Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Security Operations > Flashcards

Security Operations Flashcards

1
Q

Planning

A

security should be consider prior to development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Provisioning

A

prep for deployment and instantiating user, system, or service
Security baseline and configuration management key principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Baseline configuration

A

need well-vetted hardened baseline configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Building baseline configuration

A

don’t start from scratch
Determine reasonable starting point
establish consistent configuration across the majority of the systems
Reduce time to recover a deployed system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Infrastructure as a Service (IAAS)
Platform as a Service (PAAS)
Software as a Service (SAAS)

A

Root access
Web Service
Gmail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cloud Server (Provisioning)

A

Vuln - weakness present in preconfigured image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Types of Firewall

A

Packet Filter
Stateful
Proxy
Next Generation Firewalls (NGFW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Packet filtering firewall

A

examines each packet independently
No idea where packet came from
fast, not secure.
ACL on some devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Firewall: Stateful

A

Slower

Lookup table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Proxy Firewall

A

2 TCP connection for each request, client & server

In between, inspect, process packets at all seven layers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Firewall: Circuit Level

A

Operates at session layer
does not use application level proxy software
SOCKS - replaces network connection with socks call

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Firewall: Application Level

A

Proxy server software/Layer 7

Act as in between, moves packet from one network to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Firewall: Next Generation Firewall (NGFW)

A

packet inspection beyond ports/protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Bastion Host

A

Host that is outside the firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Firewall: Host-Based

A

e.g Windows Firewall/McAfee, etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Intrusion Prevention Systems (IPS)

A

False positive on IPS cause outages
IDS - passive
IPS - active - think pen test so that why it will stop can cause outage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Malware Detonating Devices (MDD)

Sandboxin

A

Isolate and try to see what would happen

Basically isolated denotation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sandboxing Capabilities

A

Malware checks to see if it is connected to internet before it detonates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IDS

A

Sniff traffics/sniffer with rules
Passive - sent alert (Does not stop attack)
Active - stop attack (sending resets)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q 
IDS
True Positive
True Negative
False Positive
False Negative
A

True Positive - real attack
True Negative - normal traffic
False Positive - sets off alert and normal traffic
False Negative - does not set off alert and it is attack traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Signature Matching

A

Detect pattern/detects on existing patterns

Will not detect on new patterns, polymorphic malware, or encrypted traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Protocol Behavior

A

detects protocol, syn, syn-ack, ack

False positives on complex/non-standard protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Honeypot

A

designed to be hacked into/public facing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Security Information and Event Management (SIEM)

A

Devices to view logs for events that are triggered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Audit Logs

A

Process: must be reviewed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Audit Trails

A

Individual conducting Transactions
Date
Time
Location(workstation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Preparing Incidents

A

Critical decisions must be made before it happens:
pursue legal actions
what actions are authorized to be taken
Understand root cause or reimage/revert
Allowed to attack attackers to persist gain intelligence
templates needs to be built for data gathering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Security Incidents: External Attacker

A

attacking back is a bad idea

IP is a pivot point so might not be the actual attacker IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Security Incidents: External Attacker Logs

A

Attackers will erase their tracks

Look for all systems that might have been connected to all offending IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Security Incidents: Incident Handling

A 
Preparation
Detection (Identification)
Response (Containment)
Mitigation (Eradication)
Reporting
Recovery
Remediation
Lessons learned
31
Q

Security Incidents: Detection

A

Do not jump to conclusion
Notify the correct people
use help desk to track trouble tickets and problem
Need primary handler

32
Q

SMART Guidelines

A 
Specific
Measurable
Achievable
Realistic
Timely
33
Q

Security Incidents: Response

A

Incident handler should not make things worse
Secure the area
Make a forensic backup
Pull system off the network

34
Q

Security Incidents: Mitigation

A 
Fix system before putting it back online
Determine cause & symptoms
Improve defense 
Perform vuln analysis
Analogy (Car accident):
Response - EMT stability patient
Mitigation - Doctor heal patient
35
Q

Security Incidents: Reporting

A

Occurs through all phases
Need technical & Non-technical reporting
Common mistake: focus on technical report only
Reporting less formal during incident and more formal as it approaches being handled and recovered

36
Q

Security Incidents: Recovery

A

Do not restore compromised code
validate system
monitor: make sure the attacker does not come back in

