Domain 1

Question 1

What is a Threat

Answer 1

potentially harmful occurrance

Question 2

what is a vulnerability

Answer 2

weakness that allows a threat to cause harm

Question 3

Formula for Risk

Answer 3

Risk = threat x vulnerability

Question 4

What is impact

Answer 4

severity of the damage

Question 5

How to calculate ALE (Annualized Loss Expectancy)

Answer 5

Single Loss expectancy x annual rate of occurancy

Question 6

Quantitative Risk

Answer 6

uses hard metrics, such as dollars (quantity)

Question 7

What is the NIST for Risk Management

Answer 7

800-30

Question 8

What is Policy

Answer 8

High level management directive, also mandatory

Question 9

Components of a Policy

Answer 9

Purpose, scope, responsibilities and compliance

Question 10

NIST for Policy type

Answer 10

800-12

Question 11

Three types of Policy

Answer 11

Program, issue-specific and system specific

Question 12

Procedure

Answer 12

step by step guide

Question 13

Standard

Answer 13

describe specific use of technology, mandatory

Question 14

Guidelines

Answer 14

recommendations (discretionary)

Question 15

Baseline

Answer 15

minimum security (discretionary)

Question 16

Senior Management

Answer 16

ensuring organization assets are protected

Question 17

Data Owner

Answer 17

Determine data sensitivity labels, perform management duties

Question 18

Data Custodian

Answer 18

data backup, restoration, patches, config anti-virus

Question 19

HIPAA

Answer 19

Health Insurance

Question 20

SOX (Sarbanes-Oxley)

Answer 20

Protects publicly traded data

Question 21

GLBA (Gramm-Leach-Bliley Act)

Answer 21

Protects financial information

Question 22

What is OCTAVE

Answer 22

describes 3 phase process for managing risk

Question 23

Octave Phase 1

Answer 23

ID staff knowledge, assets and threats

Question 24

Octave Phase 2

Answer 24

ID vulnerabilities and evaluates safeguard

Question 25

Octave Phase 3

Answer 25

Risk analysis and mitigation strategies

Question 26

ISO 17799 was renumbered to

Answer 26

ISO 27002 in 2005

Question 27

ISO 27002 describes what?

Answer 27

information security best practices

Question 28

ISO 27001 describes what?

Answer 28

process for auditing those best practices of 27002

Question 29

What is COBIT?

Answer 29

control framework, provides management with a governance model

Question 30

COBIT has how many processess

Answer 30

34 IT processess

Question 31

ITIL (Information Tech Infrastructure Library)

Answer 31

framework for providing best services in IT Service Management (ITSM)