Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Security+ > Governance, Risk and Compliance > Flashcards

Governance, Risk and Compliance Flashcards

1
Q

Types of controls categories (3)

A

Managerial, technical, operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Difference between managerial and operational controls

A

Managerial is high-level risk management, assesment and mitigation plans, usually at the policy, plan and procedure level.

Operational is targeted to employee’s day-to-day operations, including physical security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AUP

A

Acceptable Use Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Risk formula

A

Probability times impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SLE

A

Single Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

EF

A

Exposure Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define Exposure Factor

A

cost of theat event divided by value of asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define SLE

A

cost of a threat event (value * EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ARO

A

Average Rate of Occurence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ALE

A

Average Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define ALE

A

The Average Loss Expectancy is the SLE * ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

MTTF

A

Mean Time to Fail (one-time)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

RTO

A

Recovery Time Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

RPO

A

Recovery Point Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Ways to handle risk (3 + 2)

A

Mitigation, Acceptance and Transference + Avoidance and Deterrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Change Management

A

Evaluation the impact of changes in the system as a whole

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DLP

A

Data Loss Prevention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Two locking doors with a space between them

A

Mantrap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cold vs Warm vs Hot Site

A

Cold is only backup space, with no IT infrastructure, needs equipment. Warm already has office space and critical IT equipment. Hot is ready to go with all infrastructure and systems needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Disaster Recovery Sites can be either ____ or _____

A

shared or exclusive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Incremental vs Differential Backup

A

Differential only saves files changed since the last full backup (only requires one delta), incremental are several deltas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

BCP

A

Business Continuity Plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DRP

A

Disaster Recovery Plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

BIA

A

Business Impact Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

BCP uses ____ to determine impact of down or lost systems

A

BIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

RAID 0

A

Striping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

RAID 1

A

Mirroring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

RAID 5

A

Striping + Parity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

RAID 6

A

Striping + Double Parity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

RAID 10

A

Striping + Mirroring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

RAID 5 requires at least _ disks

A

3 disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

RAID 10 requires at least _ disks

A

4 disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

CIA

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Security posture

A

baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Threat assessment

A

Only identifies threats, part of risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Vulnerability assessment

A

Identifies vulnerabilities, and therefore threats and risks, part of risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Banner grabbing

A

Used for service recognition during port or vulnerability scans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Scan from an administrative account

A

Credentialed scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Scan as an unauthorized user

A

Non-credentialeed scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

XSRF/CSRF

A

Cross-site request forgery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

AAA

A

Authentication, Authorization, and Accounting

42
Q

Diversity

A

Having different vendors for resiliency

43
Q

Diversity

A

Having different vendors for resiliency

44
Q

Windows specific security update

45
Q

Security control types (6)

A

Compensating, Corrective, Detective, Deterrent, Physical and Preventative

46
Q

There are _ control categories.

47
Q

There are _ control types.

48
Q

PCI DSS

A

Payment Card Information Data Security Standard

49
Q

PCI DSS, unlike GDPR, is an example of industry __-_____.

A

self-governance

50
Q

CCPA

A

California Consumer Privacy Act

51
Q

CIS CSC

A

Center for Information Security (CIS) Critical Security Controls (CSC)

52
Q

Top 20 controls are published by the

A

Center for Information Security (CIS)

53
Q

NIST RMF has _ steps.

54
Q

NIST RMF

A

NIST Risk Management Framework

55
Q

RMF vs NIST CSF

A

CSF was made for critical sectors, but it’s also used elsewhere.

56
Q

NIST CSF Categories (5)

A

Identify, Protect, Detect, Respond, Recover

57
Q

NIST CSF has _ categories.

A

5 categories

58
Q

ISO/IEC 27701:2019

A

Requirements and guidence for implementation and mantaining a Privacy Information Management System (PIMS)

59
Q

PIMS

A

Privacy Information Management System

60
Q

PIMS guidelines are found on ISO

61
Q

ISO 31000:2018

A

Risk Management Guidelines

62
Q

ISO 27000:2018

A

Overview of Information Security Management Systems and vocabulary

63
Q

ISMSs

A

Information Security Management Systems

64
Q

SOC 2 assesment

A

Service and Organizations Controls on Cybersecurity, under Statement on Standards for Attestation Engagements 18 (SSAE-18).

65
Q

Cybersecurity assesment related to SSAE-18 from the AICPA

66
Q

Two key artifacts of the Cloud Security Alliance (CSA) frameworks

A

Cloud Control Matrix (CCM) and Enterprise Architecture

67
Q

Enterprise Architecture

A

CSA Cloud methodology for cloud service capabilities

68
Q

Example of benchmarks and secure configuration guides

A

DoD Security Technical Implementation Guides (STIGs)

69
Q

DoD STIGs

A

Security Technical Implementation Guides

70
Q

RMF phases (7)

A

Prepare, Categorize systems, Select Controls, Implement, Assess controls, Systems Authorization by an authority, Continuous Monitoring

71
Q

RMF phases are meant to be implemented in an _____ manner

A

iterative manner

72
Q

Due Care vs Due Diligence vs Due Process

A

Due Care is ensuring day-to-day safe activities, due diligence is mantaining security procedures and evaluating them, due process regards employee rights and fairness when being investigated.

73
Q

EOSL

A

Equipment end of service line

74
Q

In the context of third-party risk management, MSA means

A

Measurement Systems Analysis

75
Q

In the context of a BPA, a general partnership implies

A

equal sharing of profits and liabilities

76
Q

A joint venture is a general partnership that has a

A

shorter time-frame

77
Q

Risk Assessment Phases (4)

A

Asset ID, Risk Analysis, Determine Risk Likelihood and Impact, Identify Cost of Solutions

78
Q

Inherent Risk vs Control Risk vs Residual Risk

A

Inherent is without controls, control is because of control failure or inadequacy, residual is what’s left after controls are implemented.

79
Q

COOP

A

Continuity of Operations Plan

80
Q

BCP is composed of

A

BIA, DRP, COOP

81
Q

BCP is composed of (3 + 2)

A

Risks, Sites + BIA, DRP, COOP

82
Q

MEFs

A

Mission Essential Functions

83
Q

PIA

A

Privacy Impact Assessment (PIA)

84
Q

A PIA starts with a…

A

PTA (Privacy Threshold Analysis)

85
Q

In the context of testing a DRP, AAR is

A

After-action reporting

86
Q

MTTR

A

Mean Time To Repair

87
Q

In the context of PIA, PHI is

A

Protected Health Information

88
Q

In the context of GDPR, SPI is

A

Sensitive Personal Information, including PII, PHI, beliefs, standpoints, genetic data, sexual orientatrion, etc

89
Q

At least in the US, the term “data owner” has been succeeded by

A

data steward, or data custodian

90
Q

The __________ determines what data will be collected and how it will be used within an organization

A

Data controller

91
Q

The overall program for the entire organization is called _____ management, while changes at the actual host or network level of baseline configurations is called ______ management.

A

change, configuration

92
Q

In DLP, tokenization refers to

A

Replacing sensitive data by tokens that refers to the actual data somewhere else.

93
Q

In the context of cloud storage, a CASB is

A

Cloud Access Security Broker, acting as an intermediary between users and cloud providers, enforcing enterprise security policy

94
Q

DevOps is characterized by

A

Bringing together PMs, Developers and Operations to enable rapid software development

95
Q

A mantrap is also called a…

A

Access Control Vestibule

96
Q

In the context of electronic locks, fail safe vs fail secure

A

Fail safe disengages a lock in an emergency, fail secure engages it.

97
Q

Perimeter Lightning must be

A

turned from dask to dawn

98
Q

access control model that will allow you to assign specific access policies depending on which network a user is on and not necessarily on the actual identity of the specific user.

A

Rule based AC

99
Q

In MAC, access is controlled by

100
Q

In DAC, ___ ___ define what users can access data.

A

data owners

CompTIA Security+ (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions