Certified Information Systems Security Professional (CISSP) Flashcards
Browse all 30 cards
What are the 8 CISSP CBK domains?
Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management (IAM); Security Assessment and Testing; Security Operations; and Software Development Security.
What does the CIA triad stand for in information security?
Confidentiality, Integrity, and Availability — the three core properties that security controls are designed to protect.
What is the difference between qualitative and quantitative risk analysis?
Quantitative analysis assigns numeric/monetary values (e.g., ALE, SLE, ARO) to risk, while qualitative analysis uses subjective ratings like high/medium/low based on judgment and scenarios.
Define Single Loss Expectancy (SLE).
The monetary loss expected from a single occurrence of a risk event, calculated as Asset Value (AV) multiplied by Exposure Factor (EF).
Define Annualized Loss Expectancy (ALE).
The expected yearly monetary loss from a risk, calculated as SLE multiplied by the Annualized Rate of Occurrence (ARO).
What is the principle of least privilege?
Users and processes should be granted only the minimum access rights needed to perform their job functions, nothing more.
What is separation of duties?
A control that divides critical tasks among multiple people so no single individual can complete a sensitive process alone, reducing fraud and error risk.
What is defense in depth?
A layered security strategy using multiple, overlapping controls (physical, technical, administrative) so that if one layer fails, others still provide protection.
Distinguish authentication from authorization.
Authentication verifies who a subject is (identity proof), while authorization determines what an authenticated subject is permitted to do.
What are the three factors of authentication?
Something you know (password/PIN), something you have (token/smart card), and something you are (biometric).
What is Discretionary Access Control (DAC)?
An access model where the resource owner decides who can access the resource and what permissions they receive.
What is Mandatory Access Control (MAC)?
An access model where access decisions are enforced by the system based on fixed security labels/classifications, not by resource owners.
What is Role-Based Access Control (RBAC)?
An access model that grants permissions based on a subject's assigned role within an organization rather than individual identity.
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared secret key for both encryption and decryption; asymmetric encryption uses a mathematically linked public/private key pair.
What does a digital signature provide?
Integrity, authentication, and non-repudiation by hashing a message and encrypting the hash with the sender's private key.
What is the purpose of a hashing algorithm in security?
To produce a fixed-length, unique digest of data used to verify integrity — any change to the input produces a different hash.
What is the difference between a Type I and Type II error in biometric systems?
A Type I error (False Rejection Rate) wrongly denies a legitimate user; a Type II error (False Acceptance Rate) wrongly admits an impostor.
What is the Crossover Error Rate (CER) in biometrics?
The point at which the False Rejection Rate and False Acceptance Rate are equal; a lower CER indicates a more accurate biometric system.
What is a Security Information and Event Management (SIEM) system used for?
To aggregate, correlate, and analyze log data from across an environment in real time to detect and alert on security incidents.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment identifies and catalogs weaknesses without exploiting them, while a penetration test actively exploits vulnerabilities to demonstrate real-world impact.
What is the primary goal of business continuity planning (BCP)?
To ensure critical business functions can continue operating during and after a disruptive event.
What is a disaster recovery plan (DRP) focused on?
Restoring IT systems, data, and infrastructure after a disruptive event, as a subset of the broader business continuity plan.
Define Recovery Time Objective (RTO).
The maximum acceptable amount of time a system or process can be down before it must be restored after a disruption.
Define Recovery Point Objective (RPO).
The maximum acceptable amount of data loss, measured in time, between the last backup and the point of disruption.
What is the OSI model and how many layers does it have?
A conceptual 7-layer framework (Physical, Data Link, Network, Transport, Session, Presentation, Application) describing how network communication functions.
What is the purpose of change management in security operations?
To ensure that changes to systems are formally reviewed, approved, tested, and documented to minimize disruption and unintended security risk.
What is the Software Development Life Cycle (SDLC) and why does it matter for security?
A structured process for building software through phases (planning, design, development, testing, deployment, maintenance); embedding security at each phase reduces vulnerabilities before release.
What is threat modeling?
A structured process of identifying potential threats, vulnerabilities, and attack vectors against a system early in design to prioritize mitigations.
What is the difference between data at rest, in transit, and in use?
Data at rest is stored on media, data in transit is moving across a network, and data in use is actively being processed in memory — each requires different protective controls.
What is data remanence?
Residual data that remains on storage media after attempts to erase or delete it, posing a risk of unauthorized disclosure if not properly sanitized.