the foundational standard for Information Security Management Systems (ISMS).

Which of the following standards provides information on privacy and managing PII?

Information security controls are the focus of the _____ standard.

sets international standards for risk management practices.

FTPS

HTTPS

SRTP

Responsible for the organization's data privacy

Associates sensitivity labels to data and complies with laws

Processes data on behalf of the data controller. Often a 3rd party.

Manages the purposes and means by which data is processed

Associates sensitivity labels to data

Controls implemented using systems (firewalls, antivirus, etc)

Controls that are implemented by people (security guards, etc)

Controls that address security design and implementation

SOAR: conditional steps to follow. a broad process

SOAR: linear checklist of steps to perform

ASCII formatted file that contains certs and chain certificates.

Common windows format. Usually contains only public key.

Often used to transfer a private and public keypair.

Store many x.509 certs in 1 file. Can be password protected

Base64 encoded DER cert. Good for email.

Certificate format often used for Java applications

Standard for digital certificates

Block cipher mode / acts like a stream cipher

Each block is XORed with the previous ciphertext block.

Backup type that backs up what has changed since the last full backup

Backup type that backs up what has changed since the last backup. Restoring requires every backup in between

Create a central place for all of the diverse cloud providers

Targeted phishing attack where the victim believes the sender is someone they know.

Phishing attack targeted at high level members of a company.

IMAP using SSL

POP3 using SSL

SMTP with authentication

Form of EAP that utilizes a shared secret (PAC)

Form of EAP where authentication server uses a digital certificate.

Often combined with PEAP

Form of authentication compatible with a GTC (generic token card, hardware token generator)

Form of EAP that requires digital certificates on ALL devices.

Form of EAP that supports other protocols inside a TLS tunnel

Eduroam uses what?

Which of the following can be used to apply security policies to cloud-based implementations?

Which part of the PC startup process verifies the digital signature of the OS kernel?

Which part of the PC startup process verifies the digital signature of the bootloader?

Which part of the PC startup process verifies that nothing on the computer has been changed by malicious software or other processes?

Which of the following would be the BEST way to confirm the secure baseline of a deployed application instance?

Which of the following provides a ticket-based system to provide SSO?

the expected lifetime of a nonrepairable product or system

prediction of how often a repairable system will fail.

Command used for reading or writing data to the network.

Port scanning and reconnaissance utility

Restoring from a backup after an attack would be what type of security control?

Encrypted data is very different from original plaintext.

Even changing one character in the plaintext will drastically change the encryption output.

Contains a hash of the IPSec packet to provide integrity of the data.

manages access rights and sets security controls to the data.

This form of EAP requires a radius server

Netstat flag which disables domain name resolution

Netstat flag which shows active connections and also shows which TCP and UDP ports are listening for a connection.

Netstat flag which shows what programs are in control of what connections

Netstat flag which shows fully qualified domain names in the foreign address column.

When an unauthorized person is let in willingly (holding the door for example)

When an unauthorized individual enters a restricted-access building by following an authorized user.

fire extinguisher class for common combustibles

fire extinguisher class for liquids

fire extinguisher class for electrical fires

fire extinguisher class for flammable metals

RSA is

ECC is

Diffie-Hellman is

El - Gamal is

Digital Signature Algorithm (DSA) is

Merkle-Hellman Knapsack is

AES is

DES is

3DES is

IDEA PGP is

Blowfish is

Skipjack is

RC2 is

RC4 is

RC5 is

Two Fish is

Which mode of IPSEC leaves the header untouched?

IPSEC mode which encrypts both header and payload

WPA2 uses

WPA3 uses

Firewalls and routers are a good example of

chmod - execute

chmod - write

chmod - read

Who is affected by a disaster

A predetermined set of instructions or procedures that describe how an organization's mission-essential functions will be sustained within 12 hours and for up to 30 days as a result of a disaster event before returning to normal operations.

defines strategies on how to continue the business in case of a catastrophic event. It details what you will do to keep the business running while systems are down.

details how to recover from a major event. How to get the systems back to normal. It's about restoring the state before the catastrophic event and how fast you'll get there and how much data you'd lose in terms of RTO, RPO.

an agreement between two or more parties to enable them to work together that is not legally enforceable but is more formal than an unwritten agreement.

the maximum tolerable time to restore an organization's information system following a disaster, representing the length of time that the organization is willing to attempt to function without its information system

a metric that measures the maximum amount of data loss an organization can tolerate in the event of a disruption such as a cyber attack or data breach. It helps in determining how frequently data should be backed up to minimize potential data loss

focuses on restoring IT systems and infrastructure

focuses on maintaining critical business functions

Two parties can verify non-repudiation.

Non-repudiation that can be publicly verified

Includes 20 key actions (the critical security controls)

6 step process that is mandatory for federal agencies and organizations that handle federal data

A voluntary commercial framework. (Identify, Protect, Detect, Respond, and recover)

Type of audit that focuses on firewalls, intrusion detection, and mfa

Tests controls in place at a particular point in time

Tests controls over a period of at least 6 months

Cloud specific security controls, and controls are mapped to standards, best practices and regulations

Two people must be preset to perform the business function

No one person has all of the details

What process verifies device drivers during windows startup

"what if" scenarios based on specific events, that establish the "play book" to follow should that event (and assumed impacts) occur.

explains how an "adversary" exploits a "capability" over an "infrastructure" against a "victim" in simple terms.

6 step process which is mandatory for federal agencies or orgs that handle federal data

Privacy info management systems

Identify potential security techniques to block future attacks, understand methods used to move around

Taking the risk as is

Buying cyber security insurance

Decrease the risk level (example - investing in security systems)

Stop participating in high risk activity

US federal law that requires public companies to implement controls and procedures to ensure the accuracy and security of financial data and systems, and to maintain the confidentiality, integrity, and availability of financial information and systems.

Assess the measurement process and calculate measurement uncertainty.