Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Domain 7: Security Operations > Flashcards

Domain 7: Security Operations Flashcards

1
Q

Continuity Planning Subtasks (5)

A

Strategy Development, Provisions and Processes ,Plan Approval, Plan Implementation, Training and Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Strategy Devlopment

A

Bridges gap btwn BIA and Continuity Planning in BCP - determines which risks are acceptable which must be mitigated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Provisions and Processes

A

specific procedures and mechanisms that will mitigate the risk deemed unacceptable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Three Categories of assets in BCP Provisions and Processes

A

People, Buildings/Facilities, Infrasctructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Important Components of a Written BCP (11)

A

Continuity Planning Goals, Statement of Importance, Statement of Priorities, Statement of Organizational Responsibility, Statement of Urgency and Timing, Risk Assessment, Risk Acceptance/Mitigation, Vital Records Program, Emergency Response Guidelines, Maintenance, Testing and Exercise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Importance of a Written BCP (3)

A

Historical Benefit, Sanity Check, Reference document

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Entitlement

A

amount of privileges granted to users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Aggregation

A

amount of privileges that users collect over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Transitive Trust

A

extends the trust between two security domains to all their sub domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Common methods for managing security in the information life cycle

A

Marking Data, Handling data, storing Data, Destroying Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SLA

A

Service level agreement - agreement between and org and vendor that stipulated performance expectations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

MOU

A

documents the intent of two entities to work together toward a common goal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ISA

A

info on how the two parties establish, maintain, and disconnect the connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Virtual Machines

A

run as guest OSs on physical servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SDNs

A

Software Defined Networks - uses simple network devices other than routers and switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

VSANs

A

Virtual Storage Area Networks - virtual dedicated high speed network that hosts multiple storage devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the primary software component in virtualization?

A

Hypervisor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Hypervisor

A

managers the VMs, virtual data storage, and virtual network components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cloud Computing

A

on demand access to computing resources from almost anywhere

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SaaS

A

Software as a Service - fully functional applications (Google Docs), Consumes do not manage or control any assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

PaaS

A

Platform as a Service - computing platform (hw, OS, application), consumers manager the applications and maybe some config settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

IaaS

A

Infrastructure as a Service - servers, storage, networking resources, consumers install OS and applications and perform all maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the 4 cloud models?

A

Public, Private, Hybrid, and Community

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Public Cloud Model

A

assets available for any consumer to rent or lease

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Private Cloud Model
assets are for a single organization
26
Community Cloud Model
assets are provided to two or more organizations
27
Baseline
starting point for configuration of a system
28
Unauthorized Changes Directly affect the __ in the CIA triad
Availability
29
Vulnerability Management
regularly identifying, evaluating and mitigating vulnerabilities
30
CVE
common vulnerability and exposure - dictionary for a standard convention in identifying vulnerabilities
31
Incident
Any event that has a negative effect on the CIA of an org's asset
32
Computer Security Incident
an incident that is a result of an attack
33
Incident Response Steps
Detection, Response, Mitigation, Reporting, Recovery, Remediation, Lessons Learned
34
DoS Attacks
attacks that prevent a system from processing or responding to legitimate traffic or requests
35
DDoS
DoS attack using multiple attack systems
36
DRDoS
Distributed Reflective DoS, doesn't attack victim directly, manipulates traffic to reflect attacks back
37
SYN Flood attack
sends multiple SYN flags, never completed conversation
38
Smurf Attack
floods the victim with ICMP echo packets
39
Fraggle Attacks
floods victims with UDP Packets over port 7 and 19
40
Ping Flood Attack
floods a victim with ping requests
41
Ping-of-death Attack
send oversized ping packet
42
Teardrop Attack
attacker fragments traffic in such a way that a system is unable to put data packets back together
43
Land Attack
attacker sends spoofed SYN packets suing the victims IP address as source and destination
44
Zero-day Exploit
attack on a system exploiting an unknown vulnerability
45
Malicious Code
any script or program that performs an unwanted, unauthorized, or unknown activity
46
Drive-by Download
code downloaded and installed on a user's system without their knowledge
47
Man in the Middle Attack
attacker gains a logical position between two endpoints of communication
48
War Dialing
using a modem to search for a system that accepts inbound comms attempts, newer forms use VoIP
49
Knowledge Based Detection
signature or pattern based, uses database of known attacks
50
Behavior Based Detection
heuristics or anomaly based, creates a baseline of normal
51
Passive vs Active IDS Response
Passive is notifications, active modifies the environment
52
Darknet
Portion of allocated IP addresses within a network that are not used
53
Pseudo Flaws
false vulnerabilities intentionally implanted in a system to tempt attackers
54
Padded Cells
similar to honeypot but performs intrusion isolation
55
Whitelisting
Identifies list of apps authorized to run
56
Blacklisting
Identified list of apps unauthorized to run
57
Logging
process of recording info about events to a log file or database
58
Monitoring
process of reviewing information logs looking for something specific
59
Log Analysis
detailed and systematic form of monitoring
60
SIEM
Security Information and Event Management - provide real time analysis of events
61
Sampling
process of extracting specific elements from a large collection of data to construct something meaningful
62
Clipping
form of nonstatistical sampling
63
Egress Monitoring
monitoring outgoing traffic to prevent data exfiltration
64
What are the two primary types of DLP systems?
Network based and endpoint based
65
Network Based DLP
scans all outgoing data looking for specific data
66
Endpoint-based DLP
scans filed stored on the system as well as files sent to external devices (printers, flash drives, etc)
67
Disaster Recover Planning steps in where ___ leaves off
BCP
68
Single Point of Failure
any component that can cause an entire system to fail
69
Fault Tolerance
the ability of a system to suffer a fault but continue to operate
70
System Resilence
the ability of a system to maintain an acceptable level of service during an adverse event
71
RAID-0
Striping, uses two or more disks and improves disk performance but does not provide fault tolerance
72
RAID-1
Mirroring - uses two disks which both hold the same data
73
RAID-5
Striping with Parity - uses three or more disks, provides fault tolerance but system will operate slower
74
RAID-10
aka RAID 1 +0, a stripe of mirrors, two or more mirrors configured in a stripe
75
UPS
Uninterruptible Power Supply, provides btwn 5 and 30 min of power
76
Fail Secure System
systems will default to a secure state in the event of a failure
77
Fail Open System
fails to an open state, granting all access
78
4 Types of Trusted Recovery
Manual Recovery, Automated Recovery, Automated Recovery without Undue Loss, Function Recovery
79
Function Recovery
automatically recover specific functions
80
Manual Recovery
does not fail in secure state, admin manually takes actions for a secured or trusted recovery
81
Automated Recovery
system performs trusted recovery activities to restore itself against at least one type of failure
82
Automated Recovery without Undue Loss
system performs trusted recovery activities to restore itself against at least one type of failure + specific objects are protected against loss
83
Bandwidth
network capacity available to carry communications
84
Latency
time it takes a packet to travel from source to destination
85
JItter
variation in latency between different packets
86
The DRP team must first __________
identify the high priority business units
87
Cold Sites
standby facilities with HVAC, power, etc and nothing else, takes weeks to set up
88
Hot site
up to date data and facilities, may be ready instantaneously
89
Warm Sites
contains equipment and data circuits, usually 12-24 hours to activate
90
Service Bureau
Company that leases computer time, owns large server farms
91
MAAs
Mutual Assistance Agreements - two orgs pledge to assist each other
92
Electronic Vaulting
database backups are moved to a remote site using bulk transfers
93
Remote Journaling
data transfers are performed more frequently (once/hour)
94
Remote Mirroring
live database server is maintained at the backup site
95
Full Backups
complete copy, resets archive bit
96
Incremental Backups
copy only files that have been modified since the last full or incremental backup, resets archive bit
97
Differential Backups
copy all files modified since last full backup, does not reset archive bit
98
Software Escrow Arangements
third party sw developer provides copies of source code to another organization - in case they do not continue support or shut down
99
Recovery vs Restoration
Recovery is short time frame, implement and maintain operations at the recovery site. Restoration restores primary site to operational capacity
100
3 goals of a Read-through test
ensures you have key personnel aware of roles, provides individuals an opportunity to review the plans and update, update personnel who have left
101
Structured Walk Through
table top exercise - role play scenario
102
Simulation Test
structured walk through + testing of scenarios
103
Parallel Test
relocate personnel to alternate site and implement site activation procedures
104
Full-Interruption Test
shut down operations at the primary site and shifting them to the recovery site
105
Operational Investigations
examine issues related to the organization's computing infrastructure and have the primary goal of resolving operational issues
106
Criminal Investigations
may result in charging suspects with a crime
107
Regulatory Investigations
when the government believes that an individual or corporation has violated administrative law
108
9 Steps of Electronic Discovery
Information Governance, Identification, Preservation, Collection, Processing, Review, Analysis, Production, Presentation
109
What are the 3 requirements of admissible evidence?
relevant, related (Material) to the case, competent (obtained legally)
110
Real Evidence
physical evidence
111
Documentary Evidence
written items
112
Testimonial Evidence
testimony of a witness
113
Media Analysis
identification and extraction of information from storage media
114
Network Analysis
activity over network
115
Hardware/Embedded Device Analysis
review the contents of hw and embedded devices
116
Military and Intelligence Attacks
launched to obtain secret and restricted information from law enforcement or military
117
Business Attacks
illegally obtaining an org's confidential information
118
Financial Attacks
unlawfully obtain money or services
119
Grudge Attacks
attacks carried out to damage an org or person
120
Thrill Attacks
script kiddies, often for the fun of it
121
Event
any occurrence that takes place during a certain period of time
122
Incident
An event that has a negative outcome affecting the CIA
123
Scanning
similar to a burglar casing a neighborhood
124
Compromise
any unauthorized access to the system of information the system stores
125
CIRT
computer incident response team
126
3 Step Incident Response Process
1. Detection and Identification 2. Response and Reporting 3. Recover and Remediation
127
1. Detection and Identification
detect security incident and notify appropriate personnel
128
2. Response and Reporting
Isolation and Containment, Gathering Evidence
129
3. Recovery and Restoration
restore environment to normal operating state and complete a lessons learned process
130
5 rules of digital evidence
authentic, accurate, convincing, complete, admissable

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions