Mixed Deck — All ISC2 CC Topics Flashcards

What is the primary goal of an Incident Response Plan (IRP)

Answer: To ensure that the organization can quickly respond to and recover from security incidents.

An Incident Response Plan (IRP) is a structured approach for handling security incidents, aiming to limit damage and reduce recovery time and costs. Its primary goal is to enable an organization to quickly identify, contain, eradicate, recover from, and learn from security breaches. This ensures a systematic and efficient response to protect assets and maintain business operations.

What does the term 'least privilege' mean in security?

Answer: Restricting user access to only what is necessary for their job

Least privilege means users are granted only the minimum permissions necessary to perform their job functions.

What is a VLAN (Virtual Local Area Network)?

Answer: A logical network segment created within a physical network infrastructure

A VLAN is a logical grouping of network devices into separate broadcast domains even if they share the same physical infrastructure.

Which of the following best describes the principle of least privilege?

Answer: Users should have the minimum level of access necessary to perform their job functions.

The principle of least privilege dictates that users, programs, or processes should be granted only the minimum necessary permissions or access rights required to perform their legitimate functions. This security best practice minimizes the potential damage from accidental errors, misuse, or malicious attacks by limiting the scope of what an compromised account can do. It reduces the attack surface and enhances overall system security.

Which authentication factor category does a hardware token belong to?

Answer: Something you have

Hardware tokens are possession-based 'something you have' authentication factors that generate one-time codes.

Which protocol is used to securely transfer files over a network?

Answer: SFTP

SFTP, or Secure File Transfer Protocol, is specifically designed for securely transferring files over a network. It uses SSH (Secure Shell) to provide a secure channel, encrypting both the data and commands during transmission. This ensures confidentiality and integrity of the files being moved between systems.

What does the term 'asset' mean in information security?

Answer: Anything of value that needs protection

An asset is anything of value to an organization — including data, systems, people, and physical resources — that requires protection.

Which of the following is an example of multifactor authentication (MFA)?

Answer: Fingerprint and smart card

Multifactor Authentication (MFA) requires combining two or more distinct authentication factors from different categories to verify a user's identity. A fingerprint represents "something you are" (a biometric factor), while a smart card represents "something you have" (a possession factor). The combination of these two distinct factors makes "Fingerprint and smart card" a clear example of multifactor authentication, providing enhanced security.

What is the purpose of system hardening?

Answer: Reducing the attack surface by removing unnecessary services and applying secure configurations

System hardening reduces the attack surface by removing unnecessary software, closing unused ports, and applying secure configurations to minimize vulnerabilities.

What is network segmentation?

Answer: Dividing a network into smaller, isolated subnetworks to improve security

Network segmentation divides a network into smaller subnetworks to improve security, performance, and limit the spread of attacks.

What is the primary purpose of access control?

Answer: To ensure only authorized users can access resources

Access control ensures that only authorized individuals can access specific systems, data, or physical locations.

Which term describes the process of identifying potential threats and their likelihood?

Answer: Risk analysis

Risk analysis involves identifying threats, their likelihood, and their potential impact on an organization.

What is the purpose of an access control list (ACL)?

Answer: To define which users or systems have permission to access specific resources

An ACL defines rules that specify which users, systems, or processes are permitted or denied access to specific resources.

Which of the following is an example of a technical security control?

Answer: Encryption of sensitive data

Encryption is a technical security control implemented through technology to protect data from unauthorized access.

Which term describes the likelihood that a threat will exploit a vulnerability?

Answer: Probability

Probability (or likelihood) refers to the chance that a specific threat will successfully exploit a given vulnerability.

What does Mean Time Between Failures (MTBF) measure?

Answer: The average time between system failures

MTBF measures the average time between failures for a system or component and is used to assess overall reliability.

What is the purpose of a patch management program?

Answer: To keep systems up to date with security and software fixes

Patch management ensures that systems are regularly updated with security patches to fix known vulnerabilities before they can be exploited.

Which security principle involves verifying that a user is who they claim to be?

Answer: Authentication

Authentication is the process of verifying the identity of a user, system, or entity.

What is the Recovery Point Objective (RPO)?

Answer: The maximum acceptable data loss measured in time

RPO defines the maximum acceptable amount of data loss measured in time — how far back in time you can afford to lose data.

Which step comes AFTER eradication in the standard incident response process?

Answer: Recovery

After eradicating the threat, the next step is recovery — restoring affected systems and verifying they are operating normally.