Cissp Security Operations

Front 1

Disgruntled employee

Back 1

Assuming of working ideas is in place this group is best capable of stealing sensitive information due to the absence of system auditing.

Front 2

Trusted paths

Back 2

Provides controlled and un-intercepted interfaces into privileged user functions. Intended to provide a way to ensure that any communications over that path cannot be intercepted or corrupted.

Front 3

Ring protection

Back 3

Can be used to enforce boundary control between kernel functions and end user controls.

Front 4

Anti-Malware

Back 4

Used to protect against malicious software.

Front 5

Maintenance hooks

Back 5

Coding constructs written by software developers for troubleshooting an impersonation purposes but can be potential back door for malicious software.

Front 6

An example of fail safe

Back 6

The doors of the datacenter spring open in the event of a fire. Focuses on failing with a minimum of harm to personnel.

Front 7

An example of fail secure

Back 7

Doors of the marketing closets lock in the event of a fire. Focuses on failing in a controlled manner to block access while the system is in an inconsistent state.

Front 8

RAID

Back 8

Redundant array of independent disks. A data mirroring technique.

Front 9

RAID 0

Back 9

Write files in stripes across multiple disks without the use of parity information. Allows for fast reading and writing to disk because all the disks can be accessed in parallel. Does not provide redundancy and should not be used for systems with high availability requirements. Suitable in scenarios where resilience is not required. For example to store temporary data that will only be required for a short period of time.

Front 10

RAID 1

Back 10

Duplicates all disk writes from one disk to another to create two identical drives. Also known as data mirroring. Redundancy is provided at this level when one hard drive fails the other is still available. Is very costly from a drive space perspective because half of the available disk is given to the mirroring and is typically only used between pairs of drives. Commonly used to provide redundancy for system disks where the core operating system files are found.

Front 11

RAID 2

Back 11

Theoretical and not used in practice. Data is spread across multiple discs at the bit level using this technique. Redundancy information is computed using a Hammering error correction code, which is the same technique used within hard drive and error-correcting memory modules. Due to the complexity involved with this technique it is not used.

Front 12

RAID 3&4

Back 12

Requires three or more drives to implement. Parity information is written to a dedicated disk if one of the data disk fails, then the information on the parity disk may be used to reconstruct the drive. Data is striped across multiple disks at the byte level for RAID 3 and at the block level for RAID 4. 3 is more efficient but 4 is faster.

Front 13

RAID 5

Back 13

Requires 3 or more drives. Data and parity information are striped across all drives. Most common for general data storage.

Front 14

RAID 6

Back 14

Requires three or more drives to implement and computes two sets of parity information. The dual parity distribution accommodates the failure of two drives. Performance is slightly less than RAID 5. Not as frequently used in commercial environments.

Front 15

RAID 0+1 and RAID 1+0

Back 15

Nested RAID levels, combining two different RAID types together to try to get the advantages of both. In RAID 0+1 two different arays of disks are at play. One set stripes all of the data across the available drives and the drives are mirrored to a second set of disks. RAID 1+0 each drive in the first set is mirrored to a matching drive in the second set. When data is striped to one drive, it is immediately striped to another.RAID 1+0 is considered to be superior to RAID 0+1 in all respects, both in terms of speed and redundancy.

Front 16

Shadowing

Back 16

Updating records in multiple locations or copying an entire database on to a remote location as a means to ensure the appropriate levels of fault tolerance and redundancy.

Front 17

Archiving

Back 17

The storage of data that is not in continual use for historic purposes.

Front 18

Backup method used when the window is not long enough to backup all of the data and restoration of backup must be as fast as possible.

Back 18

Differential - full backup is not available as window is not long enough. Banker mental backup only gets files that changed since the last incremental backup. And differential backup or leg its files that changed since the last full backup. To restore from incremental backups the last bowl back of the end all of the incremental backups performed are combined. In contrast, restoring from a differential backup requires only the last full backup and the latest differential.

Front 19

Is an example of least privilege in physical security

Back 19

A guard verifying identification cards against a list of authorized visitors.

Front 20

Background investigations

Back 20

Provides the best determination of access and suitability of an individual.

Front 21

Clipping level

Back 21

Used to ensure the only needed logs are collected.

Front 22

Difference between security event information system SEIM and log management system

Back 22

SEIM are useful for log collection, collation, and analysis in real time. Log management is similar but more for historic purposes.

Front 23

Best way to ensure no data remanence of sensitive information stored on DVD - R

Back 23

Destruction - optical media such as CDs and DVDs must be physically destroyed to make sure that there is no residual data that can be disclosed.

Front 24

Problem management

Back 24

Concerned with tracking that event back to a root cause and addressing the underlying problem

Front 25

Ensure production systems are backed up

Back 25

Before applying a software update to production systems it is most important

Front 26

Computer forensics

Back 26

The marriage between computer science, information technology, and engineering with law.

Front 27

Locard's principle of exchange

Back 27

States that when a crime is committed the perpetrators leave something behind and take something with them, hence the exchange. Works even with a purely digital crime scene.

Front 28

5 rules of evidence

Back 28

Must be authentic, be accurate, be complete, be convincing, be admissible.

Front 29

Incident response phases

Back 29

Triage

Investigation

Containment

Analysis and tracking

Documentation

Front 30

Civil law

Back 30

Emphasizes the abstract concepts of law and is influenced by writings of legal scholars and academics, more so than common law systems.

Front 31

MOM

Back 31

Means, opportunity and motive

Front 32

Various computer forensic guidelines

Back 32

IOCE- international organization of computer evidence

SWEDGE- scientific Working Group on digital evidence

ACPO- Association of Chief Police Officers

Front 33

Sub-phases of the incident response triage phase

Back 33

Detection, identification, notification

Front 34

Integrity of forensic bit stream image is determined by

Back 34

Comparing hash totals to the original source

Front 35

When dealing with digital evidence, the crime scene

Back 35

Must have the least amount of contamination that is possible.

Front 36

When outsourcing IT systems

Back 36

All regulatory and compliance requirements must be passed on to the provider.

Front 37

With digital evidence, the chain of custody must

Back 37

Followe formal documented process

Front 38

An incident response program must

Back 38

Treat every incident as though it may be a crime

Front 39

For heavily damaged media

Back 39

Professional data recovery services are the best chance for recovery

Front 40

To fully complete of vulnerability assessment it is critical that protection systems are well understood through,

Back 40

Threat identification, threat definition and facility characterization

Front 41

Defense in depth

Back 41

Forming layers of protection around an asset or facility

Front 42

Successful physical protection systems integrate

Back 42

People, procedures, and equipment

Front 43

5 fc

Back 43

Advised lighting for parking lots or garages for safety considerations in perimeter areas

Front 44

Acoustic / shock glass break sensors

Back 44

Most appropriate interior sensor used for a building that has windows along the ground floor. The dual alarm system requires both acoustic and shock sensors to be activated before an alarm is triggered, reducing false alarms.

Front 45

Three separate functions of CCTV

Back 45

Surveillance, deterrence, and evidentiary archives

Front 46

Tamper protection

Back 46

Best method of protecting the physical devices associated with the alarm system

Front 47

Direct evidence

Back 47

Proves or disproves a specific act through oral testimony based on information gathered through the witnesses five senses.

Front 48

Circumstantial evidence

Back 48

Evidence that relies on inference to connect it to a conclusion of fact - like fingerprint at the scene of a crime.

Front 49

Conclusive evidence

Back 49

Evidence that is either unquestionable because it is so clear and convincing or because the law precludes it's contradiction.

Front 50

Corroborating evidence

Back 50

Evidence that tends to support a proposition that is already supported by some initial evidence, therefore confirming the proposition.