Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Study > Security Operations > Flashcards

Security Operations Flashcards

1
Q

The security admin should not report to the network admin. Why?

A

Conflict of interest

Network admins are more incentivized toward availability and performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Concentrates on the products’ architecture, embedded features, and functionality that enable a customer to continually obtain the necessary level of protection when using the product.

A. Production assurance
B. Implementation assurance
C. Life-cycle assurance
D. Operational assurance

A

D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Takes place after the system shuts itself down in a controlled manner in response to a kernel failure.

A. system cold start
B. emergency system restart
C. system reload
D. system reboot

A

system reboot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Takes place after a system failure happens in an uncontrolled manner.

A. system cold start
B. emergency system restart
C. system reload
D. system reboot

A

emergency system restart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Takes place when an unexpected kernel or media failure happens and the regular recovery procedure cannot recover the system to a more consistent state. Intervention by the user or administrator may be required.

A. system cold start
B. emergency system restart
C. system reload
D. system reboot

A

system cold start

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Transactions should be __________, meaning that they cannot be interrupted between the input being provided and the generation of the output.

A

atomic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Anti-virus and IDS signatures should be updated on a __________ basis.

A. Daily
B. Hourly
C. As-needed
D. Continual

A

D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which of the following is not a key aspect of operational security?

A. Resource Protection
B. Change Control
C. Incident Management
D. Hardware and software controls
E. Trusted System Recovery
D. Separation of duties
E. Least Privilege
A

C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Intrusion detection devices include all but the following?

A. Vibration Sensors
B. Electromechanical devices
C. CCTVs
D. Lighting
E. Motion Detectors
A

D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following is not a drawback to Intrusion detection systems?

A. Expensive to install and maintain
B. Require human response
C. Subject to false alarm
D. Fails to detect physical intrusions

A

D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

This type of secondary site does not have computers, but it does have some peripheral devices, such as disk drives, controllers, and tape drives.

A

Warm Site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The maximum time period within which a business process must be restored to a designated service level after a disaster to avoid unacceptable consequences.

A. MTD
B. RPO
C. RTO
D MTTR

A

RTO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The estimated amount of time it will take to get a device fixed and back into production after its failure.

A. MTD
B. RPO
C. RTO
D MTTR

A

MTTR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The acceptable amount of data loss measured in time.

A. MTD
B. RPO
C. RTO
D MTTR

A

RPO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When returning to the original site after a disaster, which organizational units should go back in first.

A. Most critical
B. Least Critical
C. Moderately critical

A

B

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A method of risk transference, _______________ covers the lost of income that an organization suffers after a disaster while it is in its recovery stage.

A

Business Interruption Insurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following might make evidence inadmissible in court? (Choose all that apply)

A. Proof of chain-of-custody
B. A document created specifically for the court case.
C. Documentation that the evidence was stored in a safe location.
D. Documentation that examination was performed on a copy of the evidence media. The copy is verifiable by a matching hash value.
E. The evidence is relevant, complete, sufficient, and reliable to the case at hand.
F. Evidence was not collected by an expert.
G. Evidence was taken without an employees permission or warrant from their personal cell phone.

A

B, G

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Backs up the files that have been modified since the last full backup.

A

Differential backup

19
Q

When data needs to be restored for from this backup type, the full backup is laid down, and then each other backup is laid down on top of it in the proper order.

A

Incremental backup

20
Q

When data needs to be restored for from this backup type, the full backup is laid down, and then the most recent backup is laid down on top of it.

A

Differential backup

21
Q

This is a secondary site that can be ready for operation within a few hours and is owned by the company.

A. Warm Site
B. Redundant Site
C. Reciprocal Site
D. Hot site

A

Redundant site

Hot sites are a subscription service.

22
Q

What are the 7 steps in the Cyber Kill Chain?

A 
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command and Control (C&C)
Actions on the Objective
23
Q

Which of the following is not a type of centralized patch management?

A. Agent Based
B. Agentless
C. Active
D. Passive

A

C

Agent Based - update agent is installed on each device and communicates with one or more update servers.

Agentless - a spin on this is to use Active Directory objects in a domain controller to manage patch levels.

Passive involves monitoring network traffic to infer patching levels. Least effective

24
Q

A fault-tolerant server technology that where each server takes part in processing services that are requested.

A

Clustering

25
Q

When data is written across all drives in a RAID, the technique is called __________.

A. Parity
B. Hot-swapping
C. Striping
D. Redundant Copying

A

C

26
Q

The most commonly used RAID mode today is RAID 5. Spreading control data across each disk in a RAID is called __________.

A. Parity
B. Hot-swapping
C. Striping
D. Redundant Control

A

A

27
Q

What does MAID stand for?

A

Massive Array of Inactive Disks

28
Q

A load-balanced parallel means of massive computation implemented with loosely coupled systems that may join and leave randomly.

A

Grid Computing

29
Q

Short focal length lenses provide _______ views, while long focal length lenses provide _________ views.

A

Wide-angle

Narrower

30
Q

In order to achieve a greater depth of focus so that there is not such a distinction between objects in the foreground and background, choose

A. Wide angle lense
B. Long focal length lense
C. Large lens opening
D. Small lens opening

A

D

31
Q

What part of the camera controls the amount of light that enters the lens?

A. Lens opening
B. Focal Length
C. Iris
D. Lux value

A

C

32
Q

What height of fence is used to deter casual trespassers?

A

3 to 4 feet high

33
Q

What height of fence is used to deter determined trespassers?

A

8 feet high

34
Q

Critical areas need to have at least _______ feet of illumination with the illumination of two foot-candles.

A. 6
B. 7
C. 8
D. 9

A

C

35
Q

A cipher lock that also logs a user’s unique code used to gain access is call what?

A

Smart Lock

36
Q

This is the small round locks you usually see on file cabinets.

A

Wafer tumbler

37
Q

A tumble lock fits within a cylinder and is susceptible to which of the following circumvention techniques? (Choose all that apply)

A. tension wrench
B. raking
C. bumping
D. slipping 
E. drilling
A

A, B, C, E

38
Q

System sensing access control readers are sometimes called this. They’re like the readers used at KIO Networks, but don’t require you to swipe anything. The reader sends out interrogating signals and obtains the access codes from the card.

A

Transponder

39
Q

This is a generic term used to describe proximity authentication devices, such as proximity readers, programmable locks, or biometric systems.

A

Electronic Access Control Tokens

EAC

40
Q

What does MOM stand for?

A

Motive, Opportunity, Means

41
Q

An act or omission that naturally and directly produces a consequence. It is the superficial or obvious cause for an occurrence. It can be seen as an element of negligence in a court of law.

A

Proximate cause

42
Q

It is common for organizations to develop GRC programs, which allow for the integration and alignment of the activities that take place in each silo of a security program. What does GRC stand for?

A

Governance, Risk, Compliance

43
Q

This term is commonly used by the U.S. govenment to denote BCP.

A

COOP

CISSP Study (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions