Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ 601 > 5.0 Flashcards > Flashcards

5.0 Flashcards

1
Q

MTBF

A

Mean Time Between Failures
Provides a measure of a system’s reliability and is usually represented in hours. The average time a system or component operates before it fails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RTO

A

Recovery Time Objective
Identifies the maximum amount of time it can take to restore a system after an outage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

MTTR

A

Mean Time To Repair
A common measure of how long it takes to repair a given failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

RPO

A

Recovery point objective

Identifies a point in time where data loss is acceptable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Owner

A

Individual or entity responsible for making decisions about how data is collected, used, protected, and managed within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data Controller

A

Manages the purposes and means by which personal data is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data Processor

A

Entity processing personal data on behalf of a data controller, following instructions provided by the controller and ensuring data protection and security measures are implemented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data Custodian/Steward

A

Individual or team responsible for the physical or technical aspects of data management, including storage, security, access control, and maintenance, ensuring data integrity and compliance with policies and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ALE

A

Annualized Loss Expectancy
Estimated financial impact expected from a specific risk over a year, calculated by multiplying the Single Loss Expectancy (SLE) with the Annualized Rate of Occurrence (ARO).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SLE

A

Single Loss Expectancy
The value (or cost) of a loss expected from a single event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ARO

A

Annualized Rate of Occurrence

Estimation of how often a specific threat or risk is expected to occur within a year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

GDPR

A

General Data Protection Regulation
European Union regulation governing the protection, processing, and transfer of personal data of individuals within the EU and EEA (European Economic Area), focusing on data privacy and rights.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

PCI DSS

A

Payment Card Industry Data Security Standard

Security standard developed by major credit card companies to protect cardholder data, outlining requirements for secure payment processing, data encryption, access control, and compliance validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AUP

A

Acceptable Use Policy

A guideline that defines acceptable and unacceptable behaviors when using a system or service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Managerial controls

A

Focus on the management of risk or the management of the cybersecurity system.
Ex. Risk assessments, Vulnerability assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Operational controls

A

Helps ensure that the day-to-day operations of an organization comply with their overall security plan.
Ex. Awareness and training, Configuration management, Media protection, Physical and environmental protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Technical controls

A

Use technology such as hardware, software, and firmware to reduce vulnerabilities.
Ex. Encryption, Antivirus software, Firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Preventative (control type)

A

Act before an event, preventing it from advancing.
Ex. firewalls, encryption, locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Detective (control type)

A

Act during an event, alerting operators to specific conditions.
Ex. IDS, SIEM, CCTV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Corrective (control type)

A

Respond to and fix security incidents after they have been detected. They aim to minimize the impact and restore normal operations.

Ex. incident response plans, patches, backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Deterrent (control type)

A

Acts to discourage the attacker by reducing the likelihood of success from the perspective of the attacker.

Ex. security training, warning signs, compliance notices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Compensating (control type)

A

It is used to meet a requirement when there is no control available to directly address the threat.

Ex. encryption, MFA, network segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Physical (control type)

A

Are any controls that you can physically touch.

Ex. Key Card Systems, Biometric Scanners, Fire Suppression Systems, HVAC Systems, Fences and Gates, Bollards, Security Guards, Patrols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

CSA

A

Cloud Security Alliance

A nonprofit organization that promotes best practices for cloud security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Least Privilege

A

Should have only the rights and privileges necessary to perform its task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Gamification

A

Intertwines game-design elements within user training methods to increase participation and interaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

CTF

A

Capture the Flag
Practice hacking into a server to find data (the flag)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

CBT

A

Computer-based training

A computer program that has self-paced modules to facilitate skill development across a wide range of skills, and the flexibility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Supply Chain

A

A set of firms that operate together to manage the movement of goods and services between firms.

30
Q

Vendors

A

Firms or individuals that supply materials or services to a business

31
Q

SLA

A

Service Level Agreement

A contract between a service provider and a customer that outlines performance expectations, such as minimum uptime and maximum downtime levels.

32
Q

MOU

A

Memorandum of Understanding

A formal agreement between two or more parties that expresses an understanding of their intention to work together toward a common goal.

33
Q

MSA

A

Measurement Systems Analysis

Used to evaluate and assess the reliability and accuracy of measurement systems.

34
Q

BPA

A

Business Partnership Agreement

An agreement that outlines the terms and conditions of a partnership between two or more parties engaged in a business venture.

35
Q

EOL

A

End of Life

When the manufacturer quits selling an item.

36
Q

EOSL

A

End of Service Life

The provider of the item or service will typically no longer sell or update it.

37
Q

Data Retention

A

The management of the data lifecycle with an emphasis on when data reaches its end of useful life for an organization

38
Q

Data Governance

A

Managing data quality in enterprise systems through policies due to the involvement of many data owners and users.

39
Q

Change Management

A

Policies on how configurations should be changed.

40
Q

Change Control

A

Managing the details of the systems changes.

41
Q

Multi-party risk

A

Breaches involving multiple parties

42
Q

IP theft

A

Intellectual Property theft

Theft of ideas, inventions, and creative expressions.

43
Q

Risk Transference

A

Transferring the risk to another party, such as through outsourcing or insurance

44
Q

Risk Acceptance

A

A business decision to accept the risk and its potential consequences without taking any action.

45
Q

Risk Avoidance

A

Eliminating the risk by avoiding the activity that creates the risk

46
Q

Risk Mitigation

A

Decrease the risk level and invest in security systems

47
Q

Risk register

A

A tool in risk management and project management Sometimes used to fulfill regulatory compliance but often to track potential issues that can derail intended outcomes.

48
Q

Inherent risk

A

The amount of risk that exists in the absence of controls.

49
Q

Control Risk

A

Risk that internal controls within an organization may not effectively prevent or detect errors or fraud that could lead to material misstatement in financial reporting.

50
Q

Residual risk

A

The presence of risks in a system is an absolute—they cannot be removed or eliminated.

51
Q

DRP

A

Disaster Recovery Plan

Detailed plan for resuming operations after a disaster

52
Q

Proprietary Data

A

Data that is property of an organization

53
Q

PII

A

Personally Identifiable Information

Data that can be used to identify an individual

54
Q

PHI

A

Protected Health Information

Health information associated with an individual

55
Q

PIA

A

Privacy Impact Assessment

An analysis of how PII is handled through business processes and an assessment of risks to the PII during storage, use, and communication.

56
Q

Data Minimization

A

A principle requiring organizations to limit the data they collect and use

57
Q

Data Masking

A

Involves the hiding of data by substituting altered values.

58
Q

Anonymization

A

The process of protecting private or sensitive information by removing identifiers that connect the stored data to an individual. Once done can’t undo

59
Q

Pseudo-Anonymization

A

Replaces PII and other data with pseudonyms or artificial identifiers. Can revert back

60
Q

Single Point of Failure

A

Is a component within a system that can cause the entire system to fail if the component fails.

61
Q

Qualitative Risk

A

Assessment involves prioritizing risks based on their potential danger, such as low, medium, and high.

62
Q

Quantitative

A

Involves assigning numerical values to the likelihood of an event occurring and the impact it would have. Usually involves the use of metrics and models

63
Q

DPO

A

Data Protection Officers
Ensure the organization’s compliance with data protection laws and best practices.

64
Q

Separation of duties

A

a basic security principle that ensures that no single person can control all the elements of a critical function or system.

65
Q

Separation of Duties

A

A subject should be given only those privileges necessary to complete their job-related tasks.

66
Q

Least Privilege

A

A subject should be given only those privileges necessary to complete their job-related tasks.

67
Q

Social Media Analysis

A

Analysis of a potential employee’s social media during the hiring process to understand more about an individual based on their Internet presence.

68
Q

Risk control assessment

A

Occurs when a company periodically checks that the risk controls that they have in place are still effective with changing technology.

69
Q

Risk control self-assessment

A

Conducted by employees within the company, often through survey or department-level review.
Inherent risk

70
Q

Control risk

A

CompTIA Security+ 601 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions