Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 > Flashcards

Domain 1 Flashcards

1
Q

Acceptable risk

A

A suitable level of risk commensurate with the potential benefits of the organization’s operations as determined by senior management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Audit/auditing

A

The tools, processes, and activities used to perform compliance reviews.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Availability

A

Ensuring timely and reliable access to and use of information by authorized users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Business continuity (BC)

A

Actions, processes, and tools for ensuring an organization can continue critical operations during a contingency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Business continuity and disaster recovery (BCDR)

A

A term used to jointly describe business continuity and disaster recovery efforts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Business impact analysis (BIA)

A

A list of the organization’s assets, annotated to reflect the criticality of each asset to the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Compliance

A

Adherence to a mandate; both the actions demonstrating adherence and the tools, processes, and documentation that are used in adherence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Confidentiality

A

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Data custodian

A

The person/role within the organization who usually manages the data on a day-to-day basis on behalf of the data owner/controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Data owner/ controller

A

An entity that collects or creates PII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Data subject

A

The individual human related to a set of personal data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Disaster recovery (DR)

A

Those tasks and activities required to bring an organization back from contingency operations and reinstate regular operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Due care

A

A legal concept pertaining to the duty owed by a provider to a customer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Due diligence

A

Actions taken by a vendor to demonstrate/ provide due care.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Governance

A

The process of how an organization is managed; usually includes all aspects of how decisions are made for that organization, such as policies, roles, and procedures the organization uses to make those decisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Governance committee

A

A formal body of personnel who determine how decisions will be made within the organization and the entity that can approve changes and exceptions to current relevant governance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Guidelines

A

Suggested practices and expectations of activity to best accomplish tasks and attain goals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Integrity

A

Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Intellectual property

A

Intangible assets (notably includes software and data).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Maximum allowable downtime (MAD)

A

The measure of how long an organization can survive an interruption of critical functions. [also known as maximum tolerable downtime (MTD)]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Personally identifiable information (PII)

A

Any data about a human being that could be used to identify that person.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Policy

A

Documents published and promulgated by senior management dictating and describing the organization’s strategic goals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Privacy

A

The right of a human individual to control the distribution of information about him- or herself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Procedures

A

Explicit, repeatable activities to accomplish a specific task. Procedures can address one-time or infrequent actions or common, regular occurrences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Recovery point objective (RPO)

A

A measure of how much data the organization can lose before the organization is no longer viable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Recovery time objective (RTO)

A

The target time set for recovering from any interruption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Residual risk

A

The risk remaining after security controls have been put in place as a means of risk mitigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Risk

A

The possibility of damage or harm and the likelihood that damage or harm will be realized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Risk acceptance

A

Determining that the potential benefits of a business function outweigh the possible risk impact/likelihood and performing that business function with no other action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Risk avoidance

A

Determining that the impact and/or likelihood of a specific risk is too great to be offset by the potential benefits and not performing a certain business function because of that determination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Risk mitigation

A

Putting security controls in place to attenuate the possible impact and/or likelihood of a specific risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Risk transference

A

Paying an external party to accept the financial impact of a given risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Security control framework

A

A notional construct outlining the organization’s approach to security, including a list of specific security processes, procedures, and solutions used by the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Security governance

A

The entirety of the policies, roles, and processes the organization uses to make security decisions in an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Standards

A

Specific mandates explicitly stating expectations of performance or conformance.

36
Q

Internet Protocol (IPv4)

A

The dominant protocol that operates at layer 3 of the OSI) 7-Layer Model. IP is responsible for addressing packets so that they can be transmitted from the source to the destination hosts.

37
Q

Internet Protocol (IPv6)

A

A modernization of IPv4 that includes a much larger address field: IPv6 addresses are 128 bits that support 2128 hosts.

38
Q

Internetworking

A

Two different sets of servers and communications elements using network protocol stacks to communicate with each other and coordinate their activities with each other.

39
Q

Intrusion Detection System (IDS)

A

A security service that monitors and analyzes network or system events for the purpose of finding and providing real-time or near real-time warning of attempts to access system resources in an unauthorized manner.

40
Q

Intrusion Prevention Systems (IPS)

A

Uses available information to determine if an attack is underway and sends alerts but also blocks the attack from reaching its intended target.

41
Q

Kill Chain, Cyber Kill Chain

A

A generalized attack model consisting of actions on the objective and six broad, overlapping sets of operational activities: reconnaissance, weaponization, delivery, exploitation, installation, command and control. APT actors often combine these operations in complex ways to achieve their goals; such attacks may span over many months. For defenders, the kill chain model highlights the temporary gain in security that can result by improved systems and organizational hardening across any or all of these areas.

42
Q

Lightweight Directory Access Protocol (LDAP)

A

Authentication is specified as simple (basic), simple using SSL/TLS, or Simple Authentication and Security Layer (SASL).

43
Q

Logical Link Control (LLC)

A

One of two sublayers that together make up the data link layer in the OSI.

44
Q

Man-in-the- Middle (MITM)

A

A form of active attack in which the attacker inserts themselves into the physical or logical communications flow between two parties and masquerades to each as the other, falsifying or altering the data exchanged as the attacker chooses to. Also known as MITM. Man (machine)-in-the-browser (MITB) attacks focus on layer 7 vulnerabilities to masquerade as client to the server and as server to the client.

45
Q

Media Access Control (MAC)

A

The 48-bit hex number assigned to all network cards. The first 24 bits are assigned to the card manufacturer with the send being a unique value (address) for that card.

46
Q

Microsegmented Networks, Microsegmentation

A

Part of a zero trust strategy that breaks LANs into very small, highly localized zones using firewalls or similar technologies. At the limit, this places a firewall at every connection point.

47
Q

Modem

A

Provides modulation and demodulation of binary data into analog signals for transmission through telephone, cable, fiber, or other signaling systems.

48
Q

Multiprotocol Label Switching (MPLS)

A

A WAN protocol that operates at both layer 2 and layer 3 and does label switching.

49
Q

Network Function Virtualization (NFV)

A

Alternately referred to as virtual network function. The objective of NFV is to decouple functions, such as firewall management, intrusion detection, NAT and name service resolution, away from specific hardware implementation and move them into software solutions. NFV’s focus is to optimize distinct network services.

50
Q

Network Management

A

Monitors network performance and identifies attacks and failures. Mechanisms include components that enable network administrators to monitor and restrict resource access.

51
Q

North-South Network Data Flow (or Traffic)

A

Data flowing either from the organization to external destinations (northbound) or into the organization from external sources (southbound). In SDN terms, data flowing up (northbound) or down (southbound) the stack of data/control/applications planes.

52
Q

Open Shortest Path First (OSPF)

A

An interior gateway routing protocol developed for IP networks based on the shortest path first or link-state algorithm.

53
Q

OSI Layer 1

A

Physical Layer

54
Q

OSI Layer 2

A

Data Link Layer

55
Q

OSI Layer 3

A

Network Layer

56
Q

OSI Layer 4

A

Transport Layer

57
Q

OSI Layer 5

A

Session Layer

58
Q

OSI Layer 6

A

Presentation Layer

59
Q

OSI Layer 7

A

Application Layer

60
Q

Packet

A

Representation of data at layer 3 of the OSI 7-Layer Model.

61
Q

Packet Loss

A

Degradation of VoIP or other streaming data caused by lost packets. A technique called packet loss concealment (PLC) is used in VoIP communications to mask the effect of dropped packets

62
Q

Packet-Switched Networks

A

Networks that do not use a dedicated connection between endpoints.

63
Q

Point-to-Point Protocol (PPP)

A

Provides a standard method for transporting multiprotocol datagrams over point-to-point links.

64
Q

Port Address Translation (PAT)

A

An extension to network address translation (NAT) to translate all addresses to one routable IP address and translate the source port number in the packet to a unique value.

65
Q

Quality of Service (QoS)

A

Refers to the capability of a network to provide better service to selected network traffic over various technologies, including frame relay, ATM, Ethernet and 802.1 networks, SONET, and IP-routed networks that may use any or all of these underlying technologies.

66
Q

Registered Ports

A

Ports 1024-49151. These ports typically accompany non-system applications associated with vendors and developers.

67
Q

Remote Procedure Call (RPC)

A

A protocol that enables one system to execute instructions on other hosts across a network infrastructure.

68
Q

Root of Trust (RoT)

A

Hardware-based mechanisms that guarantee the integrity of the hardware prior to loading the OS of a computer.

69
Q

Segment

A

Data representation (or datagram name) at Layer 4 of the OSI 7-Layer Model. A portion of a larger network, usually isolated by firewalls or routers at either end from other portions of the network. See also Microsegmented Networks, Microsegmentation.

70
Q

Simple Network Management Protocol (SNMP)

A

An IP protocol for collecting and organizing information about managed devices on IP networks. It can be used to determine the “health” of networking devices including routers, switches, servers, workstations, printers, and modem racks.

71
Q

Smurf

A

ICMP echo request sent to the network broadcast address of a spoofed victim causing all nodes to respond to the victim with an echo reply.

72
Q

Software-Defined Networking (SDN)

A

Any of a broad range of techniques that enable network management, routing, forwarding and control functions to be directed by software. This is generally done by abstracting the control and management planes from the data plane and its forwarding functions.

73
Q

Software-Defined Wide Area Network (SD-WAN)

A

An extension of the SDN practices to connect to entities spread across the internet to support WAN architecture especially related to cloud migration.

74
Q

Teardrop Attack

A

Exploits the reassembly of fragmented IP packets in the fragment offset field that indicates the starting position, or offset, of the data contained in a fragmented packet relative to the data of the original unfragmented packet.

75
Q

Terminal Emulation Protocol (Telnet)

A

A command-line protocol designed to give command-line access from one host to another.

76
Q

Transmission Control Protocol (TCP)

A

The major transport protocol in the internet suite of protocols providing reliable, connection-oriented, full-duplex streams.

77
Q

Transmission Control Protocol over Internet Protocol (TCP/IP)

A

The name of the IETF’s four-layer networking model, and its protocol stack.

78
Q

Transport Control Protocol/Internet Protocol (TCP/IP) Model

A

Internetworking protocol model created by the IETF, which specifies four layers of functionality: link layer (physical communications), internet layer (network-to-network communication), transport layer (basic channels for connections and connectionless exchange of data between hosts) and application layer, where other protocols and user applications programs make use of network services.

79
Q

Trusted Platform Module (TPM)

A

A tamper-resistant integrated circuit built into some computer motherboards that can perform cryptographic operations (including key generation) and protect small amounts of sensitive information, such as passwords and cryptographic keys.

80
Q

Unbound (Wireless) Network(s)

A

Network in which physical layer interconnections are done using radio, light or other means not confined to wires, cables or fibers. Devices on unbound networks may or may not be mobile. See also Bound Network(s).

81
Q

Virtual Local Area Networks (VLANs)

A

Allow network administrators to use switches to create software-based LAN segments that can be defined based on factors other than physical location.

82
Q

Voice over Internet Protocol (VoIP)

A

A set of technologies that enables voice to be sent over a packet network.

83
Q

Web Application Firewall (WAF)

A

A software-based firewall, which monitors and filters exchanges between an applications program and a host. WAFs usually involve inspection and filtering of HTTP and HTTPS conversations.

84
Q

Wi-Fi (Wireless LAN IEEE 802.11x)

A

Primarily associated with computer networking, Wi-Fi uses the IEEE 802.11x specification to create a wireless LAN either public or private.

85
Q

WiMAX (Broadband Wireless Access IEEE 802.16)

A

A well-known example of wireless broadband. WiMAX can potentially deliver data rates of more than 30 Mbps.

86
Q

Zero Trust Model / Architecture

A

Replaces trust, but verify as security design principle by asserting that all activities attempted, by all users or entities, must be subject to control, authentication, authorization, and management at the most granular level possible. NIST and others have proposed zero trust architectures as guidance frameworks for organizations to use as they combine microsegmentation, access control, behavior modeling, and threat intelligence (among other techniques) in moving toward a zero trust implementation.

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions