System Administration & Management Flashcards

How often should audit logs on a classified information system normally be reviewed under DCSA baseline guidance?

Answer: Weekly

DCSA guidance calls for the ISSM or designee to review audit records at least weekly.

Classified data is discovered on an unclassified system. What is this event called?

Answer: A data spillage

Classified information on a lower-level system is a spillage requiring containment and reporting.

What should be done first when an information system user suspects a spillage?

Answer: Stop work, isolate the system, and notify the ISSM and FSO

Containment and immediate notification prevent further spread and allow proper response.

Which principle limits users to only the access needed to perform their job?

Answer: Least privilege

Least privilege restricts accounts to the minimum permissions necessary.

Which action best supports separation of duties on a classified system?

Answer: Having someone other than the administrator review audit logs

Separating administration from audit review prevents one person from concealing misuse.

Before classified storage media is released to an unclassified environment, it must be:

Answer: Sanitized or destroyed using approved methods

Media must be sanitized or destroyed per approved procedures before any release or reuse.

Which describes a system's approved security configuration used to detect unauthorized changes?

Answer: Security baseline

A configuration baseline defines the approved state and is used in change control.