Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ Self Sudy Dump > Governance, Risk, and Compliance > Flashcards

Governance, Risk, and Compliance Flashcards

1
Q

Which assessment examines physical and electronic information handling issues to determine whether security weaknesses exist?

A

Organizational risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In which location should all changes made to your organization’s network and computers be listed?

A

In the change management system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which type of risk analysis is based on the expert judgment and intuition of members of an organization?

A

Qualitative risk analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which risk response strategy does not implement any countermeasures, but allows risks to remain?

A

Acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the definition of maximum tolerable downtime (MTD)

A

The maximum amount of time a business can tolerate a system remaining non-functional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the four types of personally identifiable information (PII)

A
  • Personal characteristics
  • Unique set of assigned numbers
  • Descriptions of events or points in time
  • Description of locations or places
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some examples of personal characteristics for personally identifiable information (PII)?

A
  • Full name
  • Date of birth
  • Height
  • Ethnicity
  • Place of birth
  • Mother’s maiden name
  • Biometric characteristics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are some examples of unique sets of assigned numbers that can be used as personally identifiable information (PII)?

A
  • Government ID
  • Telephone number
  • Driver’s license number
  • PIN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are some examples of descriptions of events or points in time that can be used as personally identifiable information (PII)?

A
  • Arrest records
  • Employment records
  • Medical records
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can GPS information be used as an example of a description of location for personally identifiable information (PII)?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the acronym MTTR denote?

A

Mean time to recover or repair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When considering regulations set forth by multiple government entities, which regulations should be adopted by an organization?

A

The most restrictive?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What techniques attempts to predict the likelihood that a threat will occur and assign monetary values in the event a loss occurs?

A

Quantitative risk analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which assessment examines network recorces and information to determine the probability of a successful attack by a hacker?

A

Network risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which term is used for an agreement that is signed by two partnering companies?

A

Business partners agreement (BPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which type of controls is implemented to secure physical access to an object, such as a building, a room, or a computer?

A

Physical or operational control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Upon which report does the business continuity plan depend most?

A

Business Impact Analysis (BIA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the purpose of administrative controls?

A

Implement security policies based on procedures, standards, and guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In which situation will you accept a risk?

A

When the cost of safeguard exceeds the amount of the potential loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the term for the method of determining which kinds of controls are needed to classify and protect a company’s information assets?

A

Risk assessment

21
Q

What is another term for unencrypted credentials?

A

Clear text credentials

22
Q

Which risk response strategy involves reducing the probability or impact of a risk to an acceptable risk threshold?

A

Mitigation

23
Q

What is another term for logical controls?

A

Technical controls

24
Q

Which type of controls includes developing policies and procedures, screening personnel, conducting security awareness training, and implementing change control?

A

Administrative controls

25
Q

What can you do to ensure that staff understands which data they are handling?

A

Proper labeling

26
Q

What does the acronym MTTR denote?

A

Mean time to repair

27
Q

Which component of a computer use policy indicates that data stored on a company computer is not guaranteed to remain confidential?

A

No expectation of privacy policy

28
Q

Which type of controls work to protect system access, network architecture and access, control zones, auditing, and encryption and protocols?

A

Technical controls

29
Q

Regarding mean time before failure (MTBF) and mean time to repair (MTTR) as they relate to system reliability, which metrics are desirable?

A

A high MTBF and a low MTTR

30
Q

What is the purpose of technical controls?

A

To restrict access to objects and protect availability, confidentiality, and integrity

31
Q

What is the purpose of physical controls?

A

To work with administrative and technical controls to enforce physical access control

32
Q

What is a service level agreement (SLA)

A

A contract between a network service provider and a customer that specifies the services the network service provider will furnish?

33
Q

What is the formula for determining annualized loss expectancy (ALE)?

A

ALE = single loss expectation (SLE) x annualized rate of occurrence (ARO)

34
Q

What is the recommended action when the cost of the safeguard exceeds the amount of potential loss for a given risk?

A

Accept the risk

35
Q

Which type of controls dictates how security policies are implemented to fulfill the company’s security goals?

A

Administrative or management control

36
Q

What does the acronym MTBF denote

A

Mean time before failure

37
Q

What does the acronym RPO denote?

A

Recovery point objective

38
Q

Which type of controls includes controlling access to different parts of a building, implementing locking systems, installing fencing, implementing environmental controls, and protecting the facility perimeter?

A

Physical controls

39
Q

Which term refers to the loss potential of an asset for a single year?

A

Annualized loss expectancy (ALE)

40
Q

According to the CompTIA Security+ blueprint, what are the four categories of platform/vendor-specific guides?

A
  • Webserver
  • Operating system (OS)
  • Application server
  • Network infrastructure devices
41
Q

Which risk response strategy involves purchasing insurance to protect the organization should the risk occur?

A

Transference

42
Q

Which type of controls include access control mechanisms, password management, identification methods, authentication methods, and security devices?

A

Technical or logical controls

43
Q

What is the first step in a business impact analysis

A

To identify all of the organization’s business units

44
Q

What does the acronym MTBF denote?

A

Mean time between failures

45
Q

Which risk response strategy involves modifying the security plan to eliminate the risk or its impact

A

Avoidance

46
Q

What does the acronym RTO denote?

A

Recovery time objective

47
Q

What is the primary concern of the business impact analysis(BIA)?

A

Identifies all business resources that could be lost

48
Q

Which policy forces all users to organize their work areas to reduce the risk of data theft?

A

Clean desk policy

49
Q

Which term is used for an agreement between two or more parties where the parties cannot create a legally enforceable agreement?

A

Memorandum of Understanding (MoU)

Security+ Self Sudy Dump (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions