Candi's Cissp Domain 7

Front 1

What is it called when you grant access only for what is needed to perform the task?

Back 1

Need to Know

Front 2

What is it called when privileges are granted necessary to perform the task and no more?

Back 2

Least Privilege

Front 3

What is the amount of privilege granted?

Back 3

Entitlement

Front 4

What is the amount of privileges collected over time?

Back 4

Aggregation

Front 5

What extends a trust relationship between two security domains to all of their sub domains?

Back 5

Transitive Trust

Front 6

True or False. Nontransitive trust enforces the principle of least privilege.

Back 6

True

Front 7

What establishes granular rights across apps and processes and uses least privilege to separate responsibilties?

Back 7

Separation of privileges

Front 8

What is applying least privilege to separation of duties to prevent fraud?

Back 8

Segregation of duties

Front 9

What should be the default level of access?

Back 9

No access

Front 10

What is an agreement between 2 parties to abide by agreed upon rules when transmitting sensitive data back and forth?

Back 10

Interconnection Security Agreement

Front 11

What is a button that sends a distress call?

Back 11

Duress system

Front 12

What runs as guest OS's on physical servers?

Back 12

VMs

Front 13

What manages the VM environment?

Back 13

Hypervisor

Front 14

What should you do with reusable media that has hit its MTTF (mean time to failure)?

Back 14

Destroy it

Front 15

What are these characteristics of? Broad network access; rapid elasticity; measured service; on-demand self-service.

Back 15

Cloud computing

Front 16

What is a new class of tools that can detect access to, and usage of, cloud-based services?

Back 16

CASB (Cloud Access Security Brokers)

Front 17

What ensures systems are deployed in a consistent state and maintain that state throughout its lifetime?

Back 17

Configuration management

Front 18

True or False. The primary goal of change management is to ensure that changes do not cause outages (availability).

Back 18

True

Front 19

Usability and security often conflict. What ensures you take the time to evaluate the trade offs?

Back 19

Change management

Front 20

What is the change management process?

Back 20

Request > Review > Approve/Reject > Implement > Document

Front 21

What is patch Tuesday and exploit Wednesday?

Back 21

Attackers expect patching delays, so they reverse engineer the patch released on Tuesday and start attacking on Wednesday. (MSFT releases patches every Tuesday)

Front 22

What is the most common vulnerability in a company?

Back 22

Unpatched systems

Front 23

What is the primary goal of incident response?

Back 23

Minimize impact

Front 24

Who are typically the first responders to a security incident in an organization?

Back 24

IT

Front 25

What is an indirect attack where traffic or networks are reflected back to a system from other sources?

Back 25

DRDoS Distributed Reflective Denial of Service

Front 26

What common DoS attack disrupts the 3 way communication handshake? Sends many SYN's without ever sending ACK.

Back 26

SYN Flood Attack

Front 27

What attack is it where attackers send echo requests as broadcast to all systems on the network while spoofing the source? They all respond to the victim at once. You can prevent this by setting routers not to broadcast.

Back 27

Smurf Attack

Front 28

What attack floods a victim with ping requests (thousands of systems simultaneously ping a system via botnets). Block with IDS that can block ICMP (internet control message protocol) traffic.

Back 28

Ping Flood Attack

Front 29

What are computers (aka zombies) that act like robots that do what the attacker tells them to do.

Back 29

Botnets

Front 30

True or False. Computers join botnets after being infected. Block them with up to date anti malware and patched systems along with updated browsers and their plug-ins.

Back 30

True

Front 31

What famous botnet attack was used to collect credentials to financial systems? It distributed the CryptoLocker ransomware and infected up to 1 million systems. Operation Tovar (an international law enforcement team) cut off its communication, but it's growing again.

Back 31

Gameover Zues (GOZ)

Front 32

What attack changes the normal 32 or 64 bytes ping packets to something larger causing a system crash or buffer overflow? Is easily blocked with up to date patches.

Back 32

Ping of Death attack

Front 33

What attack fragments traffic to render it unreadable (system can't put it back together again)?

Back 33

Teardrop attack

Front 34

What attack sends spoofed SYN packets using the victims IP address as both source and destination tricking the system to constantly reply to itself?

Back 34

Land attack

Front 35

What is the most common form of security breach today?

Back 35

Malware (aka malicious sw, malcode, etc)

Front 36

True or False. Years ago, floppy disks were most common means of distributing malware. Then it was email. Now it is drive by download.

