Candi's Cissp Domain 1

Front 1

What does CIA stand for?

Back 1

confidentiality, integrity, availability

Front 2

What does AAA stand for?

Back 2

authentication, authorization, accountability

Front 3

When a subject professes an identity and accountability is initiated. This starts AAA.

Back 3

Identification

Front 4

What is the process of verifying or testing that the claimed identity is valid?

Back 4

Authentication

Front 5

This ensures the requested activity or access is possible given the privileges assigned to the identity.

Back 5

Authorization

Front 6

The recording of a log of events to hold the subject accountable for their actions.

Back 6

Monitoring (Auditing)

Front 7

What part of AAA is reviewing log files checking for compliance and violations?

Back 7

Accountability

Front 8

Works to guarantee appropriate information security activities are being performed to reduce risk, security investments are being managed & executive management has visibility into its effectiveness.

Back 8

Security Governance

Front 9

True or False: Security professionals should see their role as risk advisors, not final decision makers. Management is decision maker.

Back 9

True

Front 10

The interrelationship between assessing risk & determining needs, monitoring & evaluating, promoting awareness and implementing policies & controls.

Back 10

Security and Risk Management

Front 11

4 steps to implement security policies

Back 11

Policy > Standards > Guidelines > Procedures

Front 12

2 data classification schemes

Back 12

1. Government/Military 2. Commercial business/Private sector

Front 13

What is the dynamic testing technique where you add to the SW to see what the test will uncover?

Back 13

Fuzz testing

Front 14

What does the system for thinking about security threats STRIDE stand for?

Back 14

S = spoofing

T = tampering

R = repudiation

I = information disclosure

D = denial of service

E = elevation of privilege

Front 15

What does PII stand for?

Back 15

Personal identifiable information

Front 16

Who is responsible for the protection of all of the business information assets?

Back 16

Information Security Office

Front 17

What your legal duty is considered to be? The lack of this can be considered negligence.

Back 17

Due care

Front 18

Preemptive measure made to avoid harm. Examples are background checks of employees, credit checks of business partners.

Back 18

Due diligence

Front 19

What is the potential occurrence of an undesirable outcome?

Back 19

Threat

Front 20

What is a weakness in an asset?

Back 20

Vulnerability

Front 21

What is being susceptible to asset loss from a threat?

Back 21

Exposure

Front 22

What is the possibility or likelihood that a threat will exploit a vulnerability called? (Threat x Vulnerability = ?)

Back 22

Risk

Front 23

What is the exploitation of a vulnerability?

Back 23

Attack

Front 24

What is it called when a security control has been bypassed?

Back 24

Breach

Front 25

What risk analysis gives you concrete probability percentages?

Back 25

Quantitative Risk Analysis

Front 26

What risk analysis involves scenarios & ranks threats on a scale?

Back 26

Qualitative

Front 27

Asset Value (AV) x Exposure Factor (EF) = ?

Back 27

Single Loss Expectancy (SLE)

Front 28

What is the number of occurrences in a year called?

Back 28

Annualized Rate of Occurrence (ARO)

Front 29

Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO) = ?

Back 29

Annualized Loss Expectancy (ALE)

Front 30

Brainstorming, Delphi, storyboarding, surveys, interviews are what type of risk analysis?

Back 30

Qualitative

Front 31

What technique leverages anonymous feedback and responses?

Back 31

Delphi

Front 32

What is it called when you implement security controls in layers across physical, logical/technical, and administrative?

Back 32

Defense in Depth

Front 33

Guards, fences, motion detectors, camera's, alarms, mantraps are what type of controls?

Back 33

Physical

Front 34

Authentication, encryption, firewalls, routers, intrusion detection systems, clipping levels are what type of controls?

Back 34

Logical/ technical

Front 35

Policies, procedures, hiring practices, background checks, data classification are what type of controls?

Back 35

Administrative

Front 36

What are you setting when you set the number of password attempts allowed?

Back 36

Clipping level

Front 37

A guide for how risk is to be assessed, resolved and monitored.

Back 37

Risk Framework

Front 38

What are the 6 steps of the NIST Risk Management Framework?

Back 38

1. Categorize the system

2. Select security controls

3. Implement the security controls

4. Assess the security controls

5. Authorize the operation of the system

6. Monitor the security controls effectiveness

Front 39

4 possible responses to a risk

Back 39

Reduce, assign, accept,reject

Front 40

What Act made it illegal to access or harm federal computers and was amended in 1986 to include federal interest computers?

Back 40

Comprehensive Crime Control Act (CCCA)

Front 41

What Act goes beyond computers and into railroads, gas,telecommunications & all intentional acts are a felony.

Back 41

National Information Infrastructure Protection Act of 1996

Front 42

What government organization controls federal classified computers?

Back 42

NSA National Security Agency

Front 43

What government organization controls all of the rest of the federal (non classified) computers?

Back 43

NIST National Institute of Standards & Technology

Front 44

What Act put NIST in charge & mandated baseline cyber security requirements for all federal agencies?

Back 44

Computer Security Act of 1987

Front 45

What guidelines implemented the prudent man rule requiring executives to take personal responsibility for information security, not just fiscal?

Back 45

Federal Sentencing Guidelines released in 1991

Front 46

What are intangible assets, such as brand?

Back 46

Intellectual property

Front 47

What protects creative works?

Back 47

Copyright laws

Front 48

What protects words, slogans, and logos?

Back 48

Trademarks

Front 49

What protects intellectual property of inventors?

Back 49

Patents

Front 50

What protects intellectual property of a company that is critical to their business & it is best to control them yourself and make everyone around it sign a NDA?

Back 50

Trade Secrets

Front 51

What looks out for the privacy of US citizens where their persons, papers and effects shall not be violated?

Back 51

4th Amendment

Front 52

What requires strict security measures in the medical community?

Back 52

Health Insurance Portability & Accountability Act (HIPPA)

Front 53

What broadened the powers of law enforcement, such as monitoring electronic communication, in the fight against terrorism?

Back 53

USA Patriot Act of 2001

Front 54

Cyber crime makes up how much of the total crime around the world?

Back 54

1/3rd

Front 55

What are the 5 golden rules when answering CISSP exam questions?

Back 55

1. When it comes to people, safety first

2. Management buy-in is critical

3. Everyone is responsible for Security

4. Training is essential

5. Policy is the key to nearly everything

Front 56

What DES encryption mode is least secure and produces the same key for the same message every time and does so one at a time?

Back 56

Electronic Codebook (ECB) mode

Front 57

What DES encryption mode involves XOR'ing each block of text with text before it?

Back 57

Cipher Block Chaining (CBC) mode

Front 58

What DES encryption mode is a streaming version of the Cipher Block Chaining (CBC) mode?

Back 58

Cipher Feedback (CFB) mode

Front 59

What DES encryption mode uses a seed value, then operates like Cipher Feedback (CFB) mode and errors don't corrupt the rest of the message?

Back 59

Output Feedback (OFB) mode

Front 60

What DES encryption mode uses counter instead of seed value and errors don't corrupt the rest of the message?

Back 60

Counter (CTR) mode

Front 61

What encryption standard uses a long series of XOR operations and repeats the process 16 times for each encryption/decryption operation?

Back 61

Data Encryption Standard (DES)

Front 62

What is the triple data encryption algorithm symmetric key block cipher which applies the DES cipher 3 times to each data block?

Back 62

Triple DES (3DES)

Front 63

What symmetric key block encryption algorithm operates on 64 bit blocks using a 128 bit key and consists of eight identical rounds and is used in PGP?

Back 63

International Data Encryption Algorithm (IDEA)

Front 64

AES (Advanced Encryption Standard) uses what block cipher?

Back 64

Rijndael

Front 65

What are the 3 different key lengths/encryption rounds and text block size for AES?

Back 65

128 text - 128 key with 10 rounds

128 text - 192 key with 12 rounds

128 text - 256 key with 14 rounds

Front 66

What are 3 ways to exchange secret keys securely?

Back 66

1. Offline distribution

2. Public key infrastructure/CA

3. Diffie-Hellman key exchange

Front 67

What key exchange algorithm has both parties participate in making a secret key for them to share?

Back 67

Diffie-Hellman

Front 68

True or False. Private key algorithms are used for bulk data encryption and are 1000x faster than public key cryptosystems.

Back 68

True

Front 69

What is an arrangement in which the keys needed to decrypt data are held in escrow so that under certain circumstances and authorized 3rd party may gain access to the keys?

Back 69

Fair cryptosystems or key escrow

Front 70

What algorithm does the alternative key escrow approach, Escrowed Encryption Standard (aka Clipper), use?

Back 70

Skipjack

Front 71

Fill in the blank with one of the CIA triads: The objective of privacy is the _____ of personal data.

Back 71

Confidentiality

Front 72

Fill in the blanks: An _____ (short term) supports a goal (intermediate term), which supports a _____ (long term), which is accomplished with a well defined strategy.

Back 72

An objective (short term) supports a goal (intermediate term), which supports a mission (long term), which is accomplished with a well defined strategy.

Front 73

ISACA and ITGI developed this control framework for IT management and IT governance.

Back 73

COBIT (Control Objectives for Information and Related Technologies)

Front 74

What control framework is required by all US government agencies and is also widely adopted in private industry?

Back 74

NIST SP800-53

Security and Privacy Controls

Front 75

COSO, ISO/IEC 27002, and ITIL are all what?

Back 75

Control Frameworks

Front 76

What is the difference between due care and due diligence when it comes to logging?

Back 76

Due care is turning on logging; due diligence is regularly reviewing the logs.

Front 77

What are laws derived from judicial precedence rather than statutes?

Back 77

Common law

Front 78

What type of laws form the bulk of our laws and provide for an orderly society and are not considered crimes, so only financial restitution happens as opposed to jail time?

Back 78

Civil laws

Front 79

What type of laws are policies and regulations that government agencies enforce?

Back 79

Administrative law

Front 80

True or False. The US Computer Fraud and Abuse Act of 1986 is THE major computer crime law currently in effect that enhanced it's first 1984 revision which was the very first federal computer crime law.

Back 80

True

Front 81

What Act complemented the US Computer Fraud and Abuse Act of 1986 and prohibited eavesdropping, etc. without permission, which was later amended by the USA Patriot Act authorizing it for felony violations?

Back 81

US Electronic Communications Privacy Act (ECPA) of 1986

Front 82

What European legislation protects personal information for all European citizens and led to the Safe Harbor agreement between Europe and the US in 1998 allowing US organizations to certify themselves to handle European citizens data?

Back 82

Directive 95/46/EC

Front 83

What industry standard (not yet legally required) is mandated by credit card companies who oversee their own compliance programs?

Back 83

Payment Card Industry Data Security Standard (PCI DSS)

Front 84

What is the ISC2 Code of Professional Ethics preamble?

Back 84

The safety of society and duty to our principles requires adherence to the highest ethical standards. Therefore, strict adherence to this Code is a condition of certification.

Front 85

What are the 4 canons of ISC Code of Ethics?

Back 85

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.

2. Act honorably, honestly, justly, responsibly, and legally.

3. Provide diligent and competent service to principals.

4. Advance and protect the profession.

Front 86

What are the 5 unethical practices issued by the Internet Architecture Board (IAB)?

Back 86

1. Seeks to gain unauthorized access to resources on the internet

2. Disrupts the intended use of the internet

3. Wastes resources (people, capacity, computer)

4. Destroys the integrity of computer based information

5. Compromises the privacy of users

Front 87

What are the 10 commandments of computer ethics? Thou shalt...

Back 87

1. not use a computer to harm people

2. not interfere with other people's computer work

3. not snoop around in other people's computer file

4. not use a computer to steal

5. not use a computer to bear false witness

6. not copy proprietary SW for which you have not paid

7. not use other people's computer without authorization

8. not appropriate other people's intellectual output

9. think about the social consequences of the program you write

10. use a computer in ways that show consideration and respect

Front 88

What are the 4 types of security policies?

Back 88

1. Sr management

2. Regulatory

3. Advisory

4. Informative

Front 89

True or False. The purpose of off site media storage is to ensure that up to date data is available in the event that systems in the primary data center area damaged.

Back 89

True

Front 90

What is the maximum period of time in which business must be restored after a disaster?

Back 90

Recovery Time Objective (RTO)

Front 91

What is the maximum period of time called in which data might be lost if a disaster strikes?

Back 91

Recovery Point Objective (RPO)

You set your backup schedule with it.

Front 92

What consists of an asset, a threat, and vulnerability?

Back 92

Risk management triple. (A risk consists of a threat and a vulnerability of an asset.)

Front 93

What kicks off risk assessment?

Back 93

Risk identification

Front 94

What are the 4 steps of threat analysis?

Back 94

1. Define the threat

2. Identify consequences if the threat event occurs

3. Determine probable frequency of the event

4. Assess probability that the threat will actually happen

Front 95

What are the 4 steps of risk analysis (treatment)?

Back 95

1. Identify assets to be protected (asset valuation)

2. Define threats (threat analysis)

3. Calculate ALE (SLE x ARO)

4. Select safeguards

Front 96

What illustrates the steps used to attack a target system?

Back 96

An attack tree

Front 97

A general awareness program, formal training and education are 3 main components of what?

Back 97

An effective security awareness program.

Front 98

Tip: In CISSP questions, sometimes Security is called Information Assurance

Back 98

Security = Information Assurance

Front 99

What is any location called where the level of trust or security changes?

Back 99

Trust boundary

Front 100

What says executive's must perform their duties in good faith, in the best interest of the enterprise and with care and diligence that people in a similar position would exercise in a similar circumstance?

Back 100

Prudent Man Rule

Front 101

What is a conscious disregard of the need to use reasonable care?

Back 101

Gross negligence

Front 102

What is the opposite of CIA?

Back 102

DAD (disclosure, alteration, destruction)

Front 103

What cryptography option do you use for Integrity?

Back 103

Hashing

Front 104

What is the difference between encryption and hashing?

Back 104

Hashing is one way. Encryption is 2 way.

Front 105

What cryptography option do you use for authentication, integrity and/or nonrepudation?

Back 105

Digital signatures

Front 106

What is the flow of electronic data across political boundaries, such as states and countries, which can cause legal conflicts?

Back 106

Transborder data flow

Front 107

What links business objectives to IT goals?

Back 107

COBIT

Front 108

What is the role of ITIL in IT goals?

Back 108

ITIL defines a framework for achieving IT service level goals

Front 109

What is the EF if the cost to replace a datacenter is $10M and the damage a tornado would cause is $5M?

Back 109

50%

Front 110

What enables a system to continue operating properly in the event of a failure?

Back 110

Fault tolerance

Front 111

What are 3 common risk assessment frameworks?

Back 111

FAIR (Factor Analysis of Information Risk)

OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation)

TARA (Threat Agent Risk Assessment)

Front 112

A security program cannot address which of the following business goals?

A. Accuracy of information

B. Change control

C. User expectations

D. Prevention of fraud

Back 112

A. Accuracy of information (cannot control how people enter data)

Front 113

True or False. An information security policy does not usually include guidelines for how to implement policy.

Back 113

True

Front 114

What should be the 1st step when a company suspects they have suffered a loss due to an employee's malfeasance, call law enforcement or review organizational policy?

Back 114

Review organizational policy

Front 115

What is the time you have to recover from a disaster?

Back 115

Recovery time objective

Front 116

What is the maximum period called where data can be lost from a disaster? This tells you how frequent you have to backup.

Back 116

Recovery point objective

Front 117

RTO (recovery time objective) + WRT (work recovery time) = ?

Back 117

MTD (maximum tolerable downtime)

Front 118

Who is best to own the information security program, the CEO or CIO?

Back 118

CIO

Front 119

Does electronic vaulting belong with disaster recovery or business continuity?

Back 119

Electronic vaulting is a data backup task and so belongs with disaster recovery

Front 120

What is it called when you decompose an application, system or environment during threat analysis to gain a better understanding of it?

Back 120

Reduction analysis

Front 121

What type of computer related crime is using a computer in an accompanying role, not a major role like the electronic distribution of illegal files?

Back 121

Incidental

Front 122

What is the maximum time a given biz process can be inoperative?

Back 122

MTD. Maximum Tolerable Downtime

Front 123

What is a form of one-time password authentication and can be synchronous (time-based value that expires) and asynchronous (challenge-response)?

Back 123

Token (device)