Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Security Operations > Flashcards

Security Operations Flashcards

(73 cards)

Start Studying
1
Q

Planning

A

security should be consider prior to development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Provisioning

A

prep for deployment and instantiating user, system, or service
Security baseline and configuration management key principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Baseline configuration

A

need well-vetted hardened baseline configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Building baseline configuration

A

don’t start from scratch
Determine reasonable starting point
establish consistent configuration across the majority of the systems
Reduce time to recover a deployed system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Infrastructure as a Service (IAAS)
Platform as a Service (PAAS)
Software as a Service (SAAS)

A

Root access
Web Service
Gmail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cloud Server (Provisioning)

A

Vuln - weakness present in preconfigured image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Types of Firewall

A

Packet Filter
Stateful
Proxy
Next Generation Firewalls (NGFW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Packet filtering firewall

A

examines each packet independently
No idea where packet came from
fast, not secure.
ACL on some devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Firewall: Stateful

A

Slower

Lookup table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Proxy Firewall

A

2 TCP connection for each request, client & server

In between, inspect, process packets at all seven layers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Firewall: Circuit Level

A

Operates at session layer
does not use application level proxy software
SOCKS - replaces network connection with socks call

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Firewall: Application Level

A

Proxy server software/Layer 7

Act as in between, moves packet from one network to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Firewall: Next Generation Firewall (NGFW)

A

packet inspection beyond ports/protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Bastion Host

A

Host that is outside the firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Firewall: Host-Based

A

e.g Windows Firewall/McAfee, etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Intrusion Prevention Systems (IPS)

A

False positive on IPS cause outages
IDS - passive
IPS - active - think pen test so that why it will stop can cause outage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Malware Detonating Devices (MDD)

Sandboxin

A

Isolate and try to see what would happen

Basically isolated denotation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sandboxing Capabilities

A

Malware checks to see if it is connected to internet before it detonates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IDS

A

Sniff traffics/sniffer with rules
Passive - sent alert (Does not stop attack)
Active - stop attack (sending resets)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q 
IDS
True Positive
True Negative
False Positive
False Negative
A

True Positive - real attack
True Negative - normal traffic
False Positive - sets off alert and normal traffic
False Negative - does not set off alert and it is attack traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Signature Matching

A

Detect pattern/detects on existing patterns

Will not detect on new patterns, polymorphic malware, or encrypted traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Protocol Behavior

A

detects protocol, syn, syn-ack, ack

False positives on complex/non-standard protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Honeypot

A

designed to be hacked into/public facing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Security Information and Event Management (SIEM)

A

Devices to view logs for events that are triggered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Audit Logs
Process: must be reviewed
26
Audit Trails
Individual conducting Transactions Date Time Location(workstation)
27
Preparing Incidents
Critical decisions must be made before it happens: pursue legal actions what actions are authorized to be taken Understand root cause or reimage/revert Allowed to attack attackers to persist gain intelligence templates needs to be built for data gathering
28
Security Incidents: External Attacker
attacking back is a bad idea | IP is a pivot point so might not be the actual attacker IP
29
Security Incidents: External Attacker Logs
Attackers will erase their tracks | Look for all systems that might have been connected to all offending IP addresses
30
Security Incidents: Incident Handling
``` Preparation Detection (Identification) Response (Containment) Mitigation (Eradication) Reporting Recovery Remediation Lessons learned ```
31
Security Incidents: Detection
Do not jump to conclusion Notify the correct people use help desk to track trouble tickets and problem Need primary handler
32
SMART Guidelines
``` Specific Measurable Achievable Realistic Timely ```
33
Security Incidents: Response
Incident handler should not make things worse Secure the area Make a forensic backup Pull system off the network
34
Security Incidents: Mitigation
``` Fix system before putting it back online Determine cause & symptoms Improve defense Perform vuln analysis Analogy (Car accident): Response - EMT stability patient Mitigation - Doctor heal patient ```
35
Security Incidents: Reporting
Occurs through all phases Need technical & Non-technical reporting Common mistake: focus on technical report only Reporting less formal during incident and more formal as it approaches being handled and recovered
36
Security Incidents: Recovery
Do not restore compromised code validate system monitor: make sure the attacker does not come back in
37
Security Incidents: Remediation
Occurs in phases Short term - change pw of affected users/patching affect systems Long term - reconfig systems to use dual factor auth improve org patching process
38
Security Incidents: Lesson Learned
conduct lessons-learned meeting send recommendations to management (ask for money, resources, etc..) Conduct follow up meeting
39
Forensic Investigation
Thorough and detailed analysis greater expectation that legal system could be involved presumes a violation might have been committed
40
Incident Response
immediate limiting of averting operation impact
41
Types of evidence
Direct - first hand witness Circumstantial - testimony from first hand witness of circumstances related to the legal matter Expert - opinion/interpretation from expert
42
Hearsay
second hard, rather than direct Business records - 2nd hand Disk/memory are not treated as hearsay
43
Chain of custody
integrity & authenticity Document time, location, & manner of collection specify individual responsible for control of evidence Employ tamper resistance/evidence storage Attestation Ensure chain of evidence control can be reviewed
44
EDiscovery
All data gets handed over, NO EXCEPTION
45
RAID 0
double of in size (stripe) - write on disk A, then disk B and so on and so on No redundancy
46
RAID 1
Mirroring
47
RAID 2
Needs 39 disk (32 disk for data, 7 for error recovery)
48
RAID 3/4
RAID 3- byte level RAID 4- block level dedicated parity drive
49
RAID 5
Block level Striping of data across disk Parity information striped across disk
50
RAID 6
Like RAID 5, block level | Double the parity
51
Electronic vaulting
batch processing | send data to remote server
52
Remoting Journaling
transmitting data in real time to backup storage | think of SQL trans log
53
Database Shadowing
same as remote journaling | storing duplicate data on multiple remote storage devices
54
Disk duplexing
disk controller is duplicated
55
Backup Concept: Full Backup
Full backup
56
Backup Concept: Incremental Backup
backup files that have been created/modified since last backup Set archive bit to 0 Changes from the previous day need a lot of tape to restore
57
Backup Concept: Differential Backup
backup files that have been created/modified since last backup does not set archive bit to 0 Only need last full backup and the differential tape Backup only changes from Sunday to the previous day, not day to day comparison
58
Business Continuity Plan (BCP)
business remain viable even in the face of disaster | NIST SP800-34 REV1
59
Continuity of Operations (COOP)
Subset of BCP | recover critical functions rapidly
60
Disaster Recovery Plan (DRP)
detailed steps to restore critical information and systems | BRP long term, DRP short term
61
Recovery Time Objective (RTO)
measure of when the system will be back online
62
Work Recovery Time (WRT)
length of time after hardware/software restored to when normal operations are able to resume
63
Maximum Tolerable Downtime
MTD = Recovery Time Objective (RTO) x Work Recovery Time (WRT)
64
Recovery Point Objective
amount of data that be lost for a critical function
65
Site Recovery Strategies
Self-Service - handle disruption within current facilities Reciprocal Agreement - agreement with another entity to help one another during disruption Alternate Sites: Hot, warm, cold, hybrid, mobile
66
Alternate Sites
Hot - fully equipped and staffed Warm - pre-equip but not ready to go Cold - empty facility Hybrid - combination of hot/cold/warm - Hot/Cold - Immediate failover/long-term disaster use cold site Mobile- think of office on wheels Multiple processing site - mirror location, different locations - think mirror
67
Read-Through, checklist, consistency testing
reviewing plan to ensure all areas are covered
68
Structural Walk through
step through plans looking for errors or false assumptions
69
Simulation/Tabletop
test with mock up scenarios
70
Parallel
recover to alternate site while main site is running
71
Full Interruption
full fail over to alternate site
72
Training (BCP)
how to operate alternate site how to start emergency power how to perform a restorative backup
73
Physical security & safety
``` Safety #1 In event of disaster Personnel safety Authorized access Equipment protection Information protection Availability ```

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions