ISC2 SSCP domains: access controls, security operations, risk and analysis, incident response, cryptography, networks and systems security.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the principle of least privilege?
Show answer
Grant users only the minimum access permissions necessary to perform their job functions.- Define role-based access control (RBAC).
Show answer
An access control model where permissions are assigned to roles, and users are granted access based on their assigned roles.- What is discretionary access control (DAC)?
Show answer
An access control method where the owner of a resource controls who can access it and what permissions they have.- Define separation of duties.
Show answer
A security principle where critical tasks are split among multiple people to prevent any single person from gaining excessive power.- What is mandatory access control (MAC)?
Show answer
An access control model where access decisions are enforced by the system based on classification labels, not by the resource owner.- What are multi-factor authentication (MFA) requirements?
Show answer
Authentication must use at least two different types of factors: something you know, something you have, or something you are.- What is an access control list (ACL)?
Show answer
A list that specifies which users or system processes are granted or denied access to objects.- Define security baselines.
Show answer
Documented minimum security standards and configurations established as a reference point for systems and applications.- What is configuration management in security operations?
Show answer
The process of tracking, controlling, and maintaining approved configurations of systems and equipment.- Define patch management.
Show answer
The systematic process of identifying, testing, and deploying software updates to fix vulnerabilities and bugs.- What is change management in security?
Show answer
A formal process for planning, approving, documenting, and implementing changes to systems, networks, or applications.- Define security monitoring and logging.
Show answer
The continuous collection and review of security events and activities to detect and respond to potential threats.- What is a Security Operations Center (SOC)?
Show answer
A centralized facility where security analysts monitor networks, detect threats, and respond to security incidents.- Define vulnerability scanning.
Show answer
An automated process of identifying potential weaknesses and security flaws in systems, networks, or applications.- Define risk in information security.
Show answer
The probability that a threat will exploit a vulnerability, resulting in a negative impact on assets or operations.
FlashKeepers