(5) Assets, Threats, and Vulnerabilities Flashcards
What is a risk?
Anything that can impact the confidentiality, integrity, or availability of an asset
The practice of labeling assets based on sensitivity and importance to an organization
A weakness that can be exploited by a threat
Any circumstance or event that can negatively impact assets
Anything that can impact the confidentiality, integrity, or availability of an asset
A risk is anything that can impact the confidentiality, integrity, or availability of an asset.
A security professional discovers a rogue access point on their company WiFi that is not managed by the networking team. The rogue device is altering and deleting sensitive records without authorization. What is the rogue device in this scenario?
Threat
Asset
Vulnerability
Risk
Threat
The rogue device is a threat because it is negatively impacting the company’s assets.
A product team is storing customer survey data for a new project in a cloud drive. The data is only accessible to product team members while the project is in development. What is this data’s asset type?
Public
Confidential
Customer data
Internal demo
Confidential
This data is confidential. Confidential assets such as this customer survey data can only be accessed by those working on a specific project.
What is the practice of labeling assets based on sensitivity and importance to an organization?
Asset management
Asset inventory
Asset restriction
Asset classification
Asset classification
Asset classification is the practice of labeling assets based on sensitivity and importance to an organization.
What is the practice of keeping data in all states away from unauthorized users?
Network
Cybersecurity
Asset
Information security
Information security
Information security, or InfoSec, is the practice of keeping data in all states away from unauthorized users.
An employee is promoted to a new role, so their workstation is transferred to a different office. As the employee’s workstation is being relocated, what data state are its files in?
At rest
In transit
In use
In storage
At rest
The files are at rest. Data is at rest when it is not being accessed. In this scenario, moving the workstation does not change the data state.
What is an example of data in transit?
A sent email is traveling over the network to reach its destination.
A manager is editing a report on their computer.
A spreadsheet file is saved on an employee’s hard drive.
A user logs in to their online account to review their messages.
A sent email is traveling over the network to reach its destination.
An email traveling over a network to its destination is an example of data in transit.
Fill in the blank: Data is in use when it is being _____ by one or more users.
accessed
ignored
transported
classified
accessed
Data is in use when it is being accessed by one or more users.
What types of risks do security plans address? Select three answers.
Damage to assets
Loss of information
Shift of market conditions
Disclosure of data
Damage to assets
Loss of information
Disclosure of data
What are the basic elements of a security plan? Select three answers.
Regulations
Procedures
Standards
Policies
Procedures
Standards
Policies
The basic elements of a security plan are policies, standards, and procedures. Policies are rules that reduce risk and protect information. Standards are references that inform how to set policies. And procedures are step-by-step instructions to perform a specific security task.
Fill in the blank: The NIST CSF is a _____ framework that consists of standards, guidelines, and best practices to manage cybersecurity risk.
voluntary
mandatory
limited
rigid
voluntary
The NIST CSF is a voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk. It is a comprehensive framework with a flexible design that can be used in any industry.
What are some benefits of the NIST Cybersecurity Framework (CSF)? Select three answers.
It’s adaptable to fit the needs of any business.
It can be used to identify and assess risk.
It is required to do business online.
It helps organizations achieve regulatory standards.
It’s adaptable to fit the needs of any business.
It can be used to identify and assess risk.
It helps organizations achieve regulatory standards.
Some benefits of the CSF are that it’s adaptable to fit the needs of any business, it helps organizations achieve regulatory standards, and it can be used to identify and assess risk.
An attacker spreads malicious software within an organization, which executes unauthorized actions on the organization’s systems. What does this scenario describe?
Procedure
Vulnerability
Regulation
Threat
Threat
Which of the following are examples of a vulnerability? Select two answers.
Attackers causing a power outage
A malfunctioning door lock
Malicious hackers stealing access credentials
An employee misconfiguring a firewall
A malfunctioning door lock
An employee misconfiguring a firewall
Which of the following refers to the process of tracking assets and the risks that affect them?
Asset inventory
Asset administration
Asset classification
Asset management
Asset management
What is an example of confidential information? Select two answers.
Press release
Employee contacts
Project documents
Marketing strategy
Project documents
Marketing strategy
Which of the following are examples of internal-only information? Select two answers.
Credit card numbers
Business plans
Employee records
Intellectual property
Business plans
Employee records
Which of the following can be prevented with effective information security? Select three answers.
Reputational damage
Compliance with regulations
Identity theft
Financial loss
Reputational damage
Compliance with regulations
Financial loss
What is an example of digital data at rest? Select two answers.
Email messages in an inbox
Letters on a table
Contracts in a file cabinet
Files on a hard drive
Email messages in an inbox
Files on a hard drive
Who should an effective security plan focus on protecting? Select three answers.
Business partners
Competitors
Customers
Employees
Business partners
Customers
Employees
What NIST Cybersecurity Framework (CSF) tier is an indication that compliance is being performed at an exemplary standard?
Level-3
Level-2
Level-4
Level-1
Level-4
Which component of the NIST Cybersecurity Framework (CSF) is used to compare the current state of a security plan to others?
Detect
Profiles
Compliance
Core
Profiles
What are categories of security controls? Select all that apply.
Privacy
Operational
Technical
Managerial
Operational
Technical
Managerial
Categories of security controls include technical, operational, and managerial. Technical controls include the technologies used to protect assets. Operational controls relate to maintaining the day-to-day security environment. And managerial controls are centered around how technical and operational controls reduce risk.
Fill in the blank: A data _____ decides who can access, edit, use, or destroy their information.
owner
custodian
protector
handler
owner
A data owner decides who can access, edit, use, or destroy their information.
A writer for a technology company is drafting an article about new software features that are being released. According to the principle of least privilege, what should the writer have access to while drafting the article? Select all that apply.
Login credentials of the software users
Other new software that is in development
The software they are reviewing
Software developers who are knowledgeable about the product
The software they are reviewing
Software developers who are knowledgeable about the product
The writer should have access to the software they are reviewing and the software developers who can help them understand what information is appropriate to share with readers.
Which privacy regulations influence how organizations approach data security? Select three answers.
Health Insurance Portability and Accountability Act (HIPAA)
General Data Protection Regulation (GDPR)
Payment Card Industry Data Security Standard (PCI DSS)
Infrastructure as a Service (IaaS)
Health Insurance Portability and Accountability Act (HIPAA)
General Data Protection Regulation (GDPR)
Payment Card Industry Data Security Standard (PCI DSS)
GDPR, PCI DSS, and HIPAA are notable privacy regulations that influence how organizations approach their information security.
Which of the following elements are required when using encryption? Select all that apply.
Key
Certificate
Cipher
Token
Key
Cipher
A cipher and a key are required when using encryption. This enables secure information exchange.
Which technologies are used in public key infrastructure (PKI) to securely exchange information online? Select two answers.
Digital certificates
General Data Protection Regulation (GDPR)
Platform as a service (PaaS)
Encryption algorithms
Correct
PKI uses encryption algorithms and digital certificates to securely exchange information online. Asymmetric and symmetric algorithms are used first to quickly and securely encrypt data. Digital certificates are used second as a way of signaling trust between the sender and receiver when exchanging encrypted data online.
Digital certificates
Encryption algorithms
PKI uses encryption algorithms and digital certificates to securely exchange information online. Asymmetric and symmetric algorithms are used first to quickly and securely encrypt data. Digital certificates are used second as a way of signaling trust between the sender and receiver when exchanging encrypted data online.
Fill in the blank: _____ encryption produces a public and private key pair.
Asymmetric
Hashing
Salting
Symmetric
Asymmetric
Asymmetric encryption produces a public and private key pair that are used to encrypt and decrypt information. The public key is shared with others while the data owner manages the private key.
An attacker gains access to a database where user passwords are secured with the SHA-256 hashing algorithm. Can the attacker decrypt the user passwords?
Yes. Hash algorithms produce a decryption key.
No. Hash algorithms do not produce decryption keys.
No. Hash algorithms do not produce decryption keys.
The attacker cannot decrypt the user passwords because they are stored as a hash value that is irreversible. Only symmetric and asymmetric encryption algorithms produce decryption keys.
What term describes being unable to deny that information is authentic?
Availability
Confidentiality
Integrity
Non-repudiation
Non-repudiation
Non-repudiation means that the authenticity of information cannot be denied. It also confirms that the sender of data is who they claim to be.
What factors do authentication systems use to verify a user’s identity? Select three answers.
Characteristic
Authorization
Knowledge
Ownership
Correct
Knowledge, ownership, and characteristic are the three factors used by authentication systems to verify a user’s identity.
Characteristic
Knowledge
Ownership
Knowledge, ownership, and characteristic are the three factors used by authentication systems to verify a user’s identity.
How do businesses benefit from implementing single sign-on (SSO) technology? Select two answers.
By providing a better user experience
By streamlining HTTP traffic between servers
By requiring multiple forms of identification
By simplifying their user management
Correct
Providing a better user experience and simplifying their user management are ways that businesses benefit from implementing SSO.
By providing a better user experience
By simplifying their user management
Providing a better user experience and simplifying their user management are ways that businesses benefit from implementing SSO.
A retail company has one employee that’s in charge of purchasing goods, another employee that’s in charge of approving new purchases, and a third employee that’s in charge of paying invoices. What security principle is the retail company implementing?
Authentication, authorization, and accounting (AAA)
Separation of duties
Least privilege
Non-repudiation
Separation of duties
The retail company is implementing the separation of duties principle. Separation of duties is the security principle that users should not be given levels of authorization that would allow them to misuse a system.
What are the categories of access controls? Select three answers.
Authorization
Authentication
Administration
Accounting
Authorization
Authentication
Accounting
The three categories of access controls are authentication, authorization, and accounting.
What credential does OAuth use to authenticate users?
A session cookie
A digital certificate
A one-time passcode (OTP)
An application programming interface (API) token
An application programming interface (API) token
OAuth uses an API token to authenticate users. An API token is a digital credential that is shared between a platform and a service provider to verify a user’s identity.
Which functions would fall under the category of operational security controls? Select two answers.
Responding to an incident alert
Providing security awareness training
Establishing trust using digital certificates
Exchanging encrypted information
Responding to an incident alert
Providing security awareness training
A large hotel chain collects customer email addresses as part of a national sweepstakes. As data custodians, what are the hotel chain’s responsibilities to protect this information? Select three answers.
To protect the data while in storage
To edit the data when necessary
To safely handle the data when it’s accessed
To securely transport the data over networks
To protect the data while in storage
To safely handle the data when it’s accessed
To securely transport the data over networks
