Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP FlashCards 2021 CBK (in progress) > Domain 7, Security Operations > Flashcards

Domain 7, Security Operations Flashcards

1
Q

BCP

A

Business continuity Plan. Long term plan to ensure the continuity of business ops.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Collusion

A

agreement between 2+ individuals to subvert sec system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Continuity of Operations Plan - COOP

A

Plan to maintain ops during a disaster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Disaster

A

Disruptive event that interrupts normal system operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Disaster recovery plan DRP

A

Short term plan to recover from a disruptive event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

MTBF

A

Mean time between failures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

MTTR

A

Mean time to repair/recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Mirroring

A

RAID - Duplication of data to another disk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RAID

A

Redundant array of inexpensive disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Striping

A

Spread data across multiple disks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Slack space

A

Unused space that is leftover when a File of X-1 size was given space of X

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Bad Blocks/Clusters

A

Unusable sectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Live forensics

A

Seeing what’s in live memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Meterpreter

A

Power metasploit payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Network forensics

A

study of data in motion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Forensic software analysis

A

deconstruct malware and software. Use a VM to detonate Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

EMbedded Device Forensics

A

IoT and Other Handheld devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Electronic Discovery

A

Help lawyers with discovery process via Electronic Discovery tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CSIRT

A

Computer Security Incident Response Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

800-61r2

A

NIST Incident Handling Guide

4 step lifecycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

800-61r2 lifecycle Step 1

A

Prep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

800-61r2 lifecycle Step 2

A

Detection and Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

800-61r2 lifecycle Step 3

A

Containment, Eradication, and recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

800-61r2 Step 4

A

Post-incident Activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

IR MGMT Step 1

A

Prep

Training, policies, procedures, checklist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

IR MGMT Step 2

A

Detection, AKA identification

Events—> Incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

IR MGMT Step 3

A

Response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

IR MGMT Step 4

A

Mitigation, aka Eradication

Root Cause Analysis

Get rid of the bad things

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

IR MGMT Step 5

A

Reporting

Not really a step, this happens throughout the process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

IR MGMT Step 6

A

Recovery

Restore systems and ops

Increase monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

IR MGMT Step 7

A

remediation - long term strategic activity designed to eradicate root cause for identified incidient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

IR MGMT Step 8

A

Lessons Learned. Shoudl be documented in a formal process, and assigned as action items with accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Intrusion Detection System

A

Detects intrusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

IDS True Positive

A

alerts on an actual issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

IDS True Negative

A

doesn’t alarm on something that it doesn’t need to alarm on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

IDS False positive

A

Trips on something that it shouldn’t on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

IDS False Negative

A

Doesn’t trip on something it should trip on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

NIDS NIPS

A

Network intrusion detection,

Network intrusion prevention system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

HIDS HIPS

A

Host Intrusion detection

Host intrusion prevention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Knowledge-based IDS/IPS

A

AKA Signature based, AKA Pattern-matching

-compares events to static signatures of known attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Behavior-based IDS/IPS

A

Creates a baseline for what activities/events are considered normal. Once baseline is determined, it can now detect ‘abnormal’ activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Anomaly detection

A

Finds a baseline of normal traffic, then anomaly detection IDS ignores normal traffic.

Will alert when it sees odd traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Continuous monitoring

A

ASsessing and reassessing as an ongoing process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

DLP

A

data loss prevention.

class of solutions used to detect and prevent data from leaving the org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Application Whitelisting

A

Only run what is permitted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Sandboxing

A

Separate running programs, in an effort to mitigate system failures from spreading.

Test untested or untrusted programs.

Detonate malware in a VM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Asset/Configuration management

A

Hardened baselines and configs.

Establishes the baseline of an information technology environment that includes a secure baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Baselining

A

Capture a snapshot of the current system security config. Establishes an easy means for capturing the current system config.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Vulnerability management

A

scan in a way to discover poor configs and missing patches in an environment, with an emphasis on managing those vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Zero day vulnerability

A

no identified patch or workaround.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Zero day exploit

A

Exploit methods is/are available for a vulnerability which has yet to be patched.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Change management

A

Track and audit changes to configuration files. Assess risks of changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

SLA

A

Service level agreement

Stipulate all expectations regarding behavior of the department or organizations.

Orgs must negotiate all secure terms of service lvl agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Full Backup

A

Complete copy. Duplicates every file regardless of the archive bit. Once complete, archive bit on every file is reset, turned off, or set to 0.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Incremental backup

A

archives files that have changes since last full or incremental backup. Only files that have the archive bit turned on (set to 1) are duplicated. Once complete, archive bit on every file is reset, turned off, or set to 0.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Differential Backup

A

archives files that have changes since last full (but NOT INCREMENTAL) backup. Only files that have the archive bit turned on (set to 1) are duplicated. DOES NOT CHANGE ARCHIVE BIT once done.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

RAID 0

A

Stripes two or more disks to improve performance, but NOT fault tolerance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

RAID 1

A

Mirrors, uses two disks both with the same exact data. Provides fault tolerance. Lower write speeds, but potentially higher read speeds.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

RAID 3

A

NOT IN CBK. Byte level striping with dedicated parity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

RAID 4

A

NOT IN CBK. Block lvl striping with dedicated parity

61
Q

RAID 5

A

Striping with parity. Uses three or more disks, with one disk holding parity information. Parity allows reconstruction to occur after disk failure via mathematical calculations.

