Chapter 1

Question 1

Confidentiality

Answer 1

Ensures that unauthorized individuals are not able to gain access to sensitive information.

Question 2

Integrity

Answer 2

Ensures that there are no unauthorized modifications to information or systems, either intentionally or unintentionally.

Question 3

Availability

Answer 3

Ensures that information and systems are ready to meet the needs of legitimate users at the time those users request them.

Question 4

Disclosure

Answer 4

The exposure of sensitive information to unauthorized individuals, also known as data loss. This is a violation of Confidentiality.

Question 5

Alteration

Answer 5

The unauthorized modification of information, and is a violation of Integrity.

Question 6

Denial

Answer 6

The unintended disruption of an authorized user’s legitimate access to information. This violates the principle of Availability.

Question 7

Financial Risk

Answer 7

The risk of monetary damage to the organization as the result of a data breach.

Question 8

Reputational Risk

Answer 8

The risk of negative publicity surrounding a security breach causes the loss of goodwill among customers, employees, suppliers, and other stakeholders.

Question 9

Strategic Risk

Answer 9

The risk that an organization will become less effective in meeting its major goals and objectives as a result of the breach.

Question 10

Operational Risk

Answer 10

The risk to the organization’s ability to carry out its day-to-day functions.

Question 11

Compliance Risk

Answer 11

The risk that when a security breach causes an organization to run afoul of legal or regulatory requirements.

Question 12

Technical Controls

Answer 12

Enforce confidentiality, integrity, and availability in the digital space. Examples: firewall rules, access control lists, intrusion prevention systems, and encryption.

Question 13

Operational Controls

Answer 13

The processes that we put in place to manage technology in a secure manner. Examples: access reviews, log monitoring, and vulnerability management.

Question 14

Managerial Controls

Answer 14

Procedural mechanisms that focus on the mechanics of the risk management process. Examples: periodic risk assessments, security planning exercises.

Question 15

Preventive Controls

Answer 15

To stop a security issue before it occurs.

Question 16

Detective Controls

Answer 16

To identify security evens that have already occurred.

Question 17

Corrective Controls

Answer 17

remediate security issues that have already occurred.

Question 18

Physical Controls

Answer 18

Security controls that impact the physical world. Examples: fences, perimeter lighting, locks, alarms.

Question 19

Compensating Controls

Answer 19

Designed to mitigate the risk associated with exceptions made to a security policy.

Question 20

Data At Rest

Answer 20

Data that resides on hard drives, tapes, in the cloud, or on other storage media.

Question 21

Data In Motion

Answer 21

Data that is in transit over a network.

Question 22

Data In Processing

Answer 22

Data that is actively in use by a computer system.

Question 23

DLP (Data Loss Prevention)

Answer 23

Systems that help organizations enforce information handling policies and procedures to prevent data loss and theft.

Question 24

Pattern Matching

Answer 24

DLP mechanism that watches for telltale signs of sensitive information. Examples: a number that is formatted like a Social Security number.

Question 25

Watermarking

Answer 25

Systems or administrators apply electronic tags to sensitive documents and then the DLP system can monitor systems and networks for unencrypted content containing those tags.

Question 26

Data Minimization

Answer 26

A technique that seeks to reduce risk by reducing the amount of sensitive information that we maintain on a regular basis.

Question 27

Hashing

Answer 27

A function that transforms a value in a dataset to a corresponding has value.

Question 28

Tokenization

Answer 28

Replaces sensitive values with a unique identifier using a lookup table.

Question 29

Masking

Answer 29

Partially redacts sensitive information by replacing some or all sensitive fields with blank characters.