Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

cissp > Information Security Governance and Risk Management > Flashcards

Information Security Governance and Risk Management Flashcards

1
Q

What are 3 kinds of security policies

A

Organizational
Functional
System-specific

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Functional policy

A

Focus on specific security issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A standard

A

Specify the technology or approach that must be used to control a security risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A document from a medical research company specifies the use of multi-factor authentication with a combination of key cards and biometrics for protecting access to a database.
Which component of a policy framework does this document represent?

A

Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A security procedure

A

Provides step by step instructions on how to comply with a security policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A baseline

A

Describes minimum technical security standards that should be maintained consistently across an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A guideline

A

Recommendations that individuals can follow or use at their own discretion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

For an organization to adhere to legislative and regulatory compliance, its control frameworks need to be 5 things

A 
Consistent
Measurable
Standardized
Comprehensive
Modular
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

COSO - Committee of Sponsoring Organizations of the Treadway Comission

A

Formed to study and prevent fraud in financial reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ITIL - IT Infrastructure Library

A

set of 34 books written to improve IT service management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

COBIT - Control Objectives for Information and related Technology.

A

34 high level processes and 214 control objectives to support the processes. Examines effectiveness of confidentiality, integrity, availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ISO 27000

A

Standards for information security management

Contains 134 detailed information security controls based on 11 different areas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ISO 27001

A

Can be tailored and applied to organizations of varying sizes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

NIST SP 800-53

A

has 300 controls across 17 families and three classes. Mandatory for US fed govt agencies and contractors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

COBIT divides into how many domains?

A 
4
Planning and organization
acquisition and implementation
delivery and support
Monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CRAMM

A

Developed by CCTA in Britain for risk analysis. Incorporates securing IT hardware and software with physical and human resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How many stages in CRAMM methology?

A

3
Identifying and valuing assets
assessing threats and vulnerability
Selecting and recommending countermeasures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

FMEA - failure modes and effect analysis methodology

A

Assesses risk by examining the effects at 3 different levels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

FRAP - Facilitated risk analysis process

A

Qualitative risk analysis method that uses pre-screening to identify critical risk areas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

8 NIST risk assessment methodology steps

A 
characterize systems
identify threats
identify countermeasures
determine likelihood
determine impact
determine risk
recommend additional countermeasures
document results
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

OCTAVE - Operationally critical threat asset and vulnerability evaluation

A

uses a self-directed interdisciplinary team to analyze and evaluate security risks by reviewing operational risk and security practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

NIST

A

Qualitative risk assessment methodology established with healthcare in mind.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

PUSH

A 
service based risk assessment solution with 4 phases
Preparation
Universe definition
Scoring
Hitting the mark
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SOMAP - Security Officers Management and Analysis Project

A

Swiss non-profit guide and risk assessment tool for open-source systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How many stages in SOMAP?

A 
5
Risk treatment
Data collection
Threat analysis
vulnerability analysis
risk retention
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

VAR - value at risk methodology

A

theoretically based quantitative measure of information security risk.
Creates summary of worst loss due to security breach and create a workable balance between the cost of implementing controls and reducing risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Number of stages in VAR - value at risk methodology

A 
4
Mitigate risk
identify threats
estimate var
estimate likelihood
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Risk management definition

A

comprises the tasks and activities associated with assessing, mitigating, and preventing potential threats to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Why is risk management important?

A

helps ensure legal compliance

enables identification and protection of critical assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the two types of risk assessment?

A

qualitative

quantitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Risk Assessment step

Define System characterization

A

Set the scope of the assessment. Determine system and data criticality and sensitivity at this stage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Risk Assessment step

Define Threat identification

A

Identify anything that may harm an IT system and system information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Risk Assessment step

Define vulnerability identification

A

Review of system security procedures, design, implementation, or internal controls that may fail during an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Risk Assessment step

Define Control analysis

A

Review of current and planned countermeasures against a security requirements checklist.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Risk Assessment step

Define Likelihood determination

A

Consider the capability and motivation of threat sources in terms of vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Risk Assessment step

Define impact analysis

A

Quantify or rate potential losses of integrity, availability, or confidentiality of system data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Risk Assessment step

Define risk determination

A

Quantify the probability of attack, its impact, and the adequacy of current or planned controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Risk Assessment step

Define control recommendations

A

Consider the effectiveness, performance impacts, safety and reliability of control options.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Risk Assessment step

Define results determination

A

Present threat and vulnerability pairings with associated cost-benefit data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

4 types of risk responses

A

risk avoidance
risk transfer
risk mitigation
risk acceptance

41
Q

Risk transfer

A

Passing risk to a third party

42
Q

Which frameworks & methodologies are designed for performing risk assessments?

A

OCTAVE, CRAMM, VAR

43
Q

Which frameworks & methodologies are designed for implementing and auditing security controls?

A

COBIT, ITIL, COSO

44
Q

What 5 things should an information security officer be able to provide information about

A

each risk the organization is facing
likelihood and potential impact of a risk
costs and benefits of potential solutions
risk that will remain after a response is implemented
a time frame for responding to a risk

45
Q

6 Responsibilities of an information security officer

A

communicating risks to senior management
ensuring regulatory compliance
assisting auditors
oversee development and delivery of a security awareness program.
Monitor emerging threats and new technologies
evaluating security incidents and responses

46
Q

6 steps to reduce employee security policy violations

A 
prepare accurate job descriptions
check references
conduct background checks
ask new employees to sign employment agreements
oversee how employees perform
control terminations
47
Q

When determining the value of an intangible asset, which is the best approach?
A. determine the physical storage costs and multiply the expected life of the company.
B. With the assistance of a finance of accounting professional determine how much profit the asset has returned.
C. Review the depreciation of the intangible asset over the past three years.
D. Use the historical acquisition or development cost of the intangible asset.

A

B. With the assistance of a finance of accounting professional determine how much profit the asset has returned.

48
Q

Qualitative risk assessment is described by which of the following?
A. ease of implementation and it can be completed by personnel with a limited understanding of the risk assessment process.
B. Can be completed by personnel with a limited understanding of the risk assessment process and uses detailed metrics used for calculation of risk.
C. Detailed metrics used for calculation of risk and eas of implementation.
D. Can be completed by personnel with a limited understanding of the risk assessment process and detailed metrics used for the calculation of risk.

A

A. ease of implementation and it can be completed by personnel with a limited understanding of the risk assessment process.

49
Q

single loss expectancy SLE is calculated by using
A. asset value and annualized rate of occurrence.
B. asset value, local annual frequency estimate, and standard annual frequency estimate
C. asset value and exposure factor
D. local annual frequency estimate and annualized rate of occurrence.

A

C. asset value and exposure factor

50
Q

Consideration for which type of risk assessment to perform includes all of the following
A. culture of the organization, likelihood of exposure and budget
B. budget, capabilities of resources and likelihood of exposure
C. Capabilities of resources, likelihood of exposure and budget
D. Culture of the organization, budget, capabilities and resources

A

D. Culture of the organization, budget, capabilities and resources

51
Q

Security awareness training includes
A. Legislated security compliance objectives
B. Security roles and responsibilities for staff
C. The high-level outcome of vulnerability assessments
D. Specialized curriculum assignments, coursework and an accredited institution

A

B. Security roles and responsibilities for staff

52
Q

A signed user acknowledgement of the corporate security policy
A. Ensures that users have read the policy
B. Ensures that users understand the policy, as well as the consequences for not following the policy
C. Can be waived if the organization is satisfied that users have an adequate understanding of the policy
D. helps to protect the organization if a user’s behavior violates the policy.

A

D. helps to protect the organization if a user’s behavior violates the policy.

53
Q 
Effective security management
A. Achieves security at the lowest cost
B. reduces risk to an acceptable level
C. prioritizes security for new products
D. installs patches in a timely manner
A

B. reduces risk to an acceptable level

54
Q

Availability makes information accessible by protecting it from:
A. Denial of service, fires, floods, hurricanes, and unauthorized transactions.
B. fires, floods, hurricanes, unauthorized transactions and unreadable backup tapes
C. unauthorized transactions, fires, floods, hurricanes and unreadable backup tapes
D. denial of services, fires, floods, hurricanes, and unreadable tapes.

A

D. denial of services, fires, floods, hurricanes, and unreadable tapes.

55
Q 
To avoid bias, the security officer could report to any of the following
A. CEO, application development, or CFO
B. CIO, CFO, or application development
C. CFO, CEO, CIO
D. application development, CFO, CEO
A

C. CFO, CEO, CIO

56
Q

Tactical security plans are best used to
A. establish high-level security policies
B. enable enterprise/entity-wide security management
C. reduce downtime
D. deploy new security technology

A

D. deploy new security technology

57
Q 
Who is accountable for implementing information security?
A. everyone
B. senior management
C. security officer
D. data owners
A

C. security officer

58
Q 
Security is likely to be most expensive when addressed in which phase?
A. design
B. rapid prototyping
C. testing
D. implementation
A

D. implementation

59
Q

Information systems auditors help the organization
A. mitigate compliance issues
B. establish an effective control environment
C. identify control gaps
D. address information technology for financial statements.

A

C. identify control gaps

60
Q 
Long duration security projects
A. provide greater organizational value
B. increase ROI
C. minimize risk
D. increase completion risk
A

D. increase completion risk

61
Q

Setting clear security roles has the following benefits
A. establishes personal accountability, reduces cross-training requirements and reduces departmental turf battles
B. enables continuous improvement, reduces cross-training requirements and reduces departmental turf battles
C. Establishes personal accountability, establishes continuous improvement and reduces turf battles
D. Reduces departmental turf battles, reduces cross-training requirements and establishes personal accountability.

A

C. Establishes personal accountability, establishes continuous improvement and reduces turf battles

62
Q

Well-written security program policies are best reviewed
A. at least annually or at pre-determined organization changes
B. after major project implementations
C. When applications or operating systems are updated
D. When procedures need to be modified.

A

A. at least annually or at pre-determined organization changes

63
Q 
Orally obtaining a password from an employee is the result of 
A. social engineering
B. weak authentication controls
C. ticket granting server authorization
D. voice recognition software
A

A. social engineering

64
Q

A security policy which will remain relevant and meaningful over time includes the following:
A. Directive words such as shall, must, or will, technical specifications and is short in length
B. Defined policy development process, short in length and contains directive words such as shall, must, or will
C. Short in length, technical specifications and contains directive words such as shall, must or will
D. Directive words such as shall, must, or will defined policy development process and is short in length

A

D. Directive words such as shall, must, or will defined policy development process and is short in length

65
Q 
The ability of one person in the finance department to add vendors to the vendor database and subsequently pay the vendors violates which concept?
A. a well formed transaction
B. separation of duties
C. least privilege
D. data sensitivity level
A

B. separation of duties

66
Q 
Collusion is best mitigated through
A. Job rotation
B. Data classification
C. defining job sensitivity level
D. least privilege
A

A. Job rotation

67
Q 
Data access decisions are best made by
A. user managers
B. data owners
C. senior management
D. application developers
A

B. data owners

68
Q

Which of the following best describes the relationship between CobiT and ITIL?
A. CobiT is a model for IT governance, whereas ITIL is a model for corporate governance.
B. CobiT provides a corporate goverance roadmap, whereas ITIL is a customizable framework for IT service management.
C. CobiT defines IT goals, whereas ITIL provides the process level steps on how to achieve them.
D. CobiT provides a framework for achieving business goals, whereas ITIL defines a framework for achieving IT service level goals.

A

C. CobiT defines IT goals, whereas ITIL provides the process level steps on how to achieve them.

69
Q

What is a “safe harbor”?

A

A set of “good faith” conditions which if met, may temporarily or indefinitely protect the organization from the penalties of a new law or regulation.

70
Q

What information security act must federal agencies adhere to?

A

FISMA - Federal Information Security Management Act

71
Q

What directive protects personal information in Europe?

A

European Data Protection Directive

72
Q

How often should security policies be reviewed?

A

Annually

73
Q 
Jane has been charged with ensuring that clients' personal health information is adequately protected before it is exchanged with a new European Partner.  What data security requirements must she adhere to?
A. HIPPAA
B. NIST SP 800-66
C. Safe Harbor
D. European Union Principles on Privacy
A

C. Safe Harbor

74
Q

Global organizations that transfer data across international boundaries must abide by guidelines and transborder information flow rules developed by an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy. What organization is this?
A. Committee of Sponsoring Organizations of the Treadway Commission
B. The Organization for Economic Co-operation and Development.
C. CobiT
D. International Organization for Standardization

A

B. The Organization for Economic Co-operation and Development.

75
Q 
Steve, a department manager, has been asked to join a committee that is responsible for defining an acceptable level of risk for the organization, reviewing risk assessment and audit reports, and approving significant changes to security policies and programs.  What committee is he joining?
A. Security policy committee
B. Audit committee
C. risk management committee
D. Security steering committee
A

D. Security steering committee

76
Q

As head of sales, Jim is the information owner for the sales department. Which of the following is not Jim’s responsibility as information owner?
A. Assigning information classifications.
B. Dictating how data should be protected
C. Verifying the availability of data
D. Determining how long to retain data.

A

C. Verifying the availability of data

77
Q

Assigning data classification levels can help with all of the following except:
A. The grouping of classified information with hierarchical and restrictive security
B. Ensuring that nonsensitive data is not being protected by unnecessary controls
C. Extracting data from a database
D. Lowering the costs of protecting data

A

C. Extracting data from a database

78
Q

Which of the following is not included in a risk assessment?
A. Discontinuing activities that introduce risk
B. Identifying assets
C. Identifying threats
D. Analyzing risk in order of cost or criticality

A

A. Discontinuing activities that introduce risk

79
Q 
Sue has been tasked with implementing a number of security controls, including antivirus and antispam software, to protect the company's email system.  What type of approach is her company taking to handle the risk posed by the system?
A. Risk mitigation
B. Risk acceptance
C. Risk avoidance
D. Risk transference
A

A. Risk mitigation

80
Q

The integrity of data is not related to which of the following?
A. Unauthorized manipulation or changes to data
B. The modification of data without authorization
C. The intentional or accidental substitution of data
D. The extraction of data to share with unauthorized entities.

A

D. The extraction of data to share with unauthorized entities.

81
Q

There are several methods an intruder can use to gain access to a company’s assets. Which of the following best describes masquerading?
A. Changing an IP packet’s source address
B. Elevating privileges to gain access
C. An attempt to gain unauthorized access to as another user.
D. Creating a new authorized user with hacking tools

A

C. An attempt to gain unauthorized access to as another user.

82
Q

A number of factors should be considered when assigning values to assets. Which of the following is not used to determine the value of an asset?
A. The asset’s value in the external marketplace.
B. The level of insurance required to cover the asset.
C. The initial and outgoing costs of purchasing, licensing, and supporting the asset
D. The asset’s value to the organization’s production operations.

A

B. The level of insurance required to cover the asset.

83
Q

Jill is establishing a company wide sales program that will require different user groups with different privileges to access information on a centralized database. How should the security manager secure the database?
A. Increase the database’s security controls and provide more granularity
B. Implement access controls that display each user’s permissions each time they access the database.
C. Change the database’s classification label to higher security status.
D. Decrease the security so that all users can access the information as needed.

A

A. Increase the database’s security controls and provide more granularity

84
Q

As his company’s CISCO, George needs to demonstrate to the board of directors the necessity of a strong risk management program. Which of the following should George use to calculate the company’s residual risk?
A. threats x vulnerability x asset value = residual risk
B. SLE x frequency - ALE which is equivalent to residual risk
C. (threats x vulnerability x asset value ) x control gap = residual risk
D. (total risk - asset value) x countermeasures = residual risk

A

C. (threats x vulnerability x asset value ) x control gap = residual risk

85
Q

Authorization creep is to access controls what scope creep is to software development. Which of the following is not true of authorization creep?
A. Users have a tendency to request additional permissions without asking for others to be taken away.
B. It is a violation of least privilege.
C. It enforces the “need to know” concept
D. It commonly occurs when users transfer to other departments.

A

C. It enforces the “need to know” concept

86
Q

For what purpose was the COSO framwork developed?
A. To address fraudulent financial activities and reporting.
B. To help organizations install, implement, and maintain Cobit controls
C. To serve as a guideline for IT security auditors to use when verifying compliance.
D. To address regulatory requirements related to protecting private health information.

A

A. To address fraudulent financial activities and reporting.

87
Q

Susan, an attorney, has been hired to fill a new position at Widgets Inc. The position is chief privacy officer. What is the primary function of her new role?
A. Ensuring the protection of partner data
B. Ensuring the accuracy and protection of company financial information
C. Ensuring that security policies are defined and enforced.
D. Ensuring the protection of customer, company, and employee data

A

D. Ensuring the protection of customer, company, and employee data

88
Q 
Jared plays a role in his company's classification system.  In this role, he must practice due care when accessing data and ensure that the data is used only in accordance with allowed policy while abiding by the rules set for the classification of the data.  He does not determine, maintain, or evaluate controls, so what is Jared's role?
A. Data owner
B. Data custodian
C. Data user
D. Information systems auditor
A

C. Data user

89
Q 
Risk assessment has several different methodologies.  Which of the following official risk methodologies was not created for the purpose of analyzing security risks?
A. FAP
B. OCATAVE
C. ANZ 4360
D. NIST SP 800-30
A

C. ANZ 4360

90
Q

Which of the following is not a characteristic of a company with a security governance program in place?
A. Board members are updated quarterly on the state of security.
B. All security activity takes place within the security department.
C. Security products, services, and consultants are deployed in an informed manner.
D. The organization has established metrics and goals for improving security.

A

B. All security activity takes place within the security department.

91
Q

Michael is charged with developing a classification program for his company. Which of the following should he do first?
A. Understand the different levels of protection that must be provided.
B. Specify data classification criteria
C. Identify the data custodians
