CISSP > Frameworks > Flashcards

Frameworks Flashcards

(51 cards)

Study These Flashcards
1
Q

A Framework is

A

a structure underlying a system, concept, or text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Purpose of frameworks in IT and cybersecurity is to ____

A

Provide structure to the ways in which we manage risks, develop enterprise architecture, and secure all our assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Four Basic breakdown of Framework

A
  • Risk
  • Security Program
  • Security Controls
  • Enterprise Architecture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Example of Risk Frameworks

A
  • NIST RMF
  • ISO/IEC 27005
  • OCTAVE
  • FAIR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Examples Security Program Framework

A
  • ISO/IEC 27005 series
  • NIST Cybersecurity Framework
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Examples of Security Control Framework

A
  • NIST SP 800-53
  • CIS Controls
  • COBIT 2019
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Examples of Enterprise Architecture Framework

A
  • Zachman Framework
  • TOGAF
  • DoDAF
  • SABSA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NIST RMF is described in three core interrelated Special Publications

A
  • SP 800-37 R2 RMF for Information Systems and Organizations
  • SP 800-39 Managing Information Security Risk
  • SP 800-30 R1, Guide for conducting Risk Assessment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

NIST RMF - 2. Categorize - What is the SP?

A

NIST SP 800-60 applies sensitivity and criticality to each security objective (CIA) to determine a system’s criticality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NIST RMF Defines 3 types of security controls, they are_____

A
  • Common
  • System Specific
  • Hybrid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NIST RMF 3. Select SP

A

NIST SP 800-53 R5 Security and Privacy Controls for Information Systems and Organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ISO/IEC 27005 outlines 4 ways in which the risk can be treated:

A
  • Mitigate
  • Accept
  • Transfer
  • Avoid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

For RMF best results, which 2 ISO should be combined?

A

ISO/IEC 27005
ISO/IEC 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)
Is a RMF or Methodology for Risk Assessment?

A

It is not a Framework but more of a methodology for risk assessment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Common Use of OCTAVE is in Public Sector or Private Sector?

A

Private Sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

OCTAVE Approach focuses on which type of Asset

A

Most critical assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

80% of the Consequences come from 20% of the causes (Pareto Principle) used in which Risk Assessment Methodology?

A

OCTAVE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

OCTAVE Risk Assessment Methodology is divided into 3 phases:

A
  • Organizational view for most critical assets
  • Organizational Technology infrastructure vulnerabilities
  • Team Risk High, Medium, Low assessment and developing mitigation strategies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

More Rigorous quantitative approach to manage risk - Proprietary Framework?

A

FAIR ( Factor Analysis Information Risk)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

FAIR - Factor Analysis of Information Risk focus on: Possible Threats or Probable Threats

A

Probable Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Information Security Frameworks can be divided into 2 Categories:

Study These Flashcards
A
  1. Looks holistically at the entire security program
  2. Focused on Controls
22
Q

Which ISO standard series serve as industry best practices for the management of security controls in a holistic manner within organizations around the world

Study These Flashcards
A

ISO/IEC 27000

23
Q

As you probably realize, ISO_______ is the most important of these standards for the most organization:

24
Q

NIST Cybersecurity Framework is divided into three main components:

Study These Flashcards
A
  • Frame Core
  • implementation Tiers
  • Framework Profile
25
NIST Cybersecurity Framework core practices organize Cybersecurity activities into 5 higher level functions l:
- Identify - Protect - Detect - Respond - Recover
26
Which NIST covers, Security and Privacy Controls for information systems and Organizations.
NIST SP 800-53
27
NIST SP 800-53 Prescribes 4 Step process
1. Select the appropriate security control baseline 2. Tailor the baseline 3. Document the security control selection process 4. Apply the controls
28
How many controls NIST SP 800-53 lists: more than # controls
1000 Controls into 20 families
29
CIS - Centre for Internet Security, is a non profit organization that among other things maintains a list of # critical security controls
List of 20 Critical Security Controls
30
CIS (Centre for Internet Security) recognize that not every organization will not have the resources necessary to implement all the controls. For this reason they are grouped into 3 Categories, and they are:
- Basic - Key Controls - Foundational- Best Practices - Organizational - improved Cybersecurity (People and Processes focused)
31
COBIT 2019 (Control Objectives for Information Technologies) is a framework for governance and management developed by ISACA, it helps Organizations:
Optimize the value of their IT by balancing resource utilization, risk levels, and realizations of benefits.
32
Security Control framework COBIT 2019 (Control Objectives for Information Technologies) has 6 key principles:
1. Provide stakeholder value 2. Holistic Approach 3. Dynamic Governance Systems 4. Governance distinct from management 5. Tailored to enterprise needs 6. End-to-end governance system
33
COBIT 2019 specifies # enterprise and # alignment goals. These 2 steps of goals are different but related
13
34
A Majority of the security compliance auditing practices used today in the industry are based off which security control framework?
COBIT 2019
35
Is COBIT 2019 purely security focused or IT governance as well
Both
36
One of the first enterprise architecture framework that was created is the:
Zachman Framework
37
The Zachman Framework is a two-dimensional model that uses # basic communication interrogatives:
What How Where Who When Why
38
The Open Group Architecture Framework (TOGAF), which has its origins in the U. S. Department of Defence. This be used to develop the following 4 architecture types:
- Business Architecture - Data Architecture - Application Architecture - Technology Architecture
39
TOGAF can be used to create these individual architecture type through the use of: what method?
Architecture Development Method (ADM)
40
TOGAF ( The Open Group Architecture Framework) architectures can allow a technology architect to understand the enterprise from 4 different views:
- Business - Data - Application - Technology
41
DoDAF stands for
Department of Defence Architecture Framework (DoDAF)
42
The focus of The Department of Defence Architecture Framework (DoDAF):
- Command - Control - Communications - Computers - intelligence - Surveillance - Reconnaissance systems and Processes
43
Other Frameworks (3)
- ITIL - Six Sigma - Capability Maturity Model
44
ITIL (Information Technology Infrastructure Library) 1980s by UK’s Central Computer and Telecommunications Agency. ITIL is the_____now
De facto standard of best practices for IT services management
45
Four dimensional in ITIL model:
-Organizations and People -Value Stream and Processes - Information and Technology - Partners and Suppliers
46
Six Factors in ITIL model:
- Political - Economic - Social - Technological - Legal - Environmental
47
Six Sigma was developed by Motorola with a goal of identifying and removing defects in its manufacturing process . It focuses on ______ ______ methodology.
Process improvement methodology
48
Goal or Six Sigma
Improve Process Quality by using statistical methods of measuring operation efficiency and reducing variation, defects, and waste.
49
CMM (Capability Maturity Model) 6 levels starting from 0:
Level 0: Nonexistent Management Level 1: Unpredictable Processes Level 2: Repeatable Processes Level 3: Defined Processes Level 4: Managed Processes Level 5: Optimized Processes
50
Framework designed to align an organization’s security architecture with its business strategy
SABSA
51
It is a framework that assists both business and IT by using a common language of understanding
ITIL
CISSP
flashcards
Decks in class (12)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions