Governance, Risk, and Compliance Flashcards
Which assessment examines physical and electronic information handling issues to determine whether security weaknesses exist?
Organizational risk assessment
In which location should all changes made to your organization’s network and computers be listed?
In the change management system
Which type of risk analysis is based on the expert judgment and intuition of members of an organization?
Qualitative risk analysis
Which risk response strategy does not implement any countermeasures, but allows risks to remain?
Acceptance
What is the definition of maximum tolerable downtime (MTD)
The maximum amount of time a business can tolerate a system remaining non-functional
What are the four types of personally identifiable information (PII)
- Personal characteristics
- Unique set of assigned numbers
- Descriptions of events or points in time
- Description of locations or places
What are some examples of personal characteristics for personally identifiable information (PII)?
- Full name
- Date of birth
- Height
- Ethnicity
- Place of birth
- Mother’s maiden name
- Biometric characteristics
What are some examples of unique sets of assigned numbers that can be used as personally identifiable information (PII)?
- Government ID
- Telephone number
- Driver’s license number
- PIN
What are some examples of descriptions of events or points in time that can be used as personally identifiable information (PII)?
- Arrest records
- Employment records
- Medical records
Can GPS information be used as an example of a description of location for personally identifiable information (PII)?
Yes
What does the acronym MTTR denote?
Mean time to recover or repair
When considering regulations set forth by multiple government entities, which regulations should be adopted by an organization?
The most restrictive?
What techniques attempts to predict the likelihood that a threat will occur and assign monetary values in the event a loss occurs?
Quantitative risk analysis
Which assessment examines network recorces and information to determine the probability of a successful attack by a hacker?
Network risk assessment
Which term is used for an agreement that is signed by two partnering companies?
Business partners agreement (BPA)
Which type of controls is implemented to secure physical access to an object, such as a building, a room, or a computer?
Physical or operational control
Upon which report does the business continuity plan depend most?
Business Impact Analysis (BIA)
What is the purpose of administrative controls?
Implement security policies based on procedures, standards, and guidelines
In which situation will you accept a risk?
When the cost of safeguard exceeds the amount of the potential loss
What is the term for the method of determining which kinds of controls are needed to classify and protect a company’s information assets?
Risk assessment
What is another term for unencrypted credentials?
Clear text credentials
Which risk response strategy involves reducing the probability or impact of a risk to an acceptable risk threshold?
Mitigation
What is another term for logical controls?
Technical controls
Which type of controls includes developing policies and procedures, screening personnel, conducting security awareness training, and implementing change control?
Administrative controls
