Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Sys-601 > My Questions > Flashcards

My Questions Flashcards

1
Q

Protect Documents that can be used in evidence from being altered

A

Legal Hold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Authentication Header (AH)

A

provides a mechanism for authentication only. Because AH does not perform
encryption, it is faster than ESP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Encapsulation Security Payload ESP

A

provides data confidentiality (encryption) and authentication (data integrity, data
origin authentication, and replay protection). ESP can be used with confidentiality only,
authentication only, or both confidentiality and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data owner

A

Usually a member of senior management. Can delegate some day-to-day duties.
Cannot delegate total responsibility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Controller

A

Manages the purposes and means by which
personal data is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data processor

A

Processes data on behalf of the data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data custodian/steward

A

Responsible for data accuracy, privacy, and security
– Associates sensitivity labels to the data
– Ensures compliance with any applicable laws and standards
– Manages the access rights to the data
– Implements security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data protection officer (DPO)

A

Responsible for the organization’s data privacy
– Sets policies, implements processes and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Incident Response Lifecycle

A
  • Preparation
  • Detection & Analysis
  • Containment, Eradication and Recovery
  • Post Incident Activity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cyber Kill Chain

A
  1. Recon
  2. Weaponisation
  3. Delivery
  4. Exploitation
  5. Installation
  6. Command & Control
  7. Action on Objectives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Diamond Model

A

This is an analysis framework
1. Adversary Develops Capability
2. Adversary Uses Infrastructure
3. Infrastructure Connects To Victim
4. Capability Exploits Victim and deployed via Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Managerial Control

A

Address security design and implementation through policies and SOP’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Operational Control

A

Implemented by People e.g. security guards and awareness programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Technical Control

A

Implemented using systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Physical Security

A

Deter - Deny - Detect - Delay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

DER Cert Format

A

Distinguished Encoding Rules
- Binary Format
- Common Format used in Java Certs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

PEM Cert Format

A

Privacy Enhanced Mail
- Base 64 encoded DER (ASCII)
- Format Provided by CA’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PKCS#12 Cert Format

A

Public Key Cryptography Standard #12
- Personal Information Exchange (PFX) syntax standard
- Often used in transfer of public and private key pairs
- p12 or pfx file ecxtension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CER Cert Format

A

Certificate
- Encoded as binary DER or ASCII PEM
- Common format for windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

PKCS#7 Cert Format

A
  • p7b file
  • ASCII format
  • Private keys not included in p7b file
  • Used in Windows and Java Tomcat
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Policy

A

Formal Statement produced & supported by management. The why

22
Q

Standard

A

Mandatory course of action or rules giving formal policies support or direction. The what

23
Q

Procedure

A

Step by the step instructions. The how

24
Q

Guidelines

A

Recommendation of what to do when standards do not exist. The when

25
Symmetric Algorithms
AES -DES - 3DES RC4 Blowfish - Twofish
26
Asymmetric Algorithms
RSA DSA - Digital Signature Algorithm Diffie-Hellman Ephemeral (DHE) ECDHE - Elliptic Curve DHE Elliptic Curve Cryptography (ECC) Pretty Good Privacy (PGP) GNU Privacy Gaurd (GPG)
27
Key Stretching
Bcrypt
28
CBC
Cipher Block Chaining - Depends on block before and therefore slow. Uses IV for randomisation
29
GCM
Galois Counter Mode - provides authentication/integrity and hashes
30
ECB
Electronic Code Book - simplest Cipher Each block is encrypted with the same key
31
CTR
Counter - Block cipher mode / acts like a stream cipher. Encrypts successive values of a “counter” - XOR
32
FERPA
Family Educational Rights and Privacy Act - requires that educational institutions implement security and privacy controls for student educational records
33
GLBA
Gramm-Leach-Bliley Act - focused on services of banks, lenders, and insurance severely limited services they could provide and the information they could share with each other
34
FISMA
Federal Information Security Management Act (FISMA) Required formal infosec operations for federal gov’t. Requires that government agencies include the activities of contractors in their security management programs.
35
HIPPA
Health Insurance Portability and Accountability Act
36
COPPA
Children’s Online Privacy Protection Act was designed to protect children under age 13
37
ECPA
Electronic Communications Privacy Act (ECPA) prohibits a third party from intercepting or disclosing communications without authorization
38
ISO 27001
Standards for an Information Security Management System (ISMS)
39
ISO 27002
Code of Practice for information security controls
40
ISO 27701
Privacy Information Management System (PIMS).
41
ISO 31000
Risk Management Framework
42
SSAE
Statements on Standards for Attestation Engagements (SSAE) SSAE 18 is an audit standard to enhance the quality and usefulness of System and Organization Control (SOC) reports.
43
CAC
Common Access Card
44
PIV
personal identity verification
45
CRL
Certificate revocation list (CRL) Contains information about any certificates that have been revoked by a subordinate CA due to compromises to the certificate or PKI hierarchy
46
OCSP
Online Certificate Status Protocol Offers a faster way to check a certificate’s status compared to downloading a CRL. With OCSP, the consumer of a certificate can submit a request to the issuing CA to obtain the status of a specific certificate.
47
CSR
Certificate signing request cords identifying information for a person or device that owns a private key as well as information on the corresponding public key.
48
Stapling
method used with OCSP, which allows a web server to provide information on the validity of its own certificate.
49
Pinning
method designed to mitigate the use of fraudulent certificates. Once a public key or certificate has been seen for a specific host, that key or certificate is pinned to the host
50
Tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle.
Chain of Custody

Sys-601 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions