CISMP (Certificate in Information Security Management Principles) Technical Security Controls Flashcards

24 sample cards from the Technical Security Controls deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. Which three security services does a digital signature provide?

   Integrity (message unaltered), authentication (proof of sender identity), and non-repudiation (sender cannot later deny signing). It does not by itself provide confidentiality.

2. What are a CRL and OCSP used for in PKI?

   Both check certificate revocation. A Certificate Revocation List (CRL) is a periodically published list of revoked certificate serial numbers. OCSP (Online Certificate Status Protocol) provides real-time, on-demand status checks for a single certificate.

3. What is the difference between data 'at rest', 'in transit', and 'in use', with an example control for each?

   At rest: stored data - full-disk/file encryption. In transit: data moving over networks - TLS/IPsec. In use: data being processed in memory - secure enclaves/memory protection and access controls.

4. How does TLS protect web traffic (HTTPS)?

   TLS uses asymmetric cryptography and certificates to authenticate the server and securely exchange a session key, then uses fast symmetric encryption for the session, providing confidentiality and integrity of data in transit.

5. What is a digital certificate's role in achieving non-repudiation for an email (e.g. S/MIME)?

   By signing the email with the sender's private key (whose corresponding certificate binds it to their verified identity), the sender cannot credibly deny authorship, and recipients can verify integrity and origin.

6. What is secure (hardened) system configuration?

   Configuring systems to a secure baseline by removing or disabling unnecessary services, ports, accounts, and software; changing default credentials; applying least privilege; and enabling security settings to reduce the attack surface.

7. Why are default credentials and unnecessary services a security risk?

   Default credentials are publicly known and easily exploited; unnecessary services/ports increase the attack surface and may contain vulnerabilities. Both should be removed/changed as part of system hardening.

8. What is a configuration baseline / security benchmark (e.g. CIS Benchmarks)?

   A documented, standardised set of secure configuration settings that systems are built to and measured against, providing a consistent, auditable hardened state and a reference for detecting unauthorised drift.

9. What is 'security by design' in software development?

   Building security into software from the earliest design stages and throughout the lifecycle (requirements, design, coding, testing) rather than adding it as an afterthought, reducing vulnerabilities and remediation cost.

10. What is a Secure Software Development Lifecycle (SSDLC / SDL)?

    An SDLC that integrates security activities at every phase: security requirements, threat modelling, secure design, secure coding standards, security testing (SAST/DAST), code review, and secure deployment/maintenance.

11. Why is input validation a critical secure-coding control?

    Untrusted input is the root of many attacks (SQL injection, XSS, buffer overflow). Validating, sanitising, and encoding input ensures data conforms to expected format and cannot be interpreted as code or commands.

12. Compare SAST and DAST in software security testing.

    SAST (Static Application Security Testing) analyses source code/binaries without executing it ('white-box', early in lifecycle). DAST (Dynamic Application Security Testing) tests the running application from the outside ('black-box', finds runtime/config flaws).

13. Why should development, testing, and production environments be separated?

    To prevent untested or insecure code, test data, and developer access from affecting live systems, to protect production data, and to enforce controlled, authorised promotion of changes between environments.

14. What is change management and why is it a security control?

    A formal process for requesting, assessing, approving, testing, implementing, and reviewing changes to systems. It reduces the risk that unauthorised or poorly tested changes introduce vulnerabilities, instability, or outages.

15. List the typical stages of a formal change management process.

    Request/raise change (RFC), assess/impact and risk analysis, authorise/approve (e.g. CAB), schedule, test, implement, review/verify, and close - with a defined rollback (back-out) plan.

16. What is configuration management and what is a CMDB?

    Configuration management is the process of identifying, controlling, and tracking the state of all configuration items (CIs) and their relationships. A CMDB (Configuration Management Database) is the repository recording these CIs and their attributes.

17. What is the purpose of having a documented back-out (rollback) plan in change management?

    To enable a system to be restored to its previous known-good state if a change fails or causes unexpected problems, minimising downtime and impact during a failed change.

18. Why is emergency change management still subject to controls?

    Even urgent fixes must be tracked, risk-assessed, and retrospectively authorised and documented to maintain accountability, avoid introducing new risks, and preserve an accurate configuration record and audit trail.

19. What is the security purpose of logging and monitoring?

    To record system, network, and user events so that security incidents can be detected, investigated, and responded to; to support accountability and forensic analysis; and to demonstrate compliance.

20. What is a SIEM and what does it do?

    Security Information and Event Management is a system that aggregates, normalises, and correlates logs and events from across an estate in real time to detect threats, generate alerts, support investigation, and aid compliance reporting.

21. Why must audit logs themselves be protected, and how?

    Attackers alter or delete logs to hide activity, so logs must be protected for integrity and availability via centralised/remote collection, write-once or append-only storage, access controls, hashing/signing, and tamper detection.

22. Why is accurate time synchronisation (e.g. NTP) important for logging?

    Correlating events across multiple systems during investigations requires consistent timestamps; synchronised clocks (via NTP) ensure log entries can be reliably ordered and matched to reconstruct an incident timeline.

23. What is the difference between active and passive monitoring?

    Active monitoring proactively probes/tests systems (e.g. sending requests, synthetic transactions, vulnerability scans). Passive monitoring observes existing traffic and logs without injecting activity (e.g. a NIDS or log analysis).

24. Why should log retention periods be defined, balancing two competing concerns?

    Logs must be kept long enough to support incident investigation and meet legal/regulatory obligations, but not so long as to create excessive storage cost and conflict with data protection/minimisation requirements - so a defined retention policy is needed.

What this deck covers

Technical Security Controls flashcards FAQ