stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
LVISSA CISSP Domain 1 Flashcards | StudBud
Explore
/
LVISSA CISSP Domain 1
LVISSA CISSP Domain 1
50 terms
·
StudBud Administration
·
15 plays
Imported from external platform
Flashcards
50 cards
F
Practice quiz
P
Host live
L
Questions
50
Answers
1
What is the formula of risk?
Vulnerability + threat
Threat x safeguard
Threat x vulnerability
Vulnerability - safeguard
2
HIPAA stands for which of the following:
Heuristic Information Processing and Accounting
Health Insurance Portability and Accountability Act
Harmful Information Procedures Against Attack
High Profile Protection Authorization Augmentation
3
In qualitative risk assessment, which technique takes anonymous feedback from participants to reach a consensus?
Delphi
Quantitative aggregation
scenarios
interviews
4
BCP stands for what?
Basic Contract Proposal
Business Control Purpose
Business Continuity Plan
Business Continuity Program
5
Which of the following is characterized legally by an established brand identity?
Patents
Licenses
Copyrights
Trademarks
6
Which of the following is characterized legally by an established contract of use and limitations?
Patents
Trademarks
Trade secrets
Licenses
7
Computer crimes are known to be challenging to prosecute largely because of what?
They are less established in legal precedent cases
Experts in computer science make poor court witnesses
Computer crime evidence is usually removed
Data is not tangible and can be confusing in court cases
8
Which category of law is used to keep peace and safety for society, including protection from cyber crimes?
Judicial law
Common law
Administrative law
Criminal law
9
Which of the following is not a component of the CIA triad?
Integrity
Availability
Disclosure
Confidentiality
10
A BCP can help to prepare and aid a company in the event of all except which of the following?
Decrease in the supply of toner
Tsunami
Chronic decrease in supply of petroleum
Earthquake
11
What if the purpose of the ALE calculation?
To determine the risk of a general security failure
To determine the overall strength of an information security system
To estimate the potential loss an asset may suffer from threat
To make a qualitative assignment to an unknown quantitative risk
12
An attack on PII is generally categorized as what kind of attack?
Pie attack
integrity attack
Availability attack
Confidentiality attack
13
What US law fines criminals up to $500k for starting trade secrets that could benefit a foreign government?
Economic Espionage Act of 1996
Uniform Computer Information Transformations Act
Privacy Act of 1974
Digital MIllennium Copyright Act
14
Which of the following protects "original works of authorship" from unauthorized duplication?
Licenses
Patents
Copyrights
Trademarks
15
Operations security helps prevent misuse of systems. An acceptable use policy avoids what type of misconduct?
Fraud balancing
Theft of media
Sniffers
Personal use
16
Which type of operations security control is used when the main security controls are too expensive to implement?
Corrective
Recovery
Compensation
Deterrent
17
A proprietary formula used by an organization would best be categorized as what type of risk component?
Threat
Control
Ability
Asset
18
Risk choices are broken down into 4 different components. Which of these is not a standard component of risk choices?
Risk mitigation
Risk rejection
Risk elimination
Risk transfer
19
Identify the 3 main objectives for a systems security program
Secure, Administrative, Manageable (SAM)
Fast, Business-capable, intelligent
Secure, Encrypted, Customizable (SEC)
COnfidentiality, Integrity, Availability (CIA)
20
What component is needed to unlock the AAA?
Card
Identification
Access
PIN
21
Because cookies can track a user's movements on the internet, they can be deemed as what?
Espionage violation
Violation of privacy
Submersive violation
Violation of restrictions of movement
22
Which of the following is not protected by a trademark?
Sounds
Graphics
Symbols
Names
23
Which policy protects US citizens by setting limits on the government's use of their personal information?
Data Protection Directive
OECD
Safe Harbor
Privacy Act of 1974
24
The IT security manager is looking to hire a new resource. Of the following which would be the first step
Classifying the position
Creating a job listing to begin collecting resumes
Assigning a salary for the position
Creating a job description
25
The DREAD rating system pertains to which of the following?
Assessing probability and quantifying potential opportunities for damage
Evaluating and establishing the Change Management process
Creating a 3 layered plan to approach a security plan deployment
Assessing how effective a penetration test was
26
What is the purpose behind separation of duties?
To maintain integrity of firewalls
To ensure one person cannot gain too much control
To provide an efficient corporate structure of personnel
To legally comply with separation of corporate departments
27
Of the following, which requires a federal agency to implement an information security program to cover it's operations
Federal Information Security Management Act
Paperwork Reduction Act
Government Information Security Reform Act
Computer Security Act
28
Which type of control is used for reducing risk?
Preventive controls
Deterrent controls
Corrective controls
Detective controls
29
A log that provides a piece-by-piece record of accountability for events is called what?
Clipping
Audit trail
Problem management
Operation procedures
30
The possibility that harm may occur and cause damage, destroy,, or disclose data is known as what?
Vulnerability
Risk
Threat
Harm quotient
31
At this time, which political governing body is considered to be the most strict in regards to personal privacy?
EU
NATO
OPEC
USA
32
Ultimately, who is accountable for the security of a company or organization?
Government and related bureaus
Chief Information Security Officer
Procedural and technological devices and procedures
Upper Management
33
Due care is determined largely by _____ in the public system as opposed to the private system
Legislative requirements
The jury's perception
The degree of litigation
The amount of damages claimed
34
When an employee is fired, the organization should do what?
Do nothing. The employee is of no further concern
Ensure all access rights are revoked
Do its best to placate the former employee
Notify legal of an impeding lawsuit
35
Of the following, which is the weakest component of any organizational security program
Personnel
WAN connections
Security procedures
Software applications
36
Which technical form of assessing risk deals with straight mathematical evaluations?
Quantitative Risk Analysis
Risk math on review
Qualitative Risk Analysis
Risk Valuation
37
A contract created to protect an organization's sensitive information and signed by those employed by the organization
Privilege monitor
Mandatory leave form
Nondisclosure agreement
Background check
38
Which of the following is specific to legally securing established inventions?
Patents
Trade secrets
Licenses
Trademarks
39
Which of the following is characterized legally by securing established data important to an organization's operations?
Copyrights
Patents
Trademarks
Trade secrets
40
Acceptable use policy's role is best described by which of the following?
Ascertaining whether a policy is acceptable to the user
Explaining the role of a policy
Defining the reasoning behind the integration of a specific policy's use
Defining what is acceptable use for hardware or software
41
Identify the common ground for the following items and then identify which item does not belong
Spoofing
Brute force attacking
Spamming
Dictionary hacking
42
The EU Data Protection Directive law restricts data transfers to other countries. In May 2018, this law was replaced by?
General Data Protection Regulation (GDPR)
Safe Harbor
Right to be forgotten
Privacy Act
43
Identify the country that is deemed considerably restrictive regarding the use of cryptosystems within it's borders
Canada
United States
Cuba
Britain
44
Which of the following is considered an asset?
Personnel
Risk
Controls
Threats
45
Regardless of the access control model used, the first step in any access control is what?
Verification
Authorization
Identification
Authentication
46
Which of the following must be performed before outsourcing or offshoring sensitive data?
A socioeconomic evaluation
A regulatory issue scan
Risk Analysis
Foreign national awareness training
47
Which of the following types of access control are also referred to as management controls?
Logical controls
Administrative controls
Physical controls
Technical controls
48
A system where access duration is limited and is given to others at a later time
Preferred user
Least privilege
Job rotation
Separation of duties
49
From the following options, identify the formula used for residual risk
(Threat x vulnerability x asset value) - control gap
(Vulnerability x threat) x asset value
(Threat x risk) x asset value
Asset risk x threat - control gap
50
Which area of law makes up the majority of the body of laws?
Civil law
Copyright law
Local customs
Criminal law