62
Q

RAID 6

A

Same as RAID 5, but with two parity disks.

63
Q

Mirroring

A

Writes same data to multiple hard disks.

Writes are slower read is faster. Costly

64
Q

Striping

A

Spread data across multiple hard disks.

Reads and writes can be performed in parallel acros multiple disks

Performance increase on reads and writes

65
Q

RAID 10

A

Nested RAID. Configuration is a striped set of mirrors. Uses at least 4 disks, but can support more as long as an even number of disks are added.

Can tolerate multiple disk failures, as long as one drive in each mirror continues to operate.

66
Q

BCP

A

business continuity plan. Long term plan to ensure continuity of business ops

67
Q

BCP

A

business continuity plan. Long term plan to ensure continuity of business ops

Business level scope

68
Q

DRP

A

Disaster recovery plan

Short term plan to recover from a disruptive event.

69
Q

DRP

A

Disaster recovery plan
Short term plan to recover from a disruptive event.

IT oriented scope

70
Q

MTTR

A

Mean time to repair.

71
Q

MTTR

A

Mean time to repair.

72
Q

Natural disaster

A

Weather, earthquake

73
Q

Human

A

Malware, assault, large portions of workforce leaving.

74
Q

Environmental

A

HVAC fails, power outage

75
Q

DRP Process - respond

A

Begin processing the damage

Initial assessment

76
Q

DRP Process - Acticate team

A

Activate team

77
Q

DRP Process - Communicate

A

comms must be out of band. Ensuretimely updates. Org should be prepared for external comms

78
Q

DRP Process - Assess

A

More detailed and thorough assessment

Assess damage

Team could recommend ultimate restoration/reconstitution at different site

79
Q

DRP Process -Reconstitution

A

Recover business ops at primary or secondary site.

Salvage team activated at primary facility

80
Q

Develop a BCP/DRP

A 
Project initiation
scope the project
business impact analysis
identify preventive controls
Recovery strategy
Plan design, and develpment
implementation, training, and testing
BCP/DRP
81
Q

NIST 800-34

A

NIST contigency planning guide.

82
Q

BCP/DRP Planning Project Initiation Milestones

A

7

  1. Develop contigency plan
  2. Conduct business impact ianalysis
  3. Identify preventive controls
  4. develop recovery strategies
  5. Develop IT contigency plan
  6. Plan testing, training, excercises
  7. Plan maintenance of documents
83
Q

Continuity planning project team

A

Team set up to determine responsibilities and objectives of continuity plan.

84
Q

RTO

A

Recovery time objective. How quickly something a system can be brought back on line, but not integrity hasn’t been verified yet.

85
Q

WRT

A

Work recovery time. After system is online, time to verify integrity of system.

86
Q

Executive mgmt - Scoping the project

A

need exec support for

  • initiating the scoping process,
  • and also need to sign off on final approval.
  • need to excercise due diligence and due care
87
Q

assess teh critical state

A

process to determine which iniformation systems are critical. difficult to do because how important something is depends soley on who uses it.

when compilinng the critical state and asset list, the Project manager should not how assets impact the org

88
Q

business impiact analysis BIA

A

correlate IT systems to critical services they support. Aims to quantify the consequence of disruption

89
Q

BIA Steps

A

Business impact analysis

  1. Identify critical assets
  2. Conduct DRP/BCP focused risk assessment
90
Q

MTD = ?

A

Max tolerable downtime = Recovery time objective + Work recovery time

MTD = RTO +WRT

91
Q

RPO =

A

recovery point objective, how much data you can afford to lose

92
Q

MOR =

A

Minimum operating requirements

usually applies to environmentals.

93
Q

Redundant site

A

exact replica, very expensive.

no data loss in event of disaster at primary site

94
Q

Hot site

A

Less than one hour of downtime.

Has all infrastructure for resuming normal business operations.

95
Q

warm site

A

Most aspects of a hot site, but relies on backups to get systems up and running.

MTD of 1-3 days

96
Q

Cold site

A

not equipment, no backup data. Typically just physical building.

1-3 weeks of MTD

97
Q

Mutual Aid Agreement

A

Two businesses promise to cover each others’ business needs in event of disaster.

98
Q

mobile site

A

data center on wheels.

99
Q

COOP

A

Continutity of operastions plan. Focuses exclusively on operations.

100
Q

BRP

A

Business recovery plan/ business resumption plan

details plan to resume normal operations AFTER recovering from disaster/disruptive event.

picks up after COOP is complete.

101
Q

CSP

A

continuity of support plan.

Helpdesk/IT oriented continuity plan.

102
Q

CIRP

A

Cyber Incident Response Plan

103
Q

OEP

A

Occupant emergency plan

104
Q

CMP

A

Crisis Management Plan

Details actions required of management in a disaster.

105
Q

CCP

A

crisis communications plan - Plan for communicating to staff in event of a disaster.

Component of CMP

106
Q

Call trees

A

each employee is responsible for calling a small number of other employees in event of a disaster.

107
Q

EOC

A

emerency ops center

108
Q

Vital records

A

vital documentation needed for normal operations. Licenses, checkbooks, contracts

109
Q

forensic media analysis

A

analysis of binary disk images

110
Q

root-cause analysis root cause

A

attempts to determine the underlying weakness or vulnerability.

111
Q

executive succession plan

A

determines line of succession in event an executive is unable to lead.

112
Q

executive succession plan

A

determines line of succession in event an executive is unable to lead.

113
Q

Tape rotation

A

method to ensure you have long backup windows, but don’t require too much tape.

114
Q

Electronic vaulting

A

batch process of electronically transmitting data that is backed up on a routine. Offsite facility

115
Q

Remote journaling

A

log of all database transactions.

116
Q

Database Shadowing

A

Updates a backup DB automatically when live DB is changes. Two or more backup DBs

117
Q

Software Escrow

A

source code is held by an impartial 3rd party in case software vendor goes out of business.

118
Q

Hardcopy data

A

on paper data. In hurricane prone areas, businesses often develop a paper-only DRP

119
Q

DRP Testing

A

Plan is only as effective as the last time it was updated and tested.

Should be performed at least yearly.

120
Q

DRP Testing - Read-Through AKA Checklist testing

A

Review the plan, read the whole thing.

AKA consistency testing. Lists all necessary components. Ensures they’re readily available in event of disaster.

121
Q

DRP Test, partial and complete business integration

A

Intentional outage. Can actually cause a real disaster. More common in fully redundant, load balanced operation.

122
Q

DRP training

A

DRP specific training to bring employees up to speed.

123
Q

DRP training

A

DRP specific training to bring employees up to speed.

124
Q

BCP/DRP Maintenance

A

must be kept up to date. Must keep pace with all critical IT/Business changes.

Change management

125
Q

NIST SP 800-34

A

BCP/DRP Framework from NIST

126
Q

ISO/IEC 27031

A

BCP Framework from ISO

127
Q

ISO/IEC 27031

A

BCP Framework from ISO

128
Q

ICT

A

ISO Acronym, Information and Comms Technology

129
Q

ISMS

A

ISO Acronym, Information security mgmt system.

130
Q

ISO/IEC 24762:2008

A

ISO guide for disaster recovery DRP

131
Q

BS 25999

A

Part 1, code of practice

Part 2, Specifications for business continuity

132
Q

BCI

A

Business continuity institute

133
Q

Security Operations

A

concerned with threats to a production operating environment.

134
Q

Least Privilege AKA Minimum Necessary Access

A

Persons should have no more access than is necessary for the performance of their duties.

135
Q

Need to Know

A

Even if you have access, if you do not need to know, then you should not access the data. Example, in a MAC environment, even if you have the clearance - if the information isn’t relevant to you then you aren’t ‘need to know’ and shouldn’t have access.

136
Q

Separation of Dties

A

Multiple people are required to complete critical or sensitive transactions. Idea is to require multiple people acting un-ethically for something bad to happen. i.e. the payroll administrator can’t also audit accounting logs. Idea

137
Q

Rotation of Duties/Job Rotation

A

Ensures there’s more depth to the organizational skillset. Simply requires that no one person perform critical functions for too long.

138
Q

Mandatory Leave/Forced Vacation

A

Prevents an operator from having exclusive use of a system. If they’re doing anything shady - then it will potentially/probably be discovered while they’re out.

139
Q

NDA

A

Nondisclosure Agreement.

Legally binds a user to confidentiality.

140
Q

Background Checks

A

Helps ensures quality of candidate.

141
Q

Forensic - Allocated space

A

portions of disk partition marked as containing active data

142
Q

Forensics - unallocated space

A

portions of disk that do not contain active date.

Could have never had data - or simply been marked as unallocated but still contains old information.

143
Q

Forensics - Slack Space

A

When the minimum sized block of information isn’t fully used by a piece of information - the remaining space that isn’t usable is called slack space.

Slack space may contain old/unused information, or might be used by attackers.

144
Q

Forensics - bad blocks/clusters/sectors

A

Physically unusable space. Attacker might mark space as ‘bad’ in order to use for themselves.

145
Q

Removable Media controls

A

Put controls on PCs/routers to bar un-known peripherals (USB drives, keyboards, mice, monitors etc)

146
Q

DRP Testing - walkthrough/tabletop

A

virtual/tabletop simulation of DRP to conceptually run through the whole process. Goal to find any gaps or redundancies, erroneous assumptions, etc.

147
Q

DRP Testing - Simulation test, physical walkthrough drill

A

Simulate a disaster and have all teams go through the physical motions of response.

148
Q

DRP Test - Parallel processing

A

Test recovery at another facility and restore data from a backup. Regular systems are not impacted

149
Q

DRP Test- partial business interruption AKA Cutover test

A

Stop activities at main location, start at backup location

CISSP FlashCards 2021 CBK (in progress) (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions