Chapter 13 Flashcards
Your company is preparing to enter into a partner relationship with another organization. It will be necessary for the information systems used by each organization to connect and integrate with each other.
Which of the following is of primary importance as you take steps to enter into this partner relationship?
Ensure that all aspects of the relationship are agreed upon in writing
Ensure that the integration process maintains the security of each organization’s network
Identify how data ownership is to be determined
Ensure that both organizations have similar incident-response procedures
Ensure that the integration process maintains the security of each organization’s network
Your organization entered into an interoperability agreement (IA) with another organization a year ago. As a part of this agreement, a federated trust was established between your domain and the partner domain.
The partnership has been in the ongoing operations phase for almost nine months now. As a security administrator, which tasks should you complete during this phase? (Select two.)
Draft an MOU document
Disable user and groups accounts used by the partner organization to access your organization’s data
Negotiate the BPO agreement
Conduct periodic vulnerability assessments
Verify compliance with the IA documents
Conduct periodic vulnerability assessments
Verify compliance with the IA documents
When you inform an employee that he or she is being terminated, which of the following is the most important activity?
Give him or her two weeks’ notice
Allow him or her to complete their current work projects
Allow him or her to collect their personal items
Disable his or her network access
Disable his or her network access
Which of the following is defined as a contract that prescribes the technical support or business parameters a provider bestows to its client?
Certificate practice statement
Final audit report
Mutual aid agreement
Service level agreement
Service level agreement
What is a service level agreement (SLA)?
A guarantee of a specific level of service.
An agreement to support another company in the event of a disaster.
A contract with an ISP for a specific level of bandwidth.
A contract with a legal entity to limit your asset-loss liability.
A guarantee of a specific level of service.
In a high-security environment, which of the following is the most important concern when removable media is no longer needed?
Labeling
Reuse
Destruction
Purging
Destruction
How often should change-control management be implemented?
Only when a production system is altered greatly.
At regular intervals throughout the year.
Only when changes are made that affect senior management.
Any time a production system is altered.
Any time a production system is altered.
Which of the following is the primary purpose of change control?
Keep senior management apprised of the organization’s state of security
Increase security
Prevent unmanaged change
Create detailed documentation
Prevent unmanaged change
Change control should be used to oversee and manage changes over which aspect of an organization?
Physical environment
Personnel and policies
Every aspect
IT hardware and software
Every aspect
Your company has developed and implemented countermeasures for the greatest risks to their assets. However, there is still some risk left. What is the remaining risk called?
Loss
Residual risk
Risk
Exposure
Residual risk
You have conducted a risk analysis to protect a key company asset. You identify the following values:
Asset value = 400
Exposure factor = 75
Annualized rate of occurrence = .25
What is the annualized loss expectancy (ALE)?
25
75
100
175
475
75
What is the average number of times that a specific risk is likely to be realized in a single year?
Annualized rate of occurrence
Estimated maximum downtime
Exposure factor
Annualized loss expectancy
Annualized rate of occurrence
When analyzing assets, which analysis method assigns financial values to assets?
Quantitative
Qualitative
Acceptance
Transfer
Quantitative
Which of the following best defines single loss expectancy (SLE)?
The total monetary loss associated with a single occurrence of a threat.
The total cost of all countermeasures associated with protecting against a given vulnerability.
The monetary value of a single employee’s loss of productivity due to a successful attack.
The statistical probability of a malicious event.
The total monetary loss associated with a single occurrence of a threat.
A file server with data is consider which of the following asset types?
Intangible
Neither tangible nor intangible
Tangible
Both tangible and intangible
Both tangible and intangible
