Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SEC+ > ch 15 > Flashcards

ch 15 Flashcards

1
Q

A situation that involves exposure to some type of danger

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

To create a level of protection that mitigates the vulnerabilities to the threats and reduces the potential consequences

A

Managing risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A formal process of examining the seriousness of a potential threat as well as the likelihood that it will be carried out

A

Threat assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what classification of threat is the action that affects the long term goal of the organization

A

strategic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what classification of threat is the following (or not following) a regulation or standard

A

compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what classification of threat is the action of impact of financial decisions or market factors

A

financial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what classification of threat is the following events that impact the daily business of the organisation

A

operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what classification of threat is the events that affect information technology systems

A

technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what classification of threat is the following actions related to the management of the organisation

A

managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

a network that moves a product from the supplier to the customer
Should be viewed as assets to the enterprise and their threats should be cataloged

A

Supply chain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Involves an automated software vulnerability scan through a system

A

• Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Attempts to actually penetrate the system to perform a simulated attack

A

Intrusive vulnerability scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Uses only available information to hypothesize the status of the vulnerability

A

Non-intrusive vulnerability scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Designed to exploit any weaknesses in systems that are vulnerable
Penetration testing authorization should be obtained

A

Penetration test (pentest)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Methodology for making modifications and keeping track of changes
Ensures proper documentation of changes so future changes have less chance of creating a vulnerability

A

Change management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Two major types of changes that need proper documentation

A

Changes to system architecture

Changes to file or document classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

(C M T)

A

Change management team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Subject’s access level over an object, such as a file

A

Privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Body responsible for overseeing the changes

A

Change management team (C M T)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Process of assigning and revoking privileges to objects

A

Privilege management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Periodically reviewing a subject’s privileges over an object

Objective: determine if subject has the correct privileges

A

Privilege auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Components required to identify, analyze, and contain an incident

A

Incident response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Planning, coordination, communications, and planning functions needed to resolve incident

A

Incident handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The “framework” and functions required to enable incident response and incident handling within an organization

A

Incident management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

uses an “educated guess” based on observation

Typically assigns a numeric value (1-10) or label (High, Medium, or Low) that represents the risk

A

Qualitative risk calculation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

attempts to create “hard” numbers associated with the risk of an element in a system by using historical data
Can be divided into the likelihood of a risk and the impact of a risk being successful

A

Quantitative risk calculation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

(M T B F)

A

Mean Time Between Failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

(M T T R)

A

Mean Time To Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

(M T T F)

A

Mean Time To Failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

(F I T)

A

Failure In Time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

(A R O)

A

Annualized Rate of Occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Historical data can be used to determine the likelihood of a risk occurring within a year

A

Annualized Rate of Occurrence (A R O)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Comparing the monetary loss associated with an asset in order to determine the amount of money that would be list if the risk occurred

A

Risk Impact

34
Q

expected monetary loss every time a risk occurs

A

Single Loss Expectancy (S L E)

35
Q

expected monetary loss that can be expected for an asset due to risk over a one-year period

A

Annualized Loss Expectancy (A L E)

36
Q

(S L E)

A

Single Loss Expectancy

37
Q

(A L E)

A

Annualized Loss Expectancy

38
Q

SLE=AV x EF

A

Single Loss Expectancy (S L E)

39
Q

ALE=SLE x ARO

A

Annualized Loss Expectancy (A L E)

40
Q

Any device or process that is used to reduce risk

A

Security control

41
Q

– processes for developing and ensuring that policies and procedures are carried out

A

Administrative controls

42
Q

– security controls carried out or managed by devices

A

Technical controls

43
Q

makes a third party responsible for the risk

A

Transference

44
Q
  • involves identifying the risk and making the decision to not engage in the activity
A

Risk avoidance

45
Q

the attempt to address the risk by making it less serious

A

Mitigation

46
Q

Can be defined as that which replaces human physical activity

A

Automation

47
Q

the ability to continue to function as the size or volume of the enterprise data center expands to meet the growing demands

A

Scalability

48
Q

– the ability to revert to its former size after expanding

A

Elasticity

49
Q

– sustained and continual surveillance

A

Continuous monitoring

50
Q

available to help I T security personnel configure hardware devices and software to repel attacks

A

Secure configuration guides

51
Q

useful for configuring web servers, O S s, application servers, and network infrastructure devices

A

Vendor-specific guides

52
Q

Reviewing the configuration of systems to determine if security settings are correct

A

Configuration validation

53
Q

A copy of a properly configured and secured computer software system that can be replicated to other computers
Eliminates the need for configuring individualized security settings

A

Master image

54
Q

A type of document in which the standardized content has already been created
The user needs only to enter specialized and variable components
Reduces the amount of data to be entered and helps minimize errors that could introduce a risk

A

Template

55
Q

used to ensure that unwanted data is not carried forward (clean image is used)

A

Non-persistence tools

56
Q

what is a “lighweight” bootable image on a USB flash drive or optical media

A

live boot media

57
Q

what is restoring a device to previous secure condition

A

revert to unknown state

58
Q

what is undoing recent changes that cause errors or weaken security

A

rollback to unknown configuration

59
Q

what is an instance (image) of a virtual machine

A

snapshot

60
Q

Practices for reducing risk:

A

Security policies
Awareness and training
Agreements
Personnel management

61
Q

Communicates a consensus of judgment
Defines appropriate behavior for users
Identifies what tools and procedures are needed

A

Definition of a Policy

62
Q

A written document that states how an organization plans to protect the company‘s information technology assets

A

• Security Policy

63
Q

An overall intention and direction, formally expressed by the organization’s management
Details specific risks and how to address them
Provides controls to direct employee behavior
Helps create a security-aware organizational culture

A

Security policy functions

64
Q

Three approaches to trust

A

Trust everyone all of the time
Trust no one at any time
Trust some people some of the time

65
Q

(A U P)

A

Acceptable Use Policy

66
Q

Policy that defines actions users may perform while accessing systems
Users include employees, vendors, contractors, and visitors
Typically covers all computer use, including mobile devices

A

Acceptable Use Policy (A U P)

67
Q

grouping individuals and organizations into clusters or groups based on some sort of affiliation

A

Social media network

68
Q

outlines acceptable employee use of social media be enforced

A

Social media policy

69
Q

training styles

A

Visual
Auditory
Kinesthetic

70
Q

Formal contractual relationships as they related to security policy and procedures
Part of the standard operating procedures, or those actions and conduct that are considered normal

A

Interoperability agreements

71
Q

(S L A)

A

Service Level Agreement

72
Q

specifies what services will be provided and the responsibilities of each party

A

Service Level Agreement (S L A)

73
Q

(B P A)

A

Blanket Purchase Agreement

74
Q

a prearranged purchase or sale agreement between a government agency and a business

A

Blanket Purchase Agreement (B P A

75
Q

(M O U)

A

Memorandum of Understanding

76
Q

describes an agreement between two or more parties

A

Memorandum of Understanding (M O U)

77
Q

(I S A)

A

Interconnection Security Agreement

78
Q

an agreement that is intended to minimize security risks for data transmitted across a network

A

Interconnection Security Agreement (I S A)

79
Q

(N D A)

A

Non-disclosure agreement

80
Q

– a legal contract that specifies how confidential material will be shared between parties but restricted to others

A

Non-disclosure agreement (N D A)

81
Q

The process of authenticating the information supplied to a potential employer by a job applicant in the applicant’s resume, application, and interviews

A

background check

82
Q

A “wrap-up” meeting between management representatives and the person leaving an organization either voluntarily or through termination

A

exit interview

SEC+ (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions