Logical and physical access controls and information asset protection concepts tested on the CISA exam.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the principle of least privilege?
- Grant users only the minimum access rights needed to perform their job functions, nothing more.
- Define discretionary access control (DAC).
- An access control model where the owner of a resource determines who can access it.
- Define mandatory access control (MAC).
- An access control model where access is determined by an administrator based on security labels and clearance levels, not the owner.
- Define role-based access control (RBAC).
- Access rights are assigned based on job roles, and users inherit permissions associated with their assigned roles.
- Define attribute-based access control (ABAC).
- Access decisions based on attributes of the user, resource, environment, and action being requested.
- What is the principle of separation of duties?
- No single person should have authority to authorize, approve, and reconcile the same transaction or critical action.
- What is a common measure of physical access control?
- Badges, key cards, biometric readers, security guards, visitor logs, and controlled entry points.
- What is multi-factor authentication (MFA)?
- Authentication requiring two or more types of evidence: something you know, have, are, or location-based.
- Define defense in depth.
- A security strategy using multiple layers of controls so if one fails, others still protect the asset.
- What are the three goals of information security?
- Confidentiality (prevent unauthorized disclosure), Integrity (prevent unauthorized modification), and Availability (ensure authorized access).
- What is information classification?
- Categorizing information by sensitivity level (public, internal, confidential, restricted) to determine appropriate protection controls.
- What is the purpose of an access control list (ACL)?
- Define which users or groups have specific permissions to access a resource.
- Define encryption.
- Converting readable data into a coded form using mathematical algorithms so only authorized parties with the decryption key can read it.
- What is symmetric encryption?
- Encryption where the same key is used for both encrypting and decrypting the data.
- What is asymmetric encryption?
- Encryption using a public key for encryption and a private key for decryption, or vice versa.