Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec+ > Part 1 > Flashcards

Part 1 Flashcards

1
Q

CISSP domain Security and Risk Management?

A

Defining security goals and objectives, risk mitigation, compliance, business continuity, and the law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which CISSP Domain defines security goals and objectives, risk mitigation, compliance, business continuity, and the law.

A

Security and Risk Management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which area of CISSP does the following example belong in?

Security analysts may need to update company policies related to private health information if a change is made to a federal compliance regulation such as the Health Insurance Portability and Accountability Act, also known as HIPAA.

A

Security and Risk Management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CISSP domain Asset Security?

A

Securing digital and physical assets. Also related to the storage, maintenance, retention, and destruction of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which area of CISSP does the following example belong in?

An analyst is tasked with making sure that old equipment is properly disposed of and destroyed, including any type of confidential information.

A

Asset Security Domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which CISSP domain is involved in securing digital and physical assets. Also related to the storage, maintenance, retention, and destruction of data.

A

Asset Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CISSP domain Security architecture and engineering?

A

Focuses on optimizing data security by ensuring effective tools, systems, and process are in place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which CISSP domain focuses on optimizing data security by ensuring effective tools, systems, and process are in place.

A

Security Architecture and Engineering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which CISSP domain is the following an example of?

Configuring a firewall.

A

Security Architecture and Engineering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a firewall?

A

A device used to monitor and filter incoming and outgoing computer network traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A device used to monitor and filter incoming and outgoing computer network traffic.

A

Firewall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CISSP domain Communication and Network Security?

A

Focuses on managing and securing physical networks and wireless communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which CISSP domain focuses on managing and securing physical networks and wireless communications?

A

Communication and Network Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which CISSP domain is the following an example of?

Analyzing user behavior within your organization

A

Communication and Network Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CISSP domain Identity and Access Management?

A

Focuses on keeping data secure, by ensuring users follow established policies to control and manage physical assets, like office spaces, and logical assets, such as networks and applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

which CISSP domain focuses on keeping data secure, by ensuring users follow established policies to control and manage physical assets, like office spaces, and logical assets, such as networks and applications.

A

Identity and Access Management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which CISSP domain is the following and example of?

Setting up employees’ keycard access to buildings.

A

Identity and Access Management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CISSP domain Security Assessment and Testing?

A

Focuses on conducting security control testing, collecting and analyzing data, and conducting security audits to monitor for risks, threats, and vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which CISSP domain focuses on conducting security control testing, collecting and analyzing data, and conducting security audits to monitor for risks, threats, and vulnerabilities.

A

Security Assessment and Testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which CISSP domain is the following an example of?

Analyst who is asked to regularly audit permissions to ensure that no unauthorized person can view employee salaries.

A

Security Assessment and Testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CISSP domain security operations?

A

Focuses on conducting investigations and implementing preventative measures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CISSP domain that focuses on conducting investigations and implementing preventative measures.

A

Security Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which CISSP domain is the following an example of?

As an analyst, you receive an alert that an unknown device has been connected to your internal network. You would need to follow the organization’s policies and procedures to quickly stop the potential threat.

A

Security Operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

CISSP domain software development security?

A

Focuses on using secure coding practices, which are a set of recommended guidelines that are used to create secure applications and services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which CISSP domain focuses on using secure coding practices, which are a set of recommended guidelines that are used to create secure applications and services?

A

Software Development Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which CISSP domain is the following an example of?

If one of your partner teams is creating a new mobile app, then you may be asked to advise on the password policies or ensure that any user data is properly secured and managed.

A

Software Development Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Password attack?

Which domain do they fall under?

A

An attempt to access password-secured devices, systems, networks, or data.

Communication and network security domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Social Engineering Attack?

Which domain do they fall under?

A

A manipulation technique that exploits human error to gain private information, access, or valuables.

Security and Risk Management Domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Physical attack?

Which domain do they fall under?

A

Security incident that affects not only digital but also physical environments where the incident is deployed.

Asset Security Domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Adversarial Artificial Intelligence?

Which domain(s) does it fall under?

A

A technique that manipulates artificial intelligence and machine learning technology to conduct attacks more efficiently.

Communication and network security OR
Identity and access management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Supply-Chain Attack?

Which domain(s) do they fall under?

A

Targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed.

Security and Risk Management.
Security Architecture and Engineering.
Security Operations Domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Cryptographic Attack?

Which domain do they fall under?

A

Affects secure forms of communication between a sender and intended recipient.

Communication and Network Security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Advanced Persistent Threats (APTs)?

What are their typical intentions and motivations?

A

These attackers have significant expertise accessing an organization’s network without authorization.

Damaging critical infrastructure, such as the power grid and natural resources.

Gaining access to intellectual property, such as trade secrets or patents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Insider Threats?

What are their typical intentions and motivations?

A

These attackers abuse their authorized access to obtain data that may hard an organization.

Sabotage.
Corruption.
Espionage.
Unauthorized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

These attackers abuse their authorized access to obtain data that may hard an organization.

A

Insider threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

These attackers have significant expertise accessing an organization’s network without authorization.

A

Advanced Persistent Threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Hacktivists?

What are their typical intentions and motivations?

A

Threat actors that are driven by a political agenda.

Demonstrations.
Propaganda.
Social Change Campaigns.
Fame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Threat actors that are driven by a political agenda.

A

Hacktivists.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are the three main category of hackers?

A

Authorized (ethical hackers).

Semi-authorized hackers (researchers).

Unauthorized hackers (unethical hackers).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Authorized (ethical) hackers?

A

Follow a code of ethics and adhere to the law to conduct organizational risk evaluations. Motivated to safeguard people and organizations from malicious threat actors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Semi-authorized hackers (researchers)?

A

They search for vulnerabilities but don’t take advantage of the vulnerabilities they find.

42
Q

Unauthorized (unethical) hackers?

A

They are malicious threat actors who do not follow or respect the law. Their goal is to collect and sell confidential data for financial gain.

43
Q

Examples of security _____ include security and risk management and security architecture and engineering.

A

domains

44
Q

A security professional is asked to destroy and dispose of old hard drives that include confidential customer information. Which security domain is this task related to?

A

Asset Security

45
Q

Your supervisor asks you to audit user permissions for payroll data to ensure no unauthorized employees have access to it. Which security domain is this audit related to?

A

Security Assessment and Testing

46
Q

You are asked to investigate an alert related to an unknown device that is connected to the company’s internal network. After you complete your investigation, you follow company policies and procedures to implement preventative measures that will stop the potential threat posed by the device. Which security domain is this scenario related to?

A

Security Operations

47
Q

Business Email Compromise?

A

A type of phishing attack where a threat actor impersonates a known source to obtain financial advantage

48
Q

A type of phishing attack where a threat actor impersonates a known source to obtain financial advantage

A

Business Email Compromise

49
Q

CISSP?

A

Certified Information Systems Security Professional is a globally recognized and highly sought-after information security certification, awarded by the International Information Systems Security Certification Consortium

50
Q

Computer Virus?

A

Malicious code written to interfere with computer operations and cause damage to data and software

51
Q

Malicious code written to interfere with computer operations and cause damage to data and software

A

Computer Virus

52
Q

Cryptographic Attack

A

An attack that affects secure forms of communication between a sender and intended recipient

53
Q

An attack that affects secure forms of communication between a sender and intended recipient

A

Cryptographic Attack

54
Q

Malware

A

Software designed to harm devices or networks

55
Q

Phishing?

A

The use of digital communications to trick people into revealing sensitive data or deploying malicious software

56
Q

The use of digital communications to trick people into revealing sensitive data or deploying malicious software

A

Phishing

57
Q

Physical Attack

A

A security incident that affects not only digital but also physical environments where the incident is deployed

58
Q

A security incident that affects not only digital but also physical environments where the incident is deployed

A

Physical Attack

59
Q

Physical Social Engineering?

A

An attack in which a threat actor impersonates an employee, customer, or vendor to obtain unauthorized access to a physical location

60
Q

An attack in which a threat actor impersonates an employee, customer, or vendor to obtain unauthorized access to a physical location

A

Physical Social Engineering?

61
Q

Social Engineering?

A

A manipulation technique that exploits human error to gain private information, access, or valuables

62
Q

A manipulation technique that exploits human error to gain private information, access, or valuables

A

Social Engineering

63
Q

Social Media Phishing?

A

A type of attack where a threat actor collects detailed information about their target on social media sites before initiating the attack

64
Q

A type of attack where a threat actor collects detailed information about their target on social media sites before initiating the attack

A

Social Media Phishing.

65
Q

Spear Phishing?

A

A malicious email attack targeting a specific user or group of users, appearing to originate from a trusted source

66
Q

A malicious email attack targeting a specific user or group of users, appearing to originate from a trusted source

A

Spear Phishing.

67
Q

Supply-chain Attack?

A

An attack that targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed

68
Q

An attack that targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed

A

Supply-chain Attack.

69
Q

USB baiting?

A

An attack in which a threat actor strategically leaves a malware USB stick for an employee to find and install to unknowingly infect a network

70
Q

An attack in which a threat actor strategically leaves a malware USB stick for an employee to find and install to unknowingly infect a network

A

USB baiting.

71
Q

Vishing?

A

The exploitation of electronic voice communication to obtain sensitive information or to impersonate a known source

72
Q

The exploitation of electronic voice communication to obtain sensitive information or to impersonate a known source

A

Vishing.

73
Q

Watering Hole Attack?

A

A type of attack when a threat actor compromises a website frequently visited by a specific group of users

74
Q

A type of attack when a threat actor compromises a website frequently visited by a specific group of users

A

Watering Hole Attack.

75
Q

Worms and Viruses are examples of?

A

Malware

76
Q

The _____ spread globally within a couple of months due to users inserting a disk into their computers that was meant to track illegal copies of medical software.

A

Brain Virus

77
Q

Social engineering is a manipulation technique that exploits _____ error to gain access to private information.

A

Human

78
Q

Configuring a firewall and ensuring that effective systems and process are in place are examples of which domain?

A

Security Architecture and Engineering.

79
Q

Which domain involves conducting, collecting, and analyzing data, as well as conducting security audits to monitor for risks, threats, and vulnerabilities?

A

Security Assessment and Testing.

80
Q

A security professional is asked to issue a keycard to a new employee. Which domain does this scenario relate to?

A

Identity and Access Management

81
Q

Security Frameworks?

A

Guidelines used for building plans to help mitigate risks and threats to data and privacy.

82
Q

Guidelines used for building plans to help mitigate risks and threats to data and privacy.

A

Security Frameworks

83
Q

Security Lifecycle?

A

A constantly evolving set of policies and standards that define how an organization manages risks, follow established guidelines, and meets regulatory compliance, or laws.

84
Q

A constantly evolving set of policies and standards that define how an organization manages risks, follow established guidelines, and meets regulatory compliance, or laws.

A

Security Lifecycle

85
Q

The purpose of security frameworks include..

A

Protecting personally identifiable information, securing financial information, identifying security weaknesses, managing organizational risks, and aligning security with business goals.

86
Q

An organization may have a goal to align with the E.U.’s General Data Protection Regulation, also known as GDPR. GDPR is a data protection law established to grant European citizens more control over their personal data. A security analyst may be asked to identify and document areas where an organization is out of compliance with GDPR. Which framework is this an example of?

A

Identifying and documenting security goals.

87
Q

When implementing guidelines to achieve GDPR compliance, your organization may need to develop new policies for how to handle data requests from individual users. Which framework is this an example of?

A

Setting Guidelines to achieve security goals.

88
Q

In the case of GDPR, a security analyst working for a social media company may help design procedures to ensure the organization complies with verified user data requests. An example of this type of request is when a user attempts to update or delete their profile information. Which framework is this an example of?

A

Implementing strong security processes.

89
Q

You may monitor your organization’s internal network and report a potential security issue affecting GDPR to your manager or regulatory compliance officer. Which framework is this an example of?

A

Monitoring and communicating results.

90
Q

Security Controls?

A

Safeguards designed to reduce specific security risks.

91
Q

A foundational model that helps inform how organizations consider risk when setting up systems and security policies.

A

CIA Triad

92
Q

What does CIA triad stand for?

A

Confidentiality, Integrity, and Availability.

93
Q

What are the 4 types of Security Frameworks?

A

Identifying and documenting security goals.

Setting guidelines to achieve security goals.

Implementing strong security processes.

Monitoring and communicating results.

94
Q

The process of adhering to internal standards and external regulations?

A

Compliance.

95
Q

U.S.-based agency that develops multiple voluntary compliance frameworks that organizations worldwide can use to help manage risk. The more aligned an organization is with compliance, the lower the risk.

A

The National Institute of Standards and Technology (NIST)

96
Q

A regulation that applies to organizations that work with electricity or that are involved with the U.S. and North American power grid.

A

The Federal Energy Regulatory Commission - North American Electric Reliability Corporation (FERC-NERC)

97
Q

U.S. federal government program that standardizes security assessment, authorization, monitoring, and handling of cloud services and product offerings. Its purpose is to provide consistency across the government sector and third-party cloud providers.

A

The Federal Risk and Authorization Management Program (FedRAMP)

98
Q

Nonprofit with multiple areas of emphasis. It provides a set of controls that can be used to safeguard systems and networks against attacks. Its purpose is to help organizations establish a better plan of defense.

A

Center for Internet Security (CIS)

99
Q

European Union (E.U.) general data regulation that protects the processing of E.U. residents’ data and their right to privacy in and out of E.U. territory. For example, if an organization is not being transparent about the data they are holding about an E.U. citizen and why they are holding that data, this is an infringement that can result in a fine to the organization.

A

General Data Protection Regulation (GDPR)

100
Q

International security standard meant to ensure that organizations storing, accepting, processing, and transmitting credit card information do so in a secure environment. The objective of this compliance standard is to reduce credit card fraud.

A

Payment Card Industry Data Security Standard (PCI DSS)

101
Q
A

Sec+ (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions