Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

SEC+ > Chap 1 > Flashcards

Chap 1 Flashcards

(50 cards)

Start Studying
1
Q

What is information security?

A

Protection of data resources from unauthorized access, attack, theft or damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the CIA Triad?

A

Properties of securing information:
- Confidentiality
- Integrity
- Availability
* Non-Repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Confidentiality?

A

Certain information should only be known to certain people.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is integrity?

A

When data is stored and transferred as intended and that any modification is authorized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Availability?

A

Information is accessible to those authorized to view or modify it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Non-repudiation?

A

A subject cannot deny doing something such as creating, modifying or sending a resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the five functions of Cybersecurity task according to NIST?

A
  • Identify
  • Protect
  • Detect
  • Respond
  • Recover
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Identify as a cybersecurity task function?

A

To develop security policies and capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is protect as a function of cybersecurity task?

A

Procure/develop, install, operate and decommission IT hardware and software assets with security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is “detect” as a function of Cybersecurity task?

A

To perform ongoing, proactive monitoring to ensure that controls are effective and capable of protecting against new threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is “Respond” as a function if cybersecurity task?

A

To identify, analyze, contain, and eradicate threats to systems and data security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is “recover” as a function of cybersecurity task.

A

To implement cybersecurity resilience to remote systems and data if other controls are unable to prevent attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a security policy?

A

A security policy is a formalized statement that defines how security will be implemented within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a CSO/CISO

A

Chief Security Officer/ Chief Information Security Officer is the overall authority for internal security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an ISSO

A

Information Systems Security Officer is a dedicated security admin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who as external responsibility for security (due care/liability)?

A

The owner/ director

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

All employees share some measure of responsibility. T/F?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a SOC?

A

A Security Operations Center is where critical information assets are monitored and protected across other business functions such as finance, operations, sales/marking and so on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is DevSecOps?

A

Development Security Operations is a form of development security operations that bridges the gap between developers and system administrators.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a CIRT/CSIRT/CERT?

A

Cyber incident response team, Computer security incident response team, or computer emergency response team is a single point of contact for notification of a security incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a security control?

Study These Flashcards
A

Something designed to make a system or data asset the properties of confidentiality, integrity, availability and non-repudiation.

22
Q

What are the categories of security controls?

Study These Flashcards
A
  • Technical
  • Operational
  • Managerial
23
Q

What is a technical security control?

Study These Flashcards
A

Control implemented as a system (hardware ,software, or firmware).

24
Q

What is an Operational security control?

Study These Flashcards
A

Control implemented primarily by people rather than systems.

25
What is a managerial security control?
Control that gives oversight of the information system.
26
What are the security control function types?
- Preventive - Detective - Corrective
27
What type of security control is Preventive?
The control acts to eliminate or reduce the likelihood that an attack can succeed. ACL (Access Control List) is an example of this.
28
What type of security control is Detective?
The control may not prevent or deter access, but it will identify and record any attempted or successful intrusion.
29
What type of security control is Corrective?
The control acts to eliminate or reduce the impact of an intrusion event and typically used after the attack.
30
What are other types security functions can be classified as?
- Physical - Deterrent - Compensating
31
What type of security control is physical?
Controls such as alarms, gateways,locks, lighting, security cameras, and guards that deter and detect access to premises and hardware.
32
What type of security control is Deterrent?
Control may not physically or logically prevent access, but psychologically discourages an attacker from attempting to an intrusion (i.e. warning signs).
33
What type of security control is Compensating?
Control serves as a substitute for a principle control, as recommended by a security standard and affords the same level of protection.
34
What is a CSF?
Cybersecurity framework is a list of activities and objectives undertaken to mitigate risk and allows an org to create an objective statement of current capabilities and prioritize investments to achieve a target level.
35
RMF vs CSF
Risk Management Framework pre dates the CSF and the CSF forces on practical cybersecurity of businesses while RMF is more prescriptive and principally for federal agents.
36
What is ISO?
International Organization of Standards
37
What is ISO 27001,27002, 27017, 27018 and 27701 focus on?
27001: Info Sec Management 27002: Classifies Sec Controls 27017 & 27018: Cloud Security 27701: Personal data and Privacy
38
What is ISO 31k?
Overall framework for enterprise risk management (ERM) which includes financial, customer service, competition and legal liability.
39
What is CSA?
Could Security Alliance produces various resources to assist cloud service providers (CSP) in setting up and delivering secure cloud platforms.
40
What is SSAE?
Statements on Standards for Attestation Engagements are audit specifications developed by the American Institute of Certified Public Accountants (AICPA)
41
What levels of reporting are in SSAE No.18?
Service Organization Control (SOC2) and SOC3
42
What is the CIS?
Center for Internet Security is a not-for-profit org and used to perform an overall evaluation of security posture.
43
Codes that run on the client should not be trusted. T/F?
True
43
What is OWASP?
Open Web Application Security Project is a not-for-profit, online community that publishes several secure application development resources such as the Top 10 most critical security application risks.
44
What is Due Diligence in reference to Regulation, standards and legislation?
legal term meaning that responsible persons have not been negligent in discharging their duties.
45
What does SOX mandate?
Sarbanes-Oxley ACT mandates the implementation of risk assessments, internal controls, and audit procedures.
46
What is GDPR?
General Data Protection Regulation is a fairness and right to privacy regulation in Europe.
47
What complicates compliance?
Laws derive from different sources.
48
What is GLBA?
Gramm-Leach-Bliley Act is for financial services, and the Health Insurance Portability and Accountability Act (HIPPA).
49
What is the PCI DSS?
Payment Card Industry Data Security Standard and defines the safe handling and storage of financial information.

SEC+ (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions