Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP ISC2 2023 > CISSP-Security and Risk Management-Domain 1 > Flashcards

CISSP-Security and Risk Management-Domain 1 Flashcards

1
Q

What does SPOF stand for?

A

Single Point Of Failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does the acronym SOX stand for?

A

Sarbanes-Oxley Act of 2002

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Due Care?

A

Due Care is the care a reasonable person would exercise under given circumstances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is CSMA/CA

A

Carrier Sense Multiple Access with Collision Avoidance

Uses acknowledgements, if no acknowledgement, sends information again.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Definition of Security Analyst

A

Works at the high level of security, helping develop policies and standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Definition of Data Owner

A

Usually a member of management who is ultimately responsible for the protection and use of a specific subset of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ISO/IEC 27799 is for?

A

Health Informatics - Information Security Management in Health

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ISO/IEC 27004 is for?

A

Guideline for information security management measurement and metrics framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What Protocol uses Port 80?

A

HTTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Describe ISO 31000 - Risk Management

A

ISO 31000 is a family of standards relating to risk management codified by the International Organization for Ssandardization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does MTD stand for?

A

Maximum Tolerable Downtime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 8 CISSP domains?

A 
Security and Risk Management
Asset Security
Security Engineering
Communications and Network Security
Identity and Access Management
Security Assessment and Testing
Security Operations
Software Development Security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the OSI layers?

A 
Physical
Data
Network
Transport
Session
Presentation
Application
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

LANs, WANs, MANs, GANs, PANs

A 
Local Area Network
Wide Area Network
Metropolitan Area Network
Global Area Network
Personal Area Network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What Protocol uses Port 110?

A

POPv3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Definition of Data Custodian

A

Responsible for maintaining and protecting the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is COBIT?

A

Set of control objectives for IT management.

Control OBectives for Information and related Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the acronym ISMS stand for?

A

Information Security Management System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Due Dilligence?

A

Due Diligence is a preemptive measure made to avoid harm to other persons or their property.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What layer is IP on?

A

Layer 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What Protocol uses Port 53?

A

DNS UDP and TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does BIA stand for?

A

Business Impact Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Definition of a Control

A

A Safeguard that is put in place to reduce a risk, also called a countermeasure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does the acronym FMEA stand for?

A

Failure Mode and Effect Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What Protocol uses Port 443?

A

HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What Protocol uses Port 143?

A

IMAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

ISO/IEC 27002 is for?

A

Code of practice for information security management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is Fullduplex

A

Sends and receives communications simultaneously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is ARP

A

Address Resolution Protocol

Used to translate layer 2 MAC addresses to layer 3 IP Addresses. Used to find the the MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Analog vs Digital definition

A

Analog communications are a continuous wave of information. Digital communications are on and off (true and fale, 1’s and 0’s)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the Delphi Technique

A

A group decision method used to ensure that each member gives an honest opinion of what he or she thinks the result of a particular threat will be.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does the acronym MODAF stand for?

A

British Ministry Of Defense Architecture Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

For door security, fail-secure defaults to?

Unlocked or Locked

A

Locked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is SOMAP?

A

SOMAP is a Swiss nonprofit organization whose goal is to run an open information security management project and maintain free and open tools and document under the GNU license

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What layer is TCP and UDP on?

A

Layer 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is RARP

A

Reverse Address Resolution Protocol

Used to translate layer 3 IP addresses to layer 2 MAC addresses. Used to find the IP Address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the difference between tangible and intangible assets?

A

Tangible assets have a physical presence.

Intangible assets do not have a physical presence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is CSMA/CD

A

Carrier Sense Multiple Access with Collision Detection

Waits until the network is idle before transmitting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Definition of Vulnerability

A

A lack of a countermeasure or weakness in a countermeasure that is in place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is the definition of Half-duplex

A

Sends and receives communication, one way at a time (not simultaneously)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Circuit Switch Network vs Packet Switch Network

A

Circuit Switch Networks holds the dedicated circuit up until the communication is over. Packet switch networks break communications down on packets, and send over many circuits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What equation do you use to get Single Loss Exposure?

A

Asset Value x Exposure Factor (EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are the three types of Network Address Translation

A

Static NAT: one to one
Pool NAT: Reserved and assigned as needed.
Port Address Translation: one to many private IP Addresses, uses port numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Single Loss Exposure (SLE) x Annualized Rate of Occurrence = ?

A

Annual Loss Expectancy?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What does RPO stand for?

A

Recovery Point Objectives

46
Q

What is RFC 1918?

A

Used for internet traffic that does not route across the Internet. Private Email Addresses.

  1. 0.0.0/8
  2. 16.0.0/12
  3. 168.0.0/16
47
Q

What does the acronym OCTAVE stand for?

A

Operationally Critical Threat, Asset, and Vulnerability Evaluation.

48
Q

Example of Protocol Data Units (PDUs) encapsulation

A 
Data, Segments, Packets, Frames, Bits
Bits are Layer One
Frames are Layer Two
Packets are Layer Three
Segments and Data are Layer Four
49
Q

What is SABSA?

A

Model and Methodology for development of information security enterprise architectures.

50
Q

ISO/IEC 27006 is for?

A

Guidance for bodies providing audit and certification of information security management systems

51
Q

What are the 3 types of controls

A

Administrative
Physical
Logical/Technical

52
Q

For door security, fail-secure means?

A

To default the locking mechanism during a failure in a way to keep information secure.

53
Q

Baseband Networks vs Broadband Networks

A

Baseband networks have one Channel (ethernet). Broadband networks have multiple channels and can send multiple signals at a time (cable TV)

54
Q

ISO/IEC 27000 Series was formally

A

British Standard 7799 (BS7799)

55
Q

What Protocol uses Port 21?

A

FTP Control

56
Q

Describe NIST Risk Management Framework

A

The NIST Risk Management Framework is a methodology for implementing risk management at the information systems tier.

57
Q

What Protocol uses Port 25?

A

SMTP

58
Q

What are the three functional types of policies?

A

Regulatory
Advisory
Informative

59
Q

What does the acronym FRAP stand for?

A

Facilitated Risk Analysis Process

60
Q

ISO/IEC 27005 is for?

A

Guideline for information security risk management

61
Q

Definition of an Enterprise Security Architecture

A

A subset of an enterprise architecture and defines the information security strategy that consists of layers of solutions, processes, and procedures and the way they are linked across an enterprise strategically, tactically, and operationally.

62
Q

What is Six Sigma?

A

Business Management strategy that can be used to carry out process improvement

63
Q

What equation do you use to get Annual Loss Expectancy?

A

Single Loss Exposure (SLE) x Annualized Rate of Occurrence

64
Q

What is CMMI?

A

Organizational development for process improvement.

Capability Maturity Model Integration.

65
Q

What does RTO stand for?

A

Recovery Time Objective

66
Q

What is COSO?

A

Set of internal corporate controls to help reduce the risk of financial fraud.
Committee of Sponsoring Organizations of the Treadway Comission

67
Q

What are COBIT’s four domain’s?

A

Plan and Organize
Acquire and Implement
Deliver and Support
Monitor and Evaluate

68
Q

What are the 4 main goals of a Risk Anlaysis

A

Identify assets and their value to the organization.
Identify vulnerabilities and threats.
Quantify the probability and business impact of those potential threats.
Provide and economic balance between the impact of the threat and the cost of the countermeasure.

69
Q

What Protocol uses Port 23?

A

Telnet

70
Q

For door security, fail-safe defaults to?

Unlocked or Locked

A

Unlocked

71
Q

The SOX Act is based upon what framework model?

A

COSO

72
Q

Definition of an Exposure

A

An instance of being exposed to losses.

73
Q

Describe the Facilitated Risk Analysis Process (FRAP).

A

A qualitative methodology to focus only on the systems that need assessing to reduce cost and time obligations of the risk assessment. It is used to analyze one system, application or business process at a time. Does not use exploitation values such as annual loss expectancy. Experience of the Risk Assessors are used to determine the criticality of risks. Very narrow scope.

74
Q

What is the difference between qualitative and quantitative assessments?

A

A qualitative assessment uses descriptive results.

A quantitative assessment uses measurable results.

75
Q

A Fault Tree Analysis identifies failures that take place within more complex environments and systems, vs the Failure Mode and Effect Analysis (FMEA).
True or False

A

TRUE

76
Q

Describe the risk analysis process of Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE).

A

People inside the organization have the power to address risks, by going through rounds of facilitated workshops. Very wide scope. Octave assess all systems, applications, and business processes.

77
Q

What does the acronym SOMAP stand for?

A

Security Officers Management and Analysis Project

78
Q

ISO/IEC 27003 is for?

A

Guideline for ISMS implementation

79
Q

Threat x Vulnerability x Asset Value = ?

A

Total Risk

80
Q

What is the definition of Simplex

A

One way communication

81
Q

What Protocol uses Port 20?

A

FTP Data

82
Q

Definition of a Risk

A

The likelihood of a treat agent exploiting a vulnerability and the corresponding business impact.

83
Q

Describe Failure Mode and Effect Analysis (FMEA)

A

A method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process.

84
Q

Describe Central Computing and Telecommunications Agency Risk Analysis and Management Method (CRAMM)

A 
Developed by United Kingdom and tools sold by Sieman.
Works in three distinct stages:
Define Objectives
Assess Risks
Identify Countermeasures
85
Q

What does the acronym CMMI stand for?

A

Capability Maturity Model Integration

86
Q

(Threat x Vulnerability x Asset Value) x control gaps = ?

A

Residual Risk

87
Q

What does the acronym CRAMM stand for?

A

Central Computing and Telecommunications Agency Risk Analysis and Management Method.

88
Q

What Protocol uses Port 67 and 68?

A

DHCP Port 67 for servers and 68 for Clients

89
Q

Describe Risk IT Framework - ISACA

A

The Risk IT Framework fills the gap between generic risk management frameworks and detailed IT risk management frameworks.

90
Q

The byproduct of likelihood and impact of an exploit is?

Likelihood x impact = ?

A

Risk

91
Q

Definition of Threat

A

Any potential danger that is associated with the exploitation of a vulnerability.

92
Q

What Protocol uses Port 69?

A

TFTP

93
Q

What does the acronym OSI stand for?

A

Open Systems Interconnection

94
Q

What does the acronym COSO stand for?

A

Committee of Sponsoring Organizations

95
Q

What Protocol uses Port 22?

A

SSH

96
Q

Describe Enterprise Risk Management - Integrated Framework – COSO

A

Enterprise Risks Management - Integrated Framework defines essential Enterprise Risk Management (ERM) components, discusses key ERM principles and concepts, suggests a common ERM language, and provides clear direction and guidance for enterprise risk management.

97
Q

The ISO/IEC 27000 Series is used for?

A

Security Program Development

98
Q

What are the two types of errors QA/QC mechanisms prevent?

A

Errors of Commission, which include those caused by data entry.
Errors of Omission, which include insufficient documentation of legitimate data.

99
Q

What are the 7 functions of controls

A 
Directive
Deterrent
Preventive
Detective
Corrective
Recovery
Compensating
100
Q

Asset Value x Exposure Factor (EF) = ?

A

Single Loss Exposure (SLE)

101
Q

What is the difference between strategic and tactical planning?

A

Strategic planning is aligning strategic business and information technology goals.
Tactical planning is providing the broad initiatives to support and achieve the goals specified in the strategic plan.

102
Q

What does the acronym CISSP stand for?

A

Certified Information Systems Security Professional

103
Q

Definition of System Owner

A

Responsible for one or more systems, each of which may hold and process data owned by different data owners.

104
Q

What does the acronym ITIL stand for?

A

Information Technology Infrastructure Library

105
Q

ISO/IEC 27001 is for?

A

ISMS Requirements

106
Q

What is ITIL?

A

Processes to allow for IT Service management.

107
Q

What are the four basic ways risk can be handled?

A

Transfer
Avoidance
Mitigate
Accept

108
Q

Total Risk - Countermeasures = ?

A

Residual Risk

109
Q

Threat Agent

A

An entity that can exploit a vulnerability

110
Q

What are the 8 interrelated components of Enterprise Risk Management?

A 
Internal Environment
Objective Setting
Event Identification
Risk Assessment
Risk Response
Control Activities
Information and Communication
Monitoring

CISSP ISC2 2023 (90 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions