Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 5 > Flashcards

Chapter 5 Flashcards

1
Q

Any data that isn’t public or unclassified

A

Sensitive Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

information that can identify an individual

A

PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

any health-related information that can be related to a specific person

A

PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

data that helps an organization maintain a competetive edge

ie software code, trade secrets, intellectual property

A

Proprietary Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

disclosure would cause exceptionally grave damage to national security

A

top secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

disclosure would cause serious damage to national security

A

secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

disclosure would cause damage to national security

A

confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NGO classification for exceptionally grave damage

A

Confidential/Proprietary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

NGO classification for serious damage

A

Private

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NGO classification for damage

A

Sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NGO classification for no damage

A

Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

data stored on media

A

Data at Rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What kind of encryption protects data at rest?

A

Strong, symmetric encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

data transmitted over a network

A

data in transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what kind of encryption protects data in transit?

A

a combination of symmetric and asymmetric encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

data in memory or temporary storage buffers

A

Data in Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what kind of encryption protects data in use?

A

usually unencrypted (o.o)

sometimes homomoprhic encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what is the best way to protect confidentiality of data?

A

strong encryption paired with strong authentication and authorization controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

person filling this role ensures that the organization is conducting all business activities by following the laws and regulations that apply to the organization

A

compliance officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Security administrators use the _____ defined in the security police to identify security ______.

A

requirements
security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

DLP

A

Data Loss Prevention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

event in which an unauthorized entity can view or access sensitive data

A

data breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

ongoing efforts to organize and care for data throughout its lifetime

A

data maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does this describe?

One network process unclassified data only. Another network processes classified data only. The two networks never physically touch each other.

A

Air Gap - a physical security control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How can data be transferred between air gapped networks?

A

Manually
USB
unidirectional network bridge (data can only move from unclass to class network)
technical guard solution - combo of hardware and software that requires data to be appropriately marked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

systems that attempt to detect and block data exfiltration attempts
can scan unencrypted data and look for keywords or patterns

A

DLP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

two primary types of DLP

A

Network and Endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

which type of DLP is looks at data leaving an organization on an edge device?

A

Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

which type of DLP can detect users copying data to a USB or sending to a printer?

A

Endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is a risk of logging/storing data?

A

Loosing the data or data breaches. Only store what is necessary for business purposes or what is required by law/regulation. (limit data collection)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Where is the best practice location for backups?

A

One copy on site and another copy offsite.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

physical security measures for sensitive data storage:

A

locks
multiple layers of physical security (guards, badged entry)
environmental controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

data that remains on media after it was supposedly erased

A

data remanence

34
Q

If a user was working on a top secret file a moment ago and then creates a small unclassified file, the small file might contain top secret data pulled from memory.

what security control would prevent this?

A

Do not process classified data on unclass systems

35
Q

what generates a heavy magnetic field, which realigns the magfields in media such as traditional hard drives, magentic tape, and floppy disk drives?

(uses magents to completely remove data remanence)

A

degauser

36
Q

what is the best method of sanitizing SSDs?

A

destruction - shred to 2 mm or less

37
Q

performing a delete operation against media - usually only removes the directory link to the data.

A

erasing

38
Q

preparing media for reuse and ensuring that the cleared data cannot be recovered

A

clearing/overwriting

39
Q

3 steps of a common clearing protocol

A
  1. a character (110)
  2. its complement (001)
  3. random bits
40
Q

intense form of clearing for reusing media in less secure environments - data is not recoverable using any known methods

A

purging

41
Q

uses magnets to erase data on traditional media

A

degaussing

42
Q

final stage in lifecycle of media and most secure method of sanitizing data

A

destruction

43
Q

any process that purges media or a system in preparation for reuse in an unclassified environment

A

declassification

44
Q

declassification vs destruction

A

purchasing new media is often less expensive that declassification methods so most organizations opt to destroy media when it is no longer needed.

45
Q

destroying the encryption key, or both encryption and decryption keys

A

cryptographic erasure - could possibly be decrypted so is often paired with a method to overwrite the data

46
Q

what can organizations do to data stored in the cloud?

A

encryption erasure is often the only option

47
Q

retaining and maintaining important information while it is needed and destroying it when it is no longer needed

A

record retention

48
Q

solutions that provide copyright protection for copyrighted works

A

DRM (Digital rights management)

49
Q

a license that grants access to a product with terms of use

A

DRM license

50
Q

over the internet, system periodically connects with an authentication server, and if the connection or authentication fails, DRM blocks use of the product

A

Persistent Online Authentication (always-on DRM)

51
Q

detects abuse, such as concurrent use of a product simultaneously but in two geographically different locations (Hulu, anyone?)

A

Continuous Audit Trail

52
Q

products are sold on a subscription basis and access is blocked if monthly bill is not paid

A

Automatic Expiration

53
Q

software placed logically between users and cloud-based resources that monitors all activity and enforces admin-defined security policies

A

Cloud Access Security Broker (CASB)

54
Q

the use of IT resources without the approval of the IT department

Like Mr. Armstrong using Google Drive to ask us how we feel about each other.

A

Shadow IT

55
Q

using pseudonyms to represent other PII data (can result in less stringent requirements that would apply under the GDPR)

ie using a patient number instead of a name on medical records

A

pseudonymization

56
Q

use of a random string of characters to replace other data (often used with credit card transactions)

A

tokenization. the string is the token.

57
Q

4 steps of tokenization

A
  1. Registration
  2. Usage
  3. Validation
  4. Completing the Sale
58
Q

creating a token and recording it along with the encrypted credit card number, associated with a phone number

A

registration

59
Q

processor sends token to tokenization vault, which answers with unencrypted credit card data and the charge is processed

A

validation

60
Q

processor sends a reply to the POS system and credits the seller for purchase

A

completing the sale

61
Q

If an attacker gets a token can they make purchases?

A

No. The transaction would fail because the token only works from the account associated with the token.

62
Q

removing all PII data

A

Anonymization

63
Q

swapping data in columns so that records no longer represent the actual data - aggregate data within each column is still usable for research

A

randomization

64
Q

person who is ultimately responsible for data

identify classification and ensure it is properly labeled and protected

A

owner

65
Q

the person who owns the asset or system that processes sensitive data

A

asset owner

66
Q

which data role Develops a system security plan in coordination with information owners, the system administrator, and functional end users

A

asset owner

67
Q

which data role Maintains the system security plan and ensures that the system is deployed and operated according to the agreed-upon security requirements

A

asset owner

68
Q

which data role Ensures that system users and support personnel receive appropriate security training, such as instruction on rules of behavior (or an AUP)

A

Asset owner

69
Q

which data role is seen as a program manager or information system owner who is responsible for ensuring that systems provide value to an organization

A

business/mission owner

70
Q

which method helps business owners and mission owners balance security control requirements with business or mission needs?

A

COBIT - Control Objectives for Information and Related Technology

71
Q

the GDPR defines this role as “a natural or legal person, public authority, agency, or other body, which processes personal data solely on behalf of the data controller”

A

data processor

72
Q

person or entity that controls to processing of the data - decides which data to process, why, and how

A

data controller

73
Q

roles created to oversee the control of data and ensure the organization follows all relevant laws and regulations
this role is mandated by the GDPR
responsible for ensuring the organization applies the laws to protect individual’s private data

A

data privacy officer

74
Q

this data role is responsible for day-to-day tasks

ensures proper storage and protection

typically personnel within an IT department or sysadmins

A

data custodian

75
Q

anyone with elevated privileges related to data

A

data administrators

76
Q

person who accesses data to accomplish work tasks

A

users

77
Q

person who can be identified through an identifier within data

A

data subject

78
Q

set of minimum security controls defined for an information system

A

security control baselines

79
Q

four baselines from NIST SP 800-53B

A

Low-Impact Baseline
Moderate-Impact Baseline
High-Impact Baseline
Privacy Control Baseline

80
Q

modifying a list of security controls within a baseline to align with the organizations mission

A

tailoring

81
Q

reviewing a list of baseline security controls and selecting only those controls that apply

vigorously defends in writing any decision to omit a control from the baseline

A

scoping

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions