Chapter 2– Personnel Security and Risk Management Concepts Flashcards

1
Q
  1. Which of the following is the weakest element in any security solution?
    Humans
A

Humans

Regardless of the specifics of a security solution, humans are the weakest element.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q
  1. When seeking to hire new employees, what is the first step?
    Create a job description
A

Create a job description
The first step in hiring new employees is to create a job description. Without a job description, there is no consensus on what type of individual needs to be found and hired.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  1. Which of the following is a primary purpose of an exit interview?
    To review the nondisclosure agreement
A

To review the nondisclosure agreement
The primary purpose of an exit interview is to review the nondisclosure agreement (NDA) and other liabilities and restrictions placed on the former employee based on the employment agreement and any other security-related documentation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  1. When an employee is to be terminated, which of the following should be done?
    Disable the employee’s network access just as they are informed of the termination.
A

Disable the employee’s network access just as they are informed of the termination.
You should remove or disable the employee’s network user account immediately before or at the same time they are informed of their termination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  1. If an organization contracts with outside entities to provide key business functions or services, such as account or technical support, what is the process called that is used to ensure that these entities support sufficient security?
    Third-party governance
A

Third-party governance

Third-party governance is the application of security oversight on third parties that your organization relies on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  1. A portion of the __________ is the logical and practical investigation of business processes and organizational policies. This process/policy review ensures that the stated and implemented business tasks, systems, and methodologies are practical, efficient, and cost-effective, but most of all (at least in relation to security governance) that they support security through the reduction of vulnerabilities and the avoidance, reduction, or mitigation of risk.
    Documentation review
A

Documentation review
A portion of the documentation review is the logical and practical investigation of business processes and organizational policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  1. Which of the following statements is not true?
    A. IT security can provide protection only against logical or technical attacks.
    B. The process by which the goals of risk management are achieved is known as risk analysis.
    C. Risks to an IT infrastructure are all computer based.
    D. An asset is anything used in a business process or task.
    Risks to an IT infrastructure are all computer based.
A

Risks to an IT infrastructure are all computer based.
Risks to an IT infrastructure are not all computer based. In fact, many risks come from noncomputer sources. It is important to consider all possible risks when performing risk evaluation for an organization. Failing to properly evaluate and respond to all forms of risk, a company remains vulnerable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  1. Which of the following is not an element of the risk analysis process?
    A. Analyzing an environment for risks
    B. Creating a cost/benefit report for safeguards to present to upper management
    C. Selecting appropriate safeguards and implementing them
    D. Evaluating each threat event as to its likelihood of occurring and cost of the resulting damage
    Selecting appropriate safeguards and implementing them.
A

Risk analysis includes analyzing an environment for risks, evaluating each threat event as to its likelihood of occurring and the cost of the damage it would cause, assessing the cost of various countermeasures for each risk, and creating a cost/benefit report for safeguards to present to upper management. Selecting safeguards is a task of upper management based on the results of risk analysis. It is a task that falls under risk management, but it is not part of the risk analysis process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
9.	Which of the following would generally not be considered an asset in a risk analysis?
A. A development process
B. An IT infrastructure
C. A proprietary system resource
D. Users' personal files
User’s personal files
A

User’s personal files
The personal files of users are not usually considered assets of the organization and thus are not considered in a risk analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  1. Which of the following represents accidental or intentional exploitations of vulnerabilities?
    Threat events
A

Threat events

Threat events are accidental or intentional exploitations of vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
11.	When a safeguard or a countermeasure is not present or is not sufficient, what remains?
A. Vulnerability
B. Exposure
C. Risk
D. Penetration
Vulnerability
A

Vulnerability

A vulnerability is the absence or weakness of a safeguard or countermeasure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  1. Which of the following is not a valid definition for risk?
    A. An assessment of probability, possibility, or chance
    B. Anything that removes a vulnerability or protects against one or more specific threats
    C. Risk = threat * vulnerability
    D. Every instance of exposure
    Anything that removes a vulnerability or protects against one or more specific threats
A

Anything that removes a vulnerability or protects against one or more specific threats
Anything that removes a vulnerability or protects against one or more specific threats is considered a safeguard or a countermeasure, not a risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  1. When evaluating safeguards, what is the rule that should be followed in most cases?
    The annual costs of safeguards should not exceed the expected annual costs of safeguards.
A

The annual costs of safeguards should not exceed the expected annual costs of safeguards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
14.	How is single loss expectancy (SLE) calculated?
Asset value ($) * exposure factor
A
Asset value ($) * exposure factor
SLE is calculated using the formula SLE = asset value ($) * exposure factor (SLE = AV * EF).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  1. How is the value of a safeguard to a company calculated?

ALE before safeguard – ALE after implementing the safeguard – annual cost of safeguard

A

The value of a safeguard to an organization is calculated by ALE before safeguard – ALE after implementing the safeguard – annual cost of safeguard [(ALE1 – ALE2) – ACS].

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  1. What security control is directly focused on preventing collusion?
    Separation of duties
A

Separation of duties
The likelihood that a co-worker will be willing to collaborate on an illegal or abusive scheme is reduced because of the higher risk of detection created by the combination of separation of duties, restricted job responsibilities, and job rotation.

17
Q
  1. What process or event is typically hosted by an organization and is targeted to groups of employees with similar job functions?
    Training
A

Training
Training is teaching employees to perform their work tasks and to comply with the security policy. Training is typically hosted by an organization and is targeted to groups of employees with similar job functions.

18
Q
  1. Which of the following is not specifically or directly related to managing the security function of an organization?
    Worker job satisfaction
A

Worker job satisfaction
Managing the security function often includes assessment of budget, metrics, resources, and information security strategies, and assessing the completeness and effectiveness of the security program.

19
Q
  1. While performing a risk analysis, you identify a threat of fire and a vulnerability because there are no fire extinguishers. Based on this information, which of the following is a possible risk?
    Damage to equipment
A

Damage to equipment
The threat of a fire and the vulnerability of a lack of fire
extinguishers lead to the risk of damage to equipment.

20
Q
  1. You’ve performed a basic quantitative risk analysis on a specific threat/vulnerability/risk relation. You select a possible countermeasure. When performing the calculations again, which of the following factors will change?
    Annualized rate of occurrence
A

Annualized rate of occurrence
A countermeasure directly affects the annualized rate of
occurrence, primarily because the countermeasure is designed to prevent the occurrence of the risk, thus reducing its frequency per year.