Exam 4 Flashcards
A detailed agreement between a client and a vendor that describes the work to be performed on a project is called:
A. MSA
B. SLA
C. WO
D. SOW
A statement of work (SOW) is a document routinely employed in the field of project management. It is the narrative description of a project’s work requirement.
A legal contract between the holder of confidential information and another person to whom that information is disclosed restricting that other person from disclosing the confidential information to any other party is referred to as:
A. ISA
B. NDA
C. BPA
D. SLA
An Interconnection Security Agreement (ISA) is a document that defines the security-related aspects of an intended connection between an agency system and an external system.
NDAs, or non-disclosure agreements, are legally enforceable contracts that create a confidential relationship between a person who has sensitive information and a person who will gain access to that information.
A service level agreement (SLA) is a negotiated agreement between two parties that outlines expectations of service.
A Service Level Agreement (SLA) in cybersecurity is a contract between a service provider, such as a Managed Security Service Provider (MSSP), and you, the client.
Which of the terms listed below refers to a formal contract between business partners outlining the rights, responsibilities, and obligations of each partner regarding the management, operation, and decision-making processes within the business?
A. MSA
B. SLA
C. BPA
D. MOA
Business partnership agreements (BPA) are legal agreements between partners. This is a legal agreement that outlines the terms, conditions, and expectations between the partners
Which of the following terms describes an investigation or assessment done upfront to ensure all facts and risks are known before proceeding?
A. Fiduciary duty
B. Due care
C. Standard of care
D. Due diligence
“Due Diligence” refers to the comprehensive and thorough analysis and assessment carried out by investors, before engaging in any investment activity.
Which of the terms listed below is used to describe actions taken to address and mitigate already identified risks?
A. Due diligence
B. Standard of care
C.Due care
D. Fiduciary duty
Due care refers to the reasonable steps that an organization takes to protect its information assets from unauthorized access, use, disclosure, modification, or destruction.
Under data privacy regulations, the individual whose personal data undergoes collection and processing is known as:
A. Data holder
B. Data owner
C. Data user
D. Data subject
A data holder is a business that holds consumer data and must transfer the data to an accredited data recipient at the consumer’s request.
Data users are responsible for ensuring that data is stored, processed, and handled securely, and that its integrity is maintained. This includes ensuring that data is reliable, has business value, and is of clear quality. Data users should also consider how the data will be used, how long it can be kept, and who it can be shared with.
A data subject is an individual whose personal data is being collected, used, or stored by an organization. Data subjects are also known as individuals concerned. They are entitled to specific rights and protections under data protection regulations to protect their privacy and autonomy, and to give them more control over their personal data.
Which of the following answers refers to an entity (such as an organization or individual) that determines the purpose and means of processing personal data?
A. Data processor
B. Data owner
C. Data controller
D. Data subject
A data controller is any person or entity that determines the purposes and means of the processing. A data processor is any person or entity that processes personal data on behalf of a data controller. A data controller or a data processor may be a natural or legal person, public authority, agency or other body.
An entity that acts under the instructions of a controller by processing personal data on behalf of the controller is called:
A. Data steward
B. Data processor
C. Data subject
D. Data custodian
Data Stewards help define, implement, and enforce data management policies and procedures within their specific Data Domain. A Data Trustee may delegate to the Data Steward the authority to represent the Data Trustee in data-related policy discussions.
A data processor is an entity that processes personal data on behalf of a data controller, who is responsible for creating the contract. Data processors can be legal or natural people, agencies, public authorities, or other bodies. They can include companies, third-party companies, cloud service providers, machines, or call centers.
A data custodian is an individual or organization that manages and safeguards data for data owners. Data custodians are responsible for protecting data from unauthorized access, alteration, destruction, or usage.
Which of the terms listed below refers to a legal principle that allows individuals to request the removal of personal information from Internet searches and other public sources?
A. De-identification
B. Right to be forgotten
C. Anonymization
D. Consent management
De-identification is the process of removing or altering information from a dataset to prevent it from being used to identify individuals. This can be done by masking, deleting, or otherwise obscuring sensitive data, such as personally identifiable information (PII). PII includes any data that can be used to directly or indirectly identify individuals, such as names, addresses, social security numbers, and dates of birth.
The “right to be forgotten” is the concept that an individual’s personal data stored by an organization or service provider has to be erased on the individual’s request.
A formal declaration by an auditor that they have performed their work in accordance with all relevant standards and regulations is referred to as:
A. Assertion
B. Certification
C. Validation
D. Attestation
A cyber attestation is an independent review and confirmation that an organization’s cybersecurity risk management program meets the standards and requirements set out by a governing body.
In the context of audits, an attestation is typically provided by:
A. Regulatory body
B. External auditor
C. Audit Committee
D. Internal audit team
Attestation in security is a process that verifies the authenticity and integrity of data, software, or hardware components.
In cybersecurity exercises, Red team takes on the role of:
A. An attacker
B. A defender
C. Both an attacker and a defender
D. An exercise overseer
A red team plays the role of the attacker by trying to find vulnerabilities and break through cybersecurity defenses.
In cybersecurity exercises, the defending team is known as:
A. Red team
B. Blue team
C. White team
D. Purple team
A blue team defends against attacks and responds to incidents when they occur.
In cybersecurity exercises, the role of an event overseer (i.e., the referee) is delegated to:
A. Red team
B. Blue team
C. White team
D. Purple team
A cybersecurity white team is a group of information security professionals who oversee simulated cyber-attack exercises, known as red teaming exercises, to assess an organization’s security posture and incident response capabilities. White teams act as neutral observers and referees, ensuring the exercises run smoothly and within the exercise’s pre-defined scope.
Their responsibilities include:
- Establishing rules of engagement
- Establishing metrics for assessing results
- Establishing procedures for providing operational security
- Preparing the final red teaming report and the remediation plan
- Providing a neutral perspective on the red team’s findings and recommendations
- Reviewing and analyzing the data collected during the exercise
In cybersecurity exercises, a purple team assumes the integrated role of all other teams (i.e., red, blue, and white).
True
X False
Purple teaming is a security methodology in which offensive security professionals (referred to as red teams) and Cyber Security Operations Centre (CSOC) professionals (referred to as blue teams) work closely together in order to enhance cyber capabilities through continuous feedback and knowledge transfer.
A penetration test performed by an authorized professional with the full prior knowledge on how the system that is to be tested works is called:
A. Black-hat hacking
B. White-box testing
C. Black-box testing
D. White-hat hacking
White box testing is an approach that allows testers to inspect and verify the inner workings of a software system—its code, infrastructure, and integrations with external systems.
White hats are often referred to as security researchers and act as independent contractors to help an organization tighten its cybersecurity. Some companies employ white hat hackers to work within their company to constantly try to hack their system, exposing vulnerabilities and preventing more dangerous attacks.
Which of the following terms is used to describe a penetration test in which the person conducting the test has limited access to information on the internal workings of the targeted system?
A. Black-box testing
B. Fuzz testing
C. Gray-box testing
D. White-box testing
When a white hat hacker discovers a vulnerability, they will exploit it only with permission and not tell others about it until it has been fixed. In contrast, the black hat will illegally exploit it or tell others how to do so. The gray hat will neither illegally exploit it nor tell others how to do so.
In a grey box penetration test, also known as a translucent box test, only limited information is shared with the tester. Usually this takes the form of login credentials. Grey box testing is useful to help understand the level of access a privileged user could gain and the potential damage they could cause
Fuzz testing or fuzzing is an automated software testing method that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities
In penetration testing, active reconnaissance involves gathering any type of publicly available information that can be used later for exploiting vulnerabilities found in the targeted system.
True
x False
A penetration test of a computer system performed without prior knowledge of how the system that is to be tested works is referred to as black-box testing.
x True
False
In penetration testing, passive reconnaissance relies on gathering information on the targeted system with the use of various non-invasive software tools and techniques, such as pinging, port scanning, or OS fingerprinting.
True
x False
