but can support other evidence. P.ej. la opinión de un experto.

25
Q

¿Qué es la CORROBORATIVE EVIDENCE?

A

Support evidence. Backs up other information presented. Can’t stand on it’s own.

26
Q

¿Qué es la EVIDENCIA CIRCUNSTANCIAL?

A

Por ejemplo, que alguien diga que va a robar un banco y al otro día circunstancialmente dicho banco es robado.

27
Q

¿Qué es la evidencia HEARSAY?

A

Second hand oral or written. P. ej. “Jhon heard that Bill heard that…”, copies of a document.

28
Q

¿Qué es la EVIDENCIA DEMOSTRATIVA?

A

Presentation based. P. ej. Photos of a crime scene, x-rays, etc.

29
Q

¿A que se refiere el término “enticement”?

A

Tempting a potential criminal.

  • Legal and ethical
  • Honey pot
30
Q

¿A que se refiere el término “entrapment”?

A

Tricking a person into commiting a crime.

- Ilegal and unethical

31
Q

What’s a hot spare?

A

Son refacciones listas e instaladas para funcionar.

32
Q

What’s a cold spare?

A

Son refacciones almacenadas en el closet, sin instalar aún.

33
Q

¿Qué significan las siglas MTBF?

A

Mean Time Before Failure.

Métrica que se toma en cuenta para las refacciones.

34
Q

¿Qué significa RAID?

A

Redundant Array of Inexpensive Disk (Devices)

35
Q

Características del RAID 0:

A
  • No redundant
  • No fault tolerance
  • Disk stripping
  • Data is strip into the two discs.
  • SPEED AND PERFORMACE
36
Q

Características del RAID 1:

A
  • Fault tolerance

- Disk mirroring (two replicas) exactly identical disks

37
Q

Características del RAID 5:

A
  • Disk stripping with parity

- Fault Tolerance + speed

38
Q

¿Qué son los servidores redundantes?

A

Primary server mirrors data to secondary server:

  • If primary fails it rolls over to secondary
  • Server fault tolerance
39
Q

¿A qué se refiere el término “clustering”?

A
  • Multiple server acting as a single logic unit.

- Group of servers that are managed as a single system.

40
Q

Ventajas de los cluster:

A
  • Higher availability
  • Greater scalability
  • Easier to manage instead of individual systems
41
Q

Características de los cluster:

A
  • Looks like a single server to the user (server farm)

- May provide redundancy, load balancing, or both.

42
Q

¿Cuáles son los tipos de backups (respaldos)?

A
  • Full backup
  • Incremental Backup
  • Differential Backup
43
Q

Características de un Full backup:

A
  • Backup everything
  • Archive bit is reset.
  • Server crash –> restore last backup
44
Q

Características de un Incremental Backup:

A
  • Backs up all files that have been modified since last backup.
  • Archive bit is reset.
  • Everything is change since last back up.
  • Server crash –> restore last full back up + all incremental backup
45
Q

Características de un Differential Backup:

A
  • Backs up all files that have been modified since last full backup.
  • Archive bit is not reset.
  • Server crash –> restore last full backup + last differential backup
46
Q

¿Cuál es el respaldo más rápido de restaurar?

A

Full Backup

47
Q

¿Cuál es el respaldo más lento en restaurar?

A

Incremental.

48
Q

¿Qué es un archive bit?

A

It’s like a flag, que indica que un archivo cambió. Bandera alzada.

49
Q

¿Qué es un “Copy Backup”?

A
  • Same as a full backup, but archive bit is not reset.

- Use before upgrades, or system maintenance.

50
Q

¿A qué se refiere el término “Disk Shadowing”?

A
  • Mirror technology
  • Updating one or more copies of data at the same time
  • Data saved to two media types for redundancy
    BACKUP BACKUP
51
Q

What’s Electroning Vaulting?

A
  • Copy of modified file is sent to a remote location where an original backup is stored.
  • Transfers bulk backup information
  • Batch process of moving data, P.ej. batch every hour
52
Q

What’s remote journaling?

A
  • Moves the journal or transaction log to a remote location, not the actual files.
    TRANSACTIONAL LOGS.

CISSP rvnsquad (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions