Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Test Study 5 > Flashcards

Test Study 5 Flashcards

1
Q

Detail the responsibilities of the following positions:

CEO
CIO
CSO
CISO
CPO
A

CEO - responsible for overall organization and its mission
CIO - responsible for aligning information and technology strategies
CSO - responsible for physical and technical security of assets
CISO - responsible for monitoring and analyzing risk information associated with data protection
CPO - largely responsible for ensuring that there is compliance with organization and regulatory privacy rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Who is responsible for overall organization and its mission?

A

CEO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who is responsible for aligning information and technology strategies?

A

CIO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Who is responsible for physical and technical security of assets?

A

CSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who is responsible for monitoring and analyzing risk information associated with data protection?

A

CISO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who is responsible for ensuring that there is compliance with organization and regulatory privacy rules?

A

CPO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the GISRA?

A

Government Information Security Reform Act

Requires federal agencies to perform risk assessments, enact policies, and combines several other previous laws.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What act is related to risk assessment and combines several previous laws?

A

GISRA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is FISMA?

A

Federal Information Security Modernization Act

Handles risk management by the federal government.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which act deals with risk management in the federal government?

A

FISMA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What type of control are backups?

A

Recovery

RAID is fault tolerance, not recovery, which is compensating.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What stage of the risk management framework do you ensure that controls are implemented properly?

A

Assess

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What stage of the risk management framework do you declare the acceptance of risks?

A

Authorize

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What stage of the risk management framework do you perform ongoing assessment of control effectiveness?

A

Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is FIPS-198 and what does it provide?

A

A US Government standard for keyed-HMAC and authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a US governement protocol standard for authentication?

A

FIPS-198

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

At what ring are the drivers present in a computing system?

A

Ring 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the wifi speeds and ranges?

A
  1. 4 - 46m
  2. 0 - 23m
  3. 11a = 54
  4. 11b = 11
  5. 11g = 54
  6. 11n = 600
  7. 11ac = 3466
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What protocol and port can be used to load remote operating system?

A

TFTP, 69

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What can TFTP be used for?

A

Loading a remote operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are some authentication methods that can be used over non-ethernet networks?

A

PAP, CHAP, MSCHAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which authentication method should be used over non-ethernet networks?

A

CHAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is PAP?

A

Password Authentication Protocol

Operates in clear text, should not be used, was often used in dial up.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is CHAP?

A

Challenge handshake authentication protocol

Uses an encrypted challenge and a three way handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is MS-CHAP?

A

Microsoft CHAP

Has vulnerabilities because it uses DES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What non-ethernet authentication method operates in clear text?

A

PAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What non-ethernet authentication method uses DES?

28
Q

What non-ethernet authentication method uses an encrypted handshake?

29
Q

What is a synchronous token?

A

Tokens must have a link or synchronized time with the authentication server, classic digital authenticator

30
Q

What is an asynchronous token?

A

Tokens that do not have to maintain a timing or link to the authentication server. Often the authentication server issues a challenge that is answered via the user’s asynchronous token.

31
Q

Which token type is time linked to the server?

A

Synchronous

32
Q

Which token type has no timing link to the server?

A

Asynchronous

33
Q

What are all of the endpoints that may authenticate in kerberos?

34
Q

What is the name of any endpoint in kerberos?

35
Q

What is zzuf?

A

An application input fuzzer.

36
Q

What is nikto?

A

A general purpose web application scanner.

37
Q

What is 800-53 for?

A

Catalog of Security Controls

38
Q

What is 800-53A for?

A

Assessing security and privacy controls?

39
Q

What is the difference between 800-53 and 53A?

A

53 is a catalog of security controls

53A is assessing security and privacy controls

40
Q

What is the NIST sp for the catalog of security controls.

41
Q

What is the NIST sp for assessing security and privacy controls?

42
Q

What is Fagan and what it is it composed of?

A 
Fagan is an inspection process to try to find defects in documents, such as code.
Planning
Overview
Preparation
Inspection Meeting
Rework
Follow Up
43
Q

What happens in the planning phase of Fagan?

A

Preparation of matrials
Arranging of participants
Arranging of a meeting place

44
Q

In what phase of Fagan do you prepare materials and arrange participants?

45
Q

What happens in the overview phase of Fagan?

A

Group education of participants on what is being reviewed

Assignment of roles

46
Q

In what phase of Fagan do you educate participants about what is being reviewed?

47
Q

What happens in the preparation stage of Fagan?

A

Participants review the items to be inspected an prepare to meet about them.
Participants prepare their roles.

48
Q

In what phase of Fagan do the participants inspect the supporting material?

A

Preparation

49
Q

What happens in the inspection meeting stage of Fagan?

A

Actual finding of defects

50
Q

In what phase of Fagan are defects found?

A

Inspection meeting

51
Q

What happens in the rework stage of Fagan?

A

Defects found are corrected

52
Q

In what stage of Fagan are defects corrected?

53
Q

What happens in the follow-up stage of Fagan?

A

All defects found should have been corrected and the moderator is responsible for verifying this.

54
Q

In what stage should the moderator verify that defects have been corrected?

55
Q

What duration of time is a UPS used for?

A

Minutes to hours

56
Q

What duration of time is a generator used for?

A

Hours to days

57
Q

What power backup should be used from minutes to hours?

58
Q

What power backup should be used from hours to days?

59
Q

What is a darknet?

A

An area of the network that should contain no traffic and can be watched for malicious activity.

60
Q

What is an area of the network that should be watched for malicious activity and shouldn’t contain normal traffic?

61
Q

What is MBSA?

A

Microsoft Baseline Security Analyzer

A tool for inspecting systems for dangerous settings and missing patches.

62
Q

What is a product that can analyze Windows computers for dangerous settings and missing patches?

63
Q

What is TCP hijacking?

A

Stealing session keys

64
Q

What attack is focused on stealing session keys?

A

TCP Hijacking

65
Q

What is RAD?

A

Rapid application development
Parallel development of mini projects
Makes heavy use of prototyping
Is adaptive.

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions