Logical and physical access controls and information asset protection concepts tested on the CISA exam.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- Define discretionary access control (DAC).
Show answer
An access control model where the owner of a resource determines who can access it.- Define mandatory access control (MAC).
Show answer
An access control model where access is determined by an administrator based on security labels and clearance levels, not the owner.- Define role-based access control (RBAC).
Show answer
Access rights are assigned based on job roles, and users inherit permissions associated with their assigned roles.- Define attribute-based access control (ABAC).
Show answer
Access decisions based on attributes of the user, resource, environment, and action being requested.- What is the principle of separation of duties?
Show answer
No single person should have authority to authorize, approve, and reconcile the same transaction or critical action.- What is a common measure of physical access control?
Show answer
Badges, key cards, biometric readers, security guards, visitor logs, and controlled entry points.- What is multi-factor authentication (MFA)?
Show answer
Authentication requiring two or more types of evidence: something you know, have, are, or location-based.- Define defense in depth.
Show answer
A security strategy using multiple layers of controls so if one fails, others still protect the asset.- What are the three goals of information security?
Show answer
Confidentiality (prevent unauthorized disclosure), Integrity (prevent unauthorized modification), and Availability (ensure authorized access).- What is the purpose of an access control list (ACL)?
Show answer
Define which users or groups have specific permissions to access a resource.- Define encryption.
Show answer
Converting readable data into a coded form using mathematical algorithms so only authorized parties with the decryption key can read it.- What is symmetric encryption?
Show answer
Encryption where the same key is used for both encrypting and decrypting the data.- What is asymmetric encryption?
Show answer
Encryption using a public key for encryption and a private key for decryption, or vice versa.- What is an asset inventory?
Show answer
A comprehensive record of all information assets owned by the organization, including hardware, software, data, and personnel.- Define vulnerability assessment.
Show answer
A systematic process to identify security weaknesses in systems, networks, and applications.
FlashKeepers