37
Q

Security Incidents: Remediation

A

Occurs in phases
Short term - change pw of affected users/patching affect systems
Long term - reconfig systems to use dual factor auth
improve org patching process

38
Q

Security Incidents: Lesson Learned

A

conduct lessons-learned meeting
send recommendations to management (ask for money, resources, etc..)
Conduct follow up meeting

39
Q

Forensic Investigation

A

Thorough and detailed analysis
greater expectation that legal system could be involved
presumes a violation might have been committed

40
Q

Incident Response

A

immediate limiting of averting operation impact

41
Q

Types of evidence

A

Direct - first hand witness
Circumstantial - testimony from first hand witness of circumstances related to the legal matter
Expert - opinion/interpretation from expert

42
Q

Hearsay

A

second hard, rather than direct
Business records - 2nd hand
Disk/memory are not treated as hearsay

43
Q

Chain of custody

A

integrity & authenticity
Document time, location, & manner of collection
specify individual responsible for control of evidence
Employ tamper resistance/evidence storage
Attestation
Ensure chain of evidence control can be reviewed

44
Q

EDiscovery

A

All data gets handed over, NO EXCEPTION

45
Q

RAID 0

A

double of in size (stripe) - write on disk A, then disk B and so on and so on
No redundancy

46
Q

RAID 1

A

Mirroring

47
Q

RAID 2

A

Needs 39 disk (32 disk for data, 7 for error recovery)

48
Q

RAID 3/4

A

RAID 3- byte level
RAID 4- block level
dedicated parity drive

49
Q

RAID 5

A

Block level
Striping of data across disk
Parity information striped across disk

50
Q

RAID 6

A

Like RAID 5, block level

Double the parity

51
Q

Electronic vaulting

A

batch processing

send data to remote server

52
Q

Remoting Journaling

A

transmitting data in real time to backup storage

think of SQL trans log

53
Q

Database Shadowing

A

same as remote journaling

storing duplicate data on multiple remote storage devices

54
Q

Disk duplexing

A

disk controller is duplicated

55
Q

Backup Concept: Full Backup

A

Full backup

56
Q

Backup Concept: Incremental Backup

A

backup files that have been created/modified since last backup
Set archive bit to 0
Changes from the previous day
need a lot of tape to restore

57
Q

Backup Concept: Differential Backup

A

backup files that have been created/modified since last backup
does not set archive bit to 0
Only need last full backup and the differential tape
Backup only changes from Sunday to the previous day, not day to day comparison

58
Q

Business Continuity Plan (BCP)

A

business remain viable even in the face of disaster

NIST SP800-34 REV1

59
Q

Continuity of Operations (COOP)

A

Subset of BCP

recover critical functions rapidly

60
Q

Disaster Recovery Plan (DRP)

A

detailed steps to restore critical information and systems

BRP long term, DRP short term

61
Q

Recovery Time Objective (RTO)

A

measure of when the system will be back online

62
Q

Work Recovery Time (WRT)

A

length of time after hardware/software restored to when normal operations are able to resume

63
Q

Maximum Tolerable Downtime

A

MTD = Recovery Time Objective (RTO) x Work Recovery Time (WRT)

64
Q

Recovery Point Objective

A

amount of data that be lost for a critical function

65
Q

Site Recovery Strategies

A

Self-Service - handle disruption within current facilities
Reciprocal Agreement - agreement with another
entity to help one another during disruption
Alternate Sites: Hot, warm, cold, hybrid, mobile

66
Q

Alternate Sites

A

Hot - fully equipped and staffed
Warm - pre-equip but not ready to go
Cold - empty facility
Hybrid - combination of hot/cold/warm - Hot/Cold - Immediate failover/long-term disaster use cold site
Mobile- think of office on wheels
Multiple processing site - mirror location, different locations - think mirror

67
Q

Read-Through, checklist, consistency testing

A

reviewing plan to ensure all areas are covered

68
Q

Structural Walk through

A

step through plans looking for errors or false assumptions

69
Q

Simulation/Tabletop

A

test with mock up scenarios

70
Q

Parallel

A

recover to alternate site while main site is running

71
Q

Full Interruption

A

full fail over to alternate site

72
Q

Training (BCP)

A

how to operate alternate site
how to start emergency power
how to perform a restorative backup

73
Q

Physical security & safety

A 
Safety #1
In event of disaster
Personnel safety
Authorized access
Equipment protection
Information protection
Availability

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions