Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA Decks from Others > Various > Flashcards

Various Flashcards

1
Q

A hidden software-access mechanism that will bypass normal security controls to grant access into the program

A

Trapdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Work tasks and data processing that were lost by a disaster, disruption, or failure

A

Lost work in process (LWIP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A shared connection used in common by other devices

A

Bus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Level of permission granted to individual user for reading data, writing data, or executing specific programs

A

Access rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Samples collected by the auditor to prove or disprove the audit findings

A

Audit evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Older term for the building that houses the data center

A

Information processing facility (IPF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The initial loading of software to start a computer

A

Boot strapping, also known as initial program load (IPL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Matching the combined security of subject (user or program), object (data), and context of usage (need or purpose) to determine whether the request should be approved or denied

A

Attribute-based access control (ABAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A unique serial number burned into the network interface card by the manufacturer. The address operates in the Data-Link layer (layer 2) of the OSI model.

A

Media Access Control (MAC) address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Test run by software quality assurance to check the system security mechanisms by exploiting known vulnerabilities

A

Penetration testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is it called when the auditor places restrictions on the nature, use, or content of their findings? The audit may have encountered problems in scope, time, thoroughness of tests, or content of available evidence.

A

Qualified opinion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the list of objectives, tasks in sequence, skills matrix, written procedures, written test procedures, and forecast illustrating scope, time, and cost estimates?

A

Audit plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

This is the most restrictive level of access that grants users the minimum amount of access to perform their jobs.

A

Least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Technique used by programmers in computer software to disable the functionality of the program based on a specific date

A

Time bomb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the term used to describe the development of well-defined specifications while ensuring adherence to those specifications?

A

Quality. Quality starts during initial design with the gathering of specifications. Quality originates in the beginning, not by postinspection after the product (or service) is created.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A type of audit to determine whether internal controls are present and functioning effectively

A

Compliance audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an attack that has not been seen before called?

A

Zero-day attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which access control model allows the system owner to establish access privileges to the system?

A

Discretionary access control (DAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the term for a continuous threat of breach through electronic attacks?

A

Persistent electronic threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the purpose of the chain of custody, and why is it so important when you are collecting evidence?

A

The chain of custody ensures control in the preservation of evidence. It ensures that extra care is taken not to alter or taint the sample.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The protection of information held in secret for the benefit of authorized users

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

An attempt to overpower the system or attempt every possible combination until access is granted

A

Brute-force attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Information synonymous with public records or unprotected data that is accessible by anyone

A

Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is it called when you manage a series of individual projects to create an ongoing operation, also known as a functional support program?

A

Program management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is another name for a proxy server?

A

A circuit-level firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What do you call a set of commands and macros developed into a custom template inside an integrated development environment (IDE) programming tool?

A

Pseudocode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The process of determining risks affecting the actual steps necessary to produce the desired product or service, as in use by the organization

A

Business impact analysis (BIA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is two-factor authentication?

A

Using two methods for authentication. One method is something you know; the other method is something you have, such as an ATM card, electronic token, or physical characteristics (fingerprint, iris scan).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Name for specific mid-level controls over any technology shared across multiple departments. IT systems exist in almost all departments, and therefore IT-type controls must also exist in each department regardless of who is in charge.

A

Pervasive controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What type of plan addresses the continued operation of an organization after a disaster occurs?

A

Business continuity plan (BCP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Special command used on the network to request a response from a specific machine on the same subnet

A

Ping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the name of the administrative process for subdividing services to allocate for a user?

A

Provisioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

This refers to the cost savings for doing it right the first time. Proper training and planning are examples of how this conserves money and time by avoiding the additional costs of failure.

A

Price of conformance (POC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Where in the network should public web servers be located?

A

The screened subnet (DMZ)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

When a computer program sends data as input to another database program operated by someone else, with or without their permission

A

SQL injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The process of driving through a neighborhood with technical tools to detect insecure wireless access points

A

War driving

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

A type of audit used to evaluate the process method by measuring the inputs, sequence of activities, and output to determine whether the process method meets the published requirements (specifications)

A

Process audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

The boundaries and limitations of the individual audit. Normally, this indicates particular systems or functions that will be reviewed during the audit.

A

Audit scope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

This attack targets an individual server, user, database, or network device.

A

Spear-phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Software that is readily available via nonproprietary programming methods in its design. The recipient will receive the human-readable source code with the ability to make any internal changes they desire.

A

Open system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does the acronym IDS stand for?

A

Intrusion detection system (IDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Eavesdropping and other covert techniques used to collect information

A

Passive attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is cryptography?

A

The process of either hiding information from other people or authenticating valid users. It’s an area of high interest to governments, businesses, and individuals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What it’s called when an online vendor provides the use of commercial software through subscription

A

Software as a Service (SaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

A planned method of testing and tracking minor software updates prior to implementing them into production. The cost of separate testing can be justified by using the price of failure (price of nonconformance).

A

Patch management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Kerberos is an example of what?

A

Single sign-on (SSO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

A public record of a unique design or function to which the author or inventor is granted exclusive rights for a limited period of time. The entire design and complete method of building a working copy must be fully disclosed to the public.

A

Patent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is the difference between a virus and a worm?

A

Typically, worms are malicious programs that operate independently exploiting authentication holes between systems. Viruses attach to programs or files and travel when the host file is transferred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is the most important first step in understanding the auditee’s IT infrastructure?

A

A network diagram with complete documentation of the existing systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

The first person to arrive on the scene during an emergency, regardless of training or experience. Even a four-year-old child calling 911 for help will direct the emergency response activities until relieved by a more qualified person.

A

Incident commander (IC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

A process of ranking information based on its value or requirements for secrecy

A

Data classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

The selection of projects based on the principles of “highest and best use” of available resources for generating the best return on investment (ROI). This is similar to trading stock investments or baseball cards to improve the overall value of the collection.

A

Portfolio management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What type of control specifies policies and guidelines for hiring, promotion, termination, data backup, and audits?

A

Administrative control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

The process of manually verifying that records match

A

Manual reconciliation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

An individual with a significant amount of direct experience, or special training with direct experience, and the ability to deduce a correct conclusion when everyone else would form an incorrect conclusion

A

Expert

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

A hardware or software device that is watching the communications traffic flowing across the network to other systems

A

Network-based device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

A newer security protocol used in wireless networks with automatic encryption-key generation and authentication

A

Extensible Authentication Protocol (EAP) in IEEE 802.11i Robust Security Networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

The likelihood that an unfortunate event will occur and cause a loss to assets

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Information in the computer’s working memory (RAM) that will be lost when the power is shut off

A

Volatile data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

A message that is completely readable to a human

A

Clear text

61
Q

Discipline of following forthright and honest conduct without impropriety, deceit, or conflicting agenda

A

Ethics

62
Q

The timely disclosure of information relevant to the situation. In computer systems, this also refers to the time window in which data is available before being lost or overwritten during normal processing.

A

Evidence timing

63
Q

An old diagnostic protocol that allows the sender to specify the communications path to be used in spite of the network router settings configured by the network administrator. Can circumvent firewalls and should be disabled on network devices.

A

Source routing

64
Q

This term describes the application of a procedure or method, hopefully in support of an organizational objective.

A

Tactical

65
Q

The process of physically marking insecure wireless access points to the Internet

A

War chalking

66
Q

Anything of value. May be tangible or intangible in the form of money, physical goods, products, resources, recipes, or procedures.

A

Asset

67
Q

Duplicate or redundant components operating in parallel

A

Mirrored

68
Q

A test to evaluate performance against a known workload or industry-accepted standard

A

Benchmarking

69
Q

These are software programs, interfaces, and utilities that operate invisibly between users to form a workflow connecting their data.

A

Middleware

70
Q

How can you justify the costs involved for quality?

A

By comparing cost savings to the added costs of failure (price of nonconformance)

71
Q

What is the certificate revocation list (CRL)?

A

A list of revoked and expired certificates issued by the certificate authority (CA)

72
Q

This occurs in biometrics when the system is calibrated to favor either speed or increased accuracy.

A

Crossover error rate (CER)

73
Q

System or resource being available for users whenever they care to use it

A

Uptime

74
Q

The individual charged with protecting data from a loss of availability, loss of integrity, or loss of confidentiality

A

Data custodian

75
Q

A special template of biometric data converted into a count of specific characteristics that are unique to each user

A

Minutiae

76
Q

This is designed using application of encryption and/or digital certificates to enforce licensing of electronic files (music, movies, e-books, and so forth).

A

Digital rights management (DRM)

77
Q

A database designed so that knowledge of the format and structure of data is not required. Very flexible and may be quite complex.

A

Object-oriented database (OODB)

78
Q

Scanning of hand geometry and fingerprint readers are examples of what type of authentication?

A

Biometric authentication

79
Q

This principle ensures that the user will not make a false denial of participating in a transaction.

A

Nonrepudiation

80
Q

An audit conducted by a person who is not related to the auditee. This audit represents a high value of assurance that can be used for external purposes, including regulatory licensing.

A

Independent audit

81
Q

Adjusting the sensitivity of a biometric system to use a 50/50 compromise of false acceptance and false rejection

A

Equal error rate (EER)

82
Q

A unique entry into a database record that is required for the record to be valid

A

Primary key

83
Q

Name of the entire process for ensuring proper safeguards and control with the goal of providing complete integrity

A

Records management

84
Q

A formal specification of rules for interfaces and procedures used in communication

A

Protocol

85
Q

A technique used by antivirus software to replace the original end-of-file (EOF) marker with a new EOF marker generated by the antivirus program. Anything attempting to attach itself to the new EOF marker indicates a virus attack.

A

Inoculation, or immunization

86
Q

This programming technique allows one program, such as a shopping cart, to drive another website. It’s used by 98 percent of e-commerce on the Internet.

A

Cross-site scripting (XSS)

87
Q

Unique data used as a randomizer in encryption algorithms. This cryptovariable must be kept secret from all other users in order to protect the confidentiality of encrypted files.

A

Private key

88
Q

An internal processing environment for running a program inside another program session. It partitions resources to create a secure environment to protect the rest of the computer system from harm.

A

Virtual machine

89
Q

A malicious file that usually attaches itself to other programs with the purpose of spreading infection through program execution or through transportation by using email

A

Virus

90
Q

New employees are being hired into positions that require a high degree of trust. What administrative control should be performed as part of a security policy?

A

Background checks and possibly fidelity bonding

91
Q

Used in business continuity and disaster recovery planning to identify potential violations that must be avoided or that require special handling to minimize penalties

A

Legal deadline (LD)

92
Q

Low voltage for an extended period of time

A

Brownout

93
Q

A new generation of software or a design change resulting in a new version. Releases tend to occur in 12- to 24-month intervals.

A

Major software release

94
Q

The culmination of software, hardware, procedures, and data files that will permit timely recovery from a failure or disaster

A

Backup and restore capability

95
Q

Term for application software hosted by remote vendors across the Internet to subscribers, where details of security are not actually known to be verifiable fact

A

Cloud computing

96
Q

An advanced software development tool used for writing programs. It provides built-in functions for capturing the software design, commands, and macros for creating program code and debug testing.

A

Integrated development environment (IDE)

97
Q

Evidence that can be reassembled in chronological order to retrace a transaction or series of transactions

A

Audit trail

98
Q

A physical distance between two doorways that is designed to trap an unauthorized individual between the closed doors. Fully caged turnstiles can provide a similar means to capture potential intruders.

A

Mantrap

99
Q

When data is properly ranked somewhere within a protection scheme

A

Classified

100
Q

A review of the system after it is placed in operation to determine whether it fulfilled its original objectives. New objectives may be identified that require the system to be modified to attain compliance with the new requirements.

A

Postimplementation review

101
Q

The longest period of downtime that an organization can survive from a specific outage involving a system, process, or resource

A

Maximum acceptable outage (MAO)

102
Q

List four items that are vital to recovering from a disaster.

A

Offsite data backup, copy of vital records, an alternative work location (hot site, warm site, or cold site), and the disaster recovery plan

103
Q

When a hacker is running a remote-controlled network composed of computers owned by unsuspecting users

A

Bot-net (aka roBOT-NETwork)

104
Q

A small corrective update issued by the software developer to fix problems found in a major version previously released

A

Patch, also known as a minor software update

105
Q

A family classification of computer software designed to intentionally cause malicious damage

A

Malicious software, also known as malware

106
Q

An overlay setting used to parse the IP address into two distinct portions that represent the unique network address and the unique host address. Without this setting, the computer will be confused and unable to communicate on the network.

A

Netmask

107
Q

What is the special acquisition device used to create unique minutia data representing an individual user?

A

Biometric template sensor

108
Q

A mandatory set of steps used as a cookbook recipe for a desired result. Provides the day-to-day low-level execution necessary to support a standard.

A

Procedure

109
Q

What is the name for programmed rules inside the database used to evaluate data by sorting for possible correlations?

A

Heuristics

110
Q

Used to designate a prorated dollar amount or weight of effectiveness to an entire subject population

A

Variable sampling

111
Q

This compares the user’s minutia data against their reference sample stored in the encrypted database.

A

Biometric template matcher

112
Q

Automated software discovery of all the active hosts on a network

A

Host enumeration

113
Q

A project management technique used to determine the critical path and to forecast the time and resources necessary to complete a project

A

Program Evaluation Review Technique (PERT)

114
Q

Lack of awareness or absence of knowledge. The fastest way to be convicted for violating a law or other obligation.

A

Ignorance

115
Q

What is the difference between IPsec transport mode and tunnel mode?

A

Tunnel mode hides the internal network’s IP address information and payload by using encryption. Transport hides only the data portion of the IP packet by using the encapsulated security payload (ESP) with encryption.

116
Q

A combination of using in-house work and of outsourcing selected processes

A

Hybrid sourcing

117
Q

Unbiased honesty by a person dealing with other people or in the records of transactions

A

Integrity

118
Q

An individual pretends to be a person of authority and pulls rank to intimidate a user into giving up their username and password for network access. What type of attack is this representative of?

A

Social engineering

119
Q

Eliminating the opportunity for a person to reject or renounce their participation

A

Nonrepudiation

120
Q

A high-level statement by management specifying an objective with mandatory compliance for all persons of lower authority

A

Policy

121
Q

Persistent data retained on the hard disk and other storage media after system shutdown

A

Nonvolatile data

122
Q

A database of information derived from the knowledge of individuals who perform the related tasks. Used in decision support systems.

A

Knowledge base

123
Q

An administrative grouping of program objects with similar attributes or related behavior. Similar to the classification of insects by their shared attributes.

A

Object class

124
Q

A method of access control based on job role and required tasks

A

Nondiscretionary access control

125
Q

A small downloaded program using ActiveX, Java, XML, or a similar programming language

A

Applet

126
Q

A committee that consists of business executives for the purpose of conveying current business priorities and objectives to IT management. The committee provides governance for major projects and the IT budget.

A

IT steering committee

127
Q

A decision based on current conditions, which, when met, dictate starting the disaster recovery or business continuity plans. Any delay or failure to do so would indicate negligence.

A

Activation

128
Q

The inherent potential for harm in the business or industry itself, as the organization attempts to fulfill its objectives

A

Business risk

129
Q

A large-scale, traditional, multiuser, multiprocessor system designed with excellent internal controls

A

Mainframe computer

130
Q

A specification of physical characteristics, electrical signals, formats, and procedures used to communicate between systems

A

Interface

131
Q

Refers to the auditor not being related to the audit subject. The desire is for the auditor to be objective and free of conflict because they are not related to the audit subject.

A

Auditor independence

132
Q

A symmetric-key (preshared key) encryption protocol originally designed to promote wireless security. Because of poor design, the radio beacon advertises the entire encryption key to any listening device.

A

Wired Equivalent Privacy (WEP)

133
Q

Public-key cryptography is also known as what?

A

Asymmetric cryptography

134
Q

An overt attack against the system or system data files

A

Active attack

135
Q

A declaration or activity designed to instill confidence. Also known as a promise with evidence.

A

Assurance

136
Q

Which type of network firewall is usually the simplest to configure but has the worst logging capabilities?

A

A packet-filtering network firewall (generation 1)

137
Q

A device used in forensic investigations to prevent any changes to the original data on the hard disk or media during bitstream imaging

A

Write blocker

138
Q

Is it possible to implement nonrepudiation with symmetric/secret keys?

A

No. The same key is used at both ends without a way to tell who executed the transaction.

139
Q

A temporary and uniquely generated encryption key used for a short period of time

A

Temporal key

140
Q

Which access control model grants a user a predetermined level of access based on the role the user holds in the organization?

A

Role-based access control (RBAC) model

141
Q

An effective speed metric for processing a complete set of specific transactions

A

Throughput

142
Q

What is another term for a screened subnet?

A

Demilitarized zone (DMZ)

143
Q

Firewalls should always be configured to prevent the downloading of this type of program

A

ActiveX

144
Q

A malicious, self-replicating computer program that spreads itself through the system as infected computer programs are executed

A

Virus

145
Q

Special handling for information crossing a political border. Risks include legality of the information, differences in legal requirements, and extra protection necessary to prevent unauthorized disclosure.

A

Transborder data communication

146
Q

Any disruptive event, especially those that may cause harm

A

Incident

147
Q

A system development technique used to create initial versions of software functionality. Focused on proving a method or gaining early user acceptance, usually without any internal controls.

A

Prototype

148
Q

The person(s) performing the audit by gathering evidence, testing, and reporting the findings. This person should not be related to the subject of the audit, to prevent bias.

A

Auditor

149
Q

What is it called when information contained in two or more data tables is valid across the links inside the database?

A

Referential integrity

CISA Decks from Others (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions