Cissp Security Management Domain

Front 1

What are the three sides of the CIA Triad?

Back 1

Confidentiality, Integrity, Availability

Front 2

When a threat agent exploits a vulnerability.

Back 2

Exposure

Front 3

A control used to mitigate potential losses.

Back 3

Countermeasure.

Front 4

Weakness in a mechanism that can threaten an asset.

Back 4

Vulnerability

Front 5

Lack of a countermeasure.

Back 5

Vulnerability

Front 6

Someone or something that uncovers a vulnerability and exploits it.

Back 6

Threat Agent

Front 7

Possibility of a threat occurring.

Back 7

Risk

Front 8

Long-Term, High-Level management instructions on how the organization is to be run.

Back 8

Policies

Front 9

Administrative controls that reflect an organization's goals and objectives and target a broad audience.

Back 9

Policies

Front 10

Administrative controls that define a process or rules to be used to support a policy.

Back 10

Standards

Front 11

Administrative controls that are specific instructions on performing targeted tasks.

Back 11

Procedures

Front 12

Concept of layered approach to security with loosest controls on the outside and hardest controls at the center.

Back 12

Defense in-depth

Front 13

What does ISO 27002/ISO 1799 cover.

Back 13

A code of practice with guidelines for information security.

Front 14

Military Classification Levels

Back 14

Top Secret
Secret
Confidential
Sensitive but unclassified
Unclassified

Front 15

Common Commercial Classification Levels

Back 15

Confidential
Private
Sensitive
For Internal Use Only
Public

Front 16

The process of proper investigation such as an examination of controls and policies concerning an asset.

Back 16

Due Diligence

Front 17

The conduct that a reasonable person will exercise in a particular situation.

Back 17

Due Care

Front 18

ALE

Back 18

Annual Loss Expectancy

Front 19

EAC

Back 19

Estimated Annual Cost

Front 20

This type of risk analysis utilizes the values of ALE and from risks and ranks them based on potential loss to the owner.

Back 20

Quantitative Risk Analysis

Front 21

This type of risk analysis often utilizes estimated potential and delayed losses.

Back 21

Qualitative Risk Analysis

Front 22

This type of qualitative risk analysis heavily relies on interviews with subject matter experts.

Back 22

Delphi Method

Front 23

Calculate the Single Loss Expectancy (SLE)

Back 23

Asset Value x Exposure Factor = SLE

Front 24

Calculate the Annualized Loss Expectancy (ALE)

Back 24

SLE x Annualized Loss Expectancy (ALO) = ALE

Front 25

The amount of risk after a safeguard is put into place.

Back 25

Residual Risk

Front 26

What is a good reason for the use of an automated risk analysis tool?

Back 26

Information gathering would be minimized and expedited due to the amount of information built into the tool.

Front 27

Which element of the CIA Traid ensures that resources are used only for intended purposes?

Back 27

Availability

Front 28

According to private sector data classification levels, how would salary levels and medical information be classified?

Back 28

Private

Front 29

Logical Controls are also known as?

Back 29

Technical Controls

Front 30

What type of Controls are most applicable to personnel security?

Back 30

Operational Controls