Back 36

True

Front 37

What is using a modem to find a system that accepts inbound connections?

Back 37

War dialing

Front 38

What is a malicious act of gathering proprietary info about an organization?

Back 38

Espionage

Front 39

What is the difference between an IDS (intrusion detection system) and an IPS (intrusion prevention system)?

Back 39

IDS detects intrusions by looking at logs & real-time events and IPS does IDS & stops/prevents the intrusion. IDS is not placed in line with traffic, IPS is.

Front 40

What kind of intrusion detection uses signatures (db of known attacks)?

Back 40

Knowledge-based detection

Front 41

What kind of intrusion detection compares activity against a baseline of normal performance? (Has a high amount of false alarms)

Back 41

Behavior-based detection

Front 42

What are IDS's 2 response options?

Back 42

1. Passive response (log event and send notification)

2. Active response (changes environment to block the activity as well as log and send notifications)

Front 43

What IDS monitors a single computer, but is costly to manage and can't always tell if an attack was successful?

Back 43

Host-based IDS (HIDS)

Front 44

What IDS monitors a network, but cannot monitor encrypted traffic?

Back 44

Network-based IDS (NIDS)

Front 45

What is the portion of IP addresses on a network called that are not used; require special SW or authorization to access and uses non-standard protocols?

Back 45

Darknet

Front 46

What are computers created as a trap for intruders called?

Back 46

Honeypots

Front 47

What are 2 or more networked honeypots called? (Used to simulate a network)

Back 47

Honeynet

Front 48

True or False. The goal of honeypots/nets is to attract the attention of attackers away from the real data. You can entice, but not entrap (solicit attackers to it).

Back 48

True

Front 49

What is similar to the honeypot, but performs intrusion isolation by transferring the intruder to a simulated environment?

Back 49

Padded Cell

Front 50

What is another name for pen testing?

Back 50

Ethical hacking

Front 51

What type of logs record what sites users visit and how much time they spent there?

Back 51

Proxy logs

Front 52

What is a central application that automatically monitors systems on a network and logs events?

Back 52

SIEM (Security Information and Event Mgmnt)

Front 53

What is monitoring outgoing traffic to prevent data exfiltration called?

Back 53

Egress monitoring

Front 54

What solution detects and blocks data exfiltration?

Back 54

DLP (Data Loss Prevention)

Front 55

What DLP scans all outgoing data on the network looking for specific data?

Back 55

Network-based DLP

Front 56

What DLP scans files stored on a system?

Back 56

Endpoint-based DLP

Front 57

What type of security control is an audit trail, Detective or Administrative?

Back 57

Detective

Front 58

True or False. The goal of disaster recovery planning is to restore normal business activity. Your DRP should be able to almost run on autopilot with minimal decisions needing made during a disaster.

Back 58

True

Front 59

What is the goal of system resilience and fault tolerance?

Back 59

Eliminate single points of failure

Front 60

What is the difference between Read-through and Walk-through DRP testing?

Back 60

Read-through is where an individual reviews the DRP documents. Walk-through is where several folks gather and go through it

Front 61

What DRP testing is where all designated disaster recovery personnel go through the motions as if it were a real recovery?

Back 61

Simulation test

Front 62

What is the assurance that a system is secure after a failure?

Back 62

Trusted recovery

Front 63

What is the difference between fail open and fail secure?

Back 63

System fails in an insecure state with fail open (all access is open). It fails in a secure state with fail secure. (Your choice depends on whether security or availability is most important)

Front 64

When you configure the system to reboot from a failure into a single user, non-privileged state, what are you implementing?

Back 64

A Trusted Solution

Front 65

What type of recovery does not fail in a secure state? Instead, an admin manually resets the system to a secure state.

Back 65

Manual recovery

Front 66

What type of recovery is where the system restores itself to a trusted state?

Back 66

Automated recovery

Front 67

What type of recovery is where the system restores itself to a trusted state and restores data or verifies key system components?

Back 67

Automated recovery without undue loss

Front 68

What type of recovery is where the system automatically recovers specific functions (e.g. roll back to last known secure state)?

Back 68

Function recovery

Front 69

What should you use to help you identify how much of a business unit/business function to recover 1st, 2nd and so on in a disaster?

Back 69

Business Impact Assessment (BIA) report

Front 70

What are standby facilities to keep the business running during a disaster manually? No computing is pre-installed. Takes weeks to activate, but is the cheapest option.

Back 70

Cold sites (redundant fail over recovery site)

Front 71

What disaster recovery site contains data links and equipment; takes ~12 hours to activate as you transport backup media to the site and get operations going again?

Back 71

Warm site

Front 72

What disaster recovery site is most expensive as it fully replicates your business? Takes 1-2 hours to activate.

Back 72

Hot site

Front 73

What are self-contained trailers set up to keep a specific business function operating? Can be set up as 'fly away' so they are ready to deploy at any location. Are usually configured as cold or warm sites.

Back 73

Mobile sites

Front 74

What is it when 2 companies pledge availability to the other in case of emergency?

Back 74

Reciprocal site

Front 75

In db recovery, what is it where db backups are moved to a remote site using bulk transfers (can result in significant delay when recovering)?

Back 75

Electronic vaulting

Front 76

In db recovery, what is it where you perform bulk data transaction transfers on a more frequent basis than electronic vaulting?

Back 76

Remote journaling

Front 77

In db recovery, what is the most advanced and expensive option where a live db is maintained real time at the back up site?

Back 77

Remote mirroring

Front 78

True or False. You should put the most essential task (e.g. activate the building alarm) first on the disaster recovery plan checklist.

Back 78

True

Front 79

What is the most important tool in the disaster recovery plan?

Back 79

The checklist. Because it provides a sense of order which is needed in a chaotic scenario.

Front 80

What document do you give to public relations and others needing a high level summary of your disaster recovery efforts while they are underway?

Back 80

Executive Summary

Front 81

What backup type is a complete copy of data? It resets the archive setting.

Back 81

Full backup

Front 82

What backup type stores only files that have been modified since the last incremental or full backup? It resets the archive setting.

Back 82

Incremental backup

Front 83

What backup type stores only files that have been modified since the last full backup? Does not reset the archive setting.

Back 83

Differential backup

Front 84

What is the quickest way to create a backups?

Back 84

Combine full and incremental backups

Front 85

What provides the quickest restoration time?

Back 85

Combine full backup with differential backups

Front 86

What is the biggest obstacle when it comes to abiding by a back up strategy?

Back 86

Human nature

Front 87

What is the difference between recovery and restoration?

Back 87

Recovery is bringing the business operation back to a working state. Restoration is bringing the facility and environment back to a working state.

Front 88

What investigation type's scope is computing infrastructure and its goal is resolving operational issues like performance? You use root cause analysis here.

Back 88

Operational investigation

Front 89

What investigation type's scope is violation of criminal law and is usually conducted by law enforcement? Must meet beyond a reasonable doubt

Back 89

Criminal investigation

Front 90

What investigation type's scope is disputes between 2 parties and is conducted by employees or a 3rd party on behalf of a legal team? Must meet preponderance of evidence... meaning, more likely than not

Back 90

Civil investigation

Front 91

What investigation type's scope is individual or corporate violations of administrative law and is conducted by the government?

Back 91

Regulatory investigation

Front 92

What are the 9 steps of the Electronic Discovery Reference Model (steps for conducting eDiscovery)

Back 92

1. Information Governance

2. Identification

3. Preservation

4. Collection

5. Processing (rough cut)

6. Review

7. Analysis (deeper review)

8. Production

9. Presentation

Front 93

What kind of evidence must be relevant, material (applicable), and competent (obtained legally)?

Back 93

Admissible evidence

Front 94

What type of evidence is physical evidence? Can also be conclusive evidence, such as DNA. Must be authenticated.

Back 94

Real (Object) evidence

Front 95

What is evidence that has been reproduced from an original? A copy of an original documentation, as an example.

Back 95

Secondary evidence

Front 96

What evidence rule says 'use the original document'?

Back 96

Best evidence rule

Front 97

What evidence rule is it where the document contains all of the agreement, no verbal agreements can modify it?

Back 97

Parol evidence rule

Front 98

What type of evidence is written? Has to be relevant, competent, material, and meet Best evidence & Parol rules.

Back 98

Documentary evidence

Front 99

When an object cannot be authenticated, this documents everyone who handled the evidence.

Back 99

Chain of evidence (custody)

Front 100

What type of evidence is testimony of a witness (must not be hearsay)?

Back 100

Testimonial evidence

Front 101

What should you do when working with digital evidence?

Back 101

Use a copy to keep the original in original condition.

Front 102

What are the 6 principles for collecting forensically recovered electronic evidence created by IOCE (International Organization on Computer Evidence)?

Back 102

1. Use all general forensic principles to it

2. Do not change it

3. Only trained personnel access it

4. Document the activity of collecting and processing it

5. Whom has possession of it is responsible for it

6. Agencies involved must comply with these principles

Front 103

What category of computer crime is seeking secret and restricted information from law enforcement or military?

Back 103

Military and Intelligence attacks

Front 104

What category of computer crime is seeking organizations confidential information (industrial espionage)?

Back 104

Business attacks

Front 105

What category of computer crime is seeking money or services from anyone?

Back 105

Financial attacks

Front 106

What category of computer crime is seeking to disrupt normal life and instill fear?

Back 106

Terrorist attacks

Front 107

What category of computer crime is seeking to disrupt a corporation or a person?

Back 107

Grudge attacks

Front 108

What category of computer crime is seeking fun (hactivist)?

Back 108

Thrill attacks

Front 109

What is the most common reason incidents are not reported?

Back 109

They are not identified.

Front 110

What are the 4 primary / high level responsibilities of a CIRT (computer incident response team) / CSIRT (computer security incident response team)?

Back 110

1. Determine scope of damage

2. Determine if confidential data was compromised

3. Implement recovery procedures

4. Make sure it can't happen again

Front 111

What are the 3 steps in the incident response process?

Back 111

1. Detect and identify (inform appropriate personnel)

2. Respond and report (to mgmnt)

3. Recover and remediate (lessons learned)

Front 112

How many primary categories do business disasters, that cause critical outages, generally fall into?

Back 112

3. Humans, elements and physical surroundings

Front 113

Is Exposure Factor considered subjective or objective?

Back 113

Subjective.

EF is based on theorized analysis and data believed to be applicable.

Front 114

What risk assessment deals with straight mathematical evaluations?

Back 114

Quantitative.

There are 3 approaches to risk assessment, quantitative, qualitative and semi-quantitative

Front 115

What type of evidence doesn't allow evidence of prior oral agreements that occurred before or while the agreement was being formed?

Back 115

Parol evidence

Front 116

What is a loophole deliberately implanted as a trap for intruders?

Back 116

Pseudoflaw

Front 117

What investigative device intercepts and modifies or discards commands sent to a storage device?

Back 117

Forensic disk controller

Front 118

Which is more formal, SLA or OLA?

Back 118

SLA is a contract between a service provider and a customer while OLA is an agreement between operation groups in an organization.

Front 119

What is the key difference between remote journaling and electronic vaulting?

Back 119

Remote journaling sends transactions to a remote site frequently while electronic vaulting sends full db of data to a remote site less frequently.

Front 120

What DoS attack sends a large amount of spoofed UDP traffic?

Back 120

Fraggle attack

Front 121

What separates the control plane from the data plane in virtual and non-virtual environments?

Back 121

SDN. Software defined networking

Front 122

What contains an entry for every network communication session and can be used to compare to a list of known malicious hosts?

Back 122

Netflow records

Front 123

Is a hacking incident considered a disaster when performing disaster recovery planning?

Back 123

Yes

Front 124

Would you expect a member of senior management to be part of a CSIRT?

Back 124

Yes

Front 125

What describes the default set of privileges assigned to a user when a new account is created, baseline or entitlement?

Back 125

Entitlement

Front 126

What is the difference between steganography and watermarking?

Back 126

Steganography is used to hide information in a file, like a picture. Watermarking also manipulates a picture but does so to protect intellectual property, such as a logo. Can be visible or invisible.

Front 127

During which phase do administrators take action to limit the effect or scope of an incident, Response or Mitigation?

Back 127

Mitigation, because that is the phase where action is taken to contain damage.

Front 128

2 methods for choosing records from a large set, sampling and clipping. Which one uses thresholds to select records and which one uses statistical techniques?

Back 128

Sampling uses statistical techniques and Clipping uses thresholds

Front 129

True or False. In IaaS, the vendor is responsible for the HW and network?

Back 129

True. You would still be responsible for patching systems on your virtual systems.

Front 130

What is the only sw license that has no restrictions? You can copy, modify and resell it.

Back 130

Public domain.

Open source has some restrictions