Daily Practice > CISSP Rules > Flashcards

CISSP Rules Flashcards

(80 cards)

Study These Flashcards
1
Q

In CISSP, what security objective does encryption primarily support?

A

Confidentiality (Integrity only if digital signatures or hashing are explicitly stated)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does hashing primarily provide in CISSP?

A

Integrity by detecting unauthorized modification, not confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is availability concerned with in CISSP?

A

Ensuring authorized access to systems and data when needed (uptime)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Who owns security governance in CISSP?

A

The Board of Directors and senior management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the primary purpose of security in CISSP?

A

To enable business objectives, not block them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In CISSP, what should come first: policy or technology?

A

Policy always comes before standards, procedures, and tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How does CISSP define the relationship between governance and compliance?

A

Governance is broader; compliance is only the minimum baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is due care in CISSP?

A

Implementing reasonable security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is due diligence in CISSP?

A

Continuous monitoring and maintenance of security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What legal risk can arise from lack of due diligence?

A

Negligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the conceptual CISSP risk formula?

A

Risk = Threat × Vulnerability × Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who must approve risk acceptance in CISSP?

A

Senior management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Does risk mitigation eliminate risk in CISSP?

A

No, it only reduces risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which risk response eliminates risk entirely?

A

Risk avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is risk appetite in CISSP?

A

The organization’s overall strategic willingness to accept risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is risk tolerance in CISSP?

A

The acceptable deviation from risk appetite at a tactical level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is residual risk?

A

Risk remaining after controls are applied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is inherent risk?

A

Risk that exists before any controls are implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Who is the data controller in privacy laws?

A

The entity that determines the purpose and means of processing personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Who is the data processor in privacy laws?

A

The entity that processes data on behalf of the controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where does primary accountability for privacy violations lie in CISSP?

A

With the data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

In CISSP, what determines accountability: execution or decision-making?

A

Decision-making authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does purpose limitation control?

A

How personal data is used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does data minimization control?

A

How much personal data is collected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is the impact of a broken chain of custody?
Evidence may become inadmissible in court
26
What is the key distinction between criminal and civil law?
Criminal law is state vs individual; civil law is party vs party
27
Are all data assets protected equally in CISSP?
No, protection is based on classification
28
Who is the asset owner in CISSP?
A business role responsible for the information asset
29
Is IT the asset owner by default in CISSP?
No, IT is never the asset owner by default
30
Who classifies data in CISSP?
The asset owner
31
Who accepts residual risk for an information asset?
The asset owner
32
What is the primary responsibility of a data custodian?
Implementing and maintaining security controls
33
Can accountability be delegated in CISSP?
No, accountability cannot be delegated
34
Who is accountable for data misclassification?
The asset owner
35
What is the primary driver for data classification?
Business impact if the data is compromised
36
Do users ever classify data in CISSP?
No, users never classify data
37
In CISSP, at which stages must security controls be applied in the data lifecycle?
Security controls must apply across the entire data lifecycle
38
What drives how long data should be retained in CISSP?
Legal, regulatory, and business requirements
39
What overrides normal data retention and disposal schedules?
A litigation hold
40
Does deleting data guarantee it is destroyed?
No, data remanence may still exist
41
How should data disposal methods be chosen in CISSP?
Based on data classification and risk
42
What determines data handling requirements?
Data classification
43
What is the primary purpose of data marking?
To support user awareness and proper handling
44
Does data marking enforce access control?
No, it only supports awareness
45
What does need to know restrict in CISSP?
Which data a user may access
46
What does least privilege restrict in CISSP?
The amount of access granted to a user
47
In CISSP, how must data be protected across states?
Data must be protected at rest, in transit, and in use
48
How must exceptions to data handling rules be managed?
They must be documented and approved
49
What does least privilege limit?
The scope of access granted
50
What does need to know limit?
Access to data relevant to specific job tasks
51
What is the primary flow of physical security controls?
Prevent, detect, and respond
52
Which physical control is most effective at preventing tailgating?
Mantraps
53
What is the primary function of fences in physical security?
To deter and delay attackers
54
In CISSP, what takes priority over asset protection?
Life safety
55
What is the difference between defense in depth and zoning?
Defense in depth is layering; zoning is segmentation
56
What does defense in depth mean in physical security?
Applying multiple independent layers of controls
57
What does zoning mean in facility security?
Dividing areas based on sensitivity and risk
58
What is the purpose of secure system design in CISSP?
To build security into systems from the beginning
59
What does defense in depth rely on?
Multiple independent security layers
60
How should systems behave when access control fails?
They should fail safe (fail closed)
61
Should security depend on secrecy of design?
No, security must not rely on secrecy of design
62
What increases security assurance in system design?
A smaller Trusted Computing Base
63
What is the risk of shared components in system design?
Increased attack surface and systemic risk
64
Which design principle minimizes shared mechanisms?
Least common mechanism
65
What is the primary focus of the Bell–LaPadula model?
Confidentiality
66
What is the primary focus of the Biba model?
Integrity
67
What does the Clark–Wilson model enforce?
Integrity through well-formed transactions
68
What problem does the Brewer–Nash (Chinese Wall) model address?
Conflicts of interest
69
How does the Brewer–Nash model make access decisions?
Based on prior access (dynamic)
70
Which type of encryption should be used for bulk data?
Symmetric encryption
71
Which type of encryption is best for key exchange?
Asymmetric encryption
72
What security objective does hashing provide?
Integrity
73
Does hashing provide confidentiality?
No, hashing does not hide data
74
What security objectives do digital signatures provide?
Integrity, authentication, and non-repudiation
75
What commonly undermines strong cryptography in practice?
Poor key management
76
What is the most effective way to reduce attack surface?
Disabling unnecessary services
77
Why are firmware vulnerabilities especially dangerous?
They operate below the operating system
78
What mitigation limits the blast radius of a compromise?
Isolation
79
What major risk is introduced by virtualization?
Hypervisor compromise
80
What ensures systems remain securely configured over time?
Configuration management
Daily Practice
flashcards
Decks in class (19)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions