CISSE Advanced Level
Information Systems Security flashcards
Read the question, say the answer to yourself, then turn the card to check. The first 10 of 50 cards are free; the rest come with the subject.
Card 1 of 50
Jump to a card
Complete Flashcard Reference
Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 40 come with the subject.
What are the three objectives of the CIA triad, and what breaches each?
Confidentiality: information is disclosed only to those authorised to see it. Breached by an unauthorised read. Integrity: information is accurate and not altered without authorisation. Breached by an unauthorised write. Availability: information and systems are accessible to authorised users when needed. Breached by a denial-of-service attack or a ransomware lockout.
What is the difference between an IDS and an IPS?
An Intrusion Detection System monitors traffic or host activity and generates an alert, without taking blocking action. An Intrusion Prevention System sits inline in the traffic path and can act automatically: drop packets, reset a connection or block a source address in real time.
How does ISO/IEC 27001 differ from the NIST Cybersecurity Framework?
ISO/IEC 27001 is a standard: certifiable requirements for an Information Security Management System, and an organisation either conforms or does not. The NIST CSF is a voluntary framework of functions and outcomes. It certifies nothing; it is used to structure a programme and assess maturity against a target profile. Many organisations use both together.
What principles does section 25 of the Data Protection Act, 2019 set out?
Lawfulness, fairness and transparency. Purpose limitation. Data minimisation. Accuracy. Storage limitation. Integrity and confidentiality. Accountability.
What are management, operational and technological controls?
Management: policies, procedures and organisational decisions that guide how security is managed, e.g. security awareness training requirements. Operational: day-to-day procedures people carry out, e.g. change management and patch management. Technological: mechanisms enforced by hardware or software, e.g. a firewall or encryption.
What makes a penetration test lawful in Kenya?
A signed authorisation, obtained during planning and scoping, defining exactly which systems, methods and timeframe the client has consented to. Without it the tester's steps are the unauthorised access the Computer Misuse and Cybercrimes Act, 2018 criminalises, and a tester who exceeds the agreed scope loses that protection for the excess conduct.
What is the difference between the Recovery Time Objective and the Recovery Point Objective?
RTO: the maximum acceptable time to restore a system after failure, how long the outage may last. RPO: the maximum acceptable amount of data loss, measured in time since the last good backup.
What are hot, warm and cold disaster recovery sites?
Hot site: fully equipped and ready to operate; fastest recovery, highest ongoing cost. Warm site: partially equipped, needs some setup; the middle ground on cost and speed. Cold site: bare facility with power and connectivity only; slowest recovery, lowest ongoing cost. Choose against both the RTO and the budget.
How does an IS security audit differ from a penetration test?
An audit tests whether the right controls exist, are properly documented and are operated as designed, against a stated standard or policy. A penetration test tests whether those controls actually withstand a genuine attempt to defeat them.
Who does what in a typical security roles and responsibilities matrix?
Board and senior management: set risk appetite, approve strategy, hold the CISO accountable. CISO: owns the security programme and turns strategy into policy. IT and security operations staff: run the technological controls day to day. Data or asset owners: business-side managers accountable for their own data's classification and protection. All staff: follow policy, complete training, report suspected incidents.
Which two objectives extend the CIA triad in modern practice?
This answer comes with Information Systems Security. Buy the subject
How do a threat, a vulnerability and a risk differ?
This answer comes with Information Systems Security. Buy the subject
What are the four tiers of a typical information asset classification scheme?
This answer comes with Information Systems Security. Buy the subject
What does the scope of IS security cover beyond the technical?
This answer comes with Information Systems Security. Buy the subject
What do MTTD and MTTR measure?
This answer comes with Information Systems Security. Buy the subject
What is ISO/IEC 27002?
This answer comes with Information Systems Security. Buy the subject
What are the core functions of the NIST Cybersecurity Framework?
This answer comes with Information Systems Security. Buy the subject
Which two Kenyan statutes carry the most direct weight for an IS security programme?
This answer comes with Information Systems Security. Buy the subject
What structures does security governance typically rely on?
This answer comes with Information Systems Security. Buy the subject
How does a network-based IDS differ from a host-based IDS?
This answer comes with Information Systems Security. Buy the subject
What is the weakness of signature-based and of anomaly-based detection?
This answer comes with Information Systems Security. Buy the subject
Why is an IPS tuned more conservatively than an IDS?
This answer comes with Information Systems Security. Buy the subject
Which network and endpoint controls prevent intrusion?
This answer comes with Information Systems Security. Buy the subject
What is the 3-2-1 backup rule, and what else supports recovery from failure?
This answer comes with Information Systems Security. Buy the subject
Which data holdings are typically the most critical to protect?
This answer comes with Information Systems Security. Buy the subject
What is data loss prevention, and how do endpoint and network DLP differ?
This answer comes with Information Systems Security. Buy the subject
Why does encryption still protect data when other controls fail?
This answer comes with Information Systems Security. Buy the subject
How does privacy differ from confidentiality?
This answer comes with Information Systems Security. Buy the subject
What are privacy by design, data minimisation and purpose limitation?
This answer comes with Information Systems Security. Buy the subject
What does a ransomware attack on a database of customers' personal data trigger?
This answer comes with Information Systems Security. Buy the subject
What did Regus Kenya Limited v Data Protection Commissioner (2025) show?
This answer comes with Information Systems Security. Buy the subject
What are preventive, detective and corrective controls?
This answer comes with Information Systems Security. Buy the subject
Which controls count as technological controls?
This answer comes with Information Systems Security. Buy the subject
How do you tell which kind a control is: management, operational or technological?
This answer comes with Information Systems Security. Buy the subject
What types of security policy should an organisation have?
This answer comes with Information Systems Security. Buy the subject
What are the five stages of the security policy lifecycle?
This answer comes with Information Systems Security. Buy the subject
Why is 'staff should use strong passwords' a poor policy clause?
This answer comes with Information Systems Security. Buy the subject
Why must a security policy set be derived from the organisation's own strategy?
This answer comes with Information Systems Security. Buy the subject
What are the six stages of the penetration testing process?
This answer comes with Information Systems Security. Buy the subject
What classes of tool does a penetration tester use?
This answer comes with Information Systems Security. Buy the subject
What should a penetration test report contain?
This answer comes with Information Systems Security. Buy the subject
What is architectural risk analysis, and which techniques does it use?
This answer comes with Information Systems Security. Buy the subject
What are functional, non-functional and compliance-driven security requirements?
This answer comes with Information Systems Security. Buy the subject
How is a security culture built?
This answer comes with Information Systems Security. Buy the subject
What are the five stages of incident management?
This answer comes with Information Systems Security. Buy the subject
What does a Business Impact Analysis do?
This answer comes with Information Systems Security. Buy the subject
How does business continuity planning differ from disaster recovery planning?
This answer comes with Information Systems Security. Buy the subject
What are the three types of IS security audit?
This answer comes with Information Systems Security. Buy the subject
What are the stages of the IS audit process, and the main fieldwork techniques?
This answer comes with Information Systems Security. Buy the subject
What does each finding in an IS audit report record?
This answer comes with Information Systems Security. Buy the subject
How to revise with these cards
- Answer out loud or on paper before you turn the card: recalling is what fixes it.
- Go through the deck in short sessions of ten to fifteen minutes, every day.
- Shuffle once you know the order, so you are not answering from memory of the sequence.
- When a card catches you out, read the chapter it links to, then try the topic in a past paper.