Chapter 15 Flashcards
Which of the following threats would be classified as the actions of a hactivist
External threat
Which of these is NOT a response to risk?
Mitigation
Transference
Resistance
Avoidance
Resistance
Agnella was asked to create a report that listed the reasons why a contractor should be provided penetration testing authorization. Which of the follow would she NOT list in her report?
Legal authorization
Indemnification
Limit retaliation
Access to resources
Access to resources
Which of the following risk control types would use video surveillance systems and barricades to limit access to secure sites?
Operational
Managerial
Technical
Strategic
Technical
Which of the following approaches to risk calculation typically assigns a numeric value (1–10) or label (High, Medium, or Low) represents a risk?
Quantitative risk calculation
Qualitative risk calculation
Rule-based risk calculation
Policy-based risk calculation
Qualitative risk calculation
Which of the following is the average amount of time that it will take a device to recover from a failure that is not a terminal failure?
MTTF
MTTR
FIT
MTBF
MTTR (mean time to recover)
Which of the following covers the procedures of managing object authorizations?
Asset management
Task management
Privilege management
Threat management
Privilege management
Which statement does NOT describe a characteristic of a policy?
Policies define appropriate user behavior.
Policies identify what tools and procedures are needed.
Policies communicate a unanimous agreement of judgment.
Policies may be helpful if it is necessary to prosecute violators.
Policies communicate a unanimous agreement of judgment.
Tomassa is asked to determine the expected monetary loss every time a risk occurs. Which formula will she use?
AV
ARO
ALE
SLE
SLE (single loss expectancy)
Simona needs to research a control that attempts to discourage security violations before they occur. Which control will she research?
Deterrent control
Preventive control
Detective control
Corrective control
Deterrent control
Which statement is NOT something that a security policy must do?
State reasons why the policy is necessary.
Balance protection with productivity.
Be capable of being implemented and enforced.
Be concise and easy to understand.
State reasons why the policy is necessary.
What is a collection of suggestions that should be implemented?
Policy
Guideline
Standard
Code
Guideline
What describes the ability of an enterprise data center to revert to its former size after expanding?
Scalability
Elasticity
Contraction
Reduction
Elasticity
Which policy defines the actions users may perform while accessing systems and networking equipment?
End-user policy
Acceptable use policy
Internet use policy
User permission policy
Acceptable use policy
While traveling abroad, Giuseppe needs to use public Internet café computers to access the secure network. Which of the following non-persistence tools should he use?
Snapshot
Live boot media
Revert to known state
Secure Configuration
Live boot media