Cissp - Lesson I

Front 1

Risk, as it applies to IT is associated with

Back 1

-People
-Practices
-Processes

Front 2

Another name for the Information Security Triad is

Back 2

CIA triad

Front 3

What represents keeping an organization information accurate, without error, and without unauthorized modification

Back 3

Integrity

Front 4

Security principle limits access of information to the minimum necessary

Back 4

Least privilege

Front 5

Limitation of access based on rules provided through the ID of the entity attempting to access an object

Back 5

Access Control Services

Front 6

Division of tasks between different people to complete a business process or work function.

Back 6

SOD-Segregation of duties

Front 7

Process of determining & assigning privileges to various resources, objects, and data.

Back 7

Access Control

Front 8

Access controls sufficient to maintain the CIA triad

Back 8

-Detective
-Corrective
-Preventative

Front 9

Access Control Service that determines capabilities of a subject when accessing the object.

Back 9

Authorization

Front 10

Access control type covers personnel security, monitoring, user & password management, and permissions management.

Back 10

Administrative

Front 11

Restricting access to objects based on sensitivity of the information contained in the objects is:

Back 11

MAC

Front 12

Which nondiscretionary access control technique limits subject's access to objects by examining object data so that the subject's access rights can be determined?

Back 12

Content dependen

Front 13

What one or more methods are used to authenticate identity?

Back 13

-Something you have
-Something you know
-Something you are

Front 14

An auth. factor using passwords and password variants

Back 14

Something you know

Front 15

An auth. factor using a personal attribute such as fingerprints.

Back 15

Something you are.

Front 16

An auth. factor using a physical device such as a magnetic strip

Back 16

Something you have.

Front 17

Which auth. method is necessaryto safeguard systems and facilities in high-security environments?

Back 17

Strong two factor authentication

Front 18

Though single sign on (SSO) can be convenient, what is a potential security problem?

Back 18

It can allow an unauthenticated user access to all systems.

Front 19

Which access control administration method involves distributing the process to localized parts of the enterprise?

Back 19

Centralized.

Front 20

What is the simplest way to attack an access control system?

Back 20

Capture a user ID and steal a password.

Front 21

Limits or eliminates user's ability to access the network and/or data

Back 21

Denial of Service (DOS)

Front 22

Programs such as malware, spyware, viruses, and worms may cause system failures, or malfunctions.

Back 22

Malicious software

Front 23

Protocol analyzer used to capture user IDs and passwords.

Back 23

Sniffer

Front 24

Information left on media after erasures or deletions.

Back 24

Remnants.

Front 25

Reclaiming information from media thought to be erased.

Back 25

Object reuse.

Front 26

A set of predefined words from a dictionary to crack a password.

Back 26

Dictionary attack.

Front 27

Accessing a program or operating system through a hidden entry point.

Back 27

Trapdoor

Front 28

Attempting to access a system by trying every possible combination of a password or a PIN.

Back 28

Brute Force.

Front 29

Passing electrons through a wire or over the radio to leak protected information.

Back 29

Emanation.

Front 30

Accessing a program or operating system through a hidden entry point placed in programs to allow programmers to repair problems.

Back 30

Backdoor

Front 31

Attack where attacker pretends to be someone else to hide his/her actual identity.

Back 31

Spoofing.

Front 32

A signature file contains profiles of known threats in a:

Back 32

Intrusion Detection System

Front 33

Controlled use of attack methods to test security of a system or facility

Back 33

Penetration testing

Front 34

Penetration test process phase that includes gaining more detailed information about the selected target

Back 34

Enumeration

Front 35

What does war dialing do?

Back 35

Locates and attempts to penetrate wireless systems.

Front 37

Another name for the Information Security triad is

Back 37

The CIA triad

Front 38

This represents the property of keeping an organization information accurate, without error, and without unauthorized modification

Back 38

Integrity

Front 39

Describe Least Privilege

Back 39

Security principle that limits access of information to the minimum necessary

Front 40

Describe Access Control Services

Back 40

Limitation of access based on rules provided through the ID of the entity attempting to access an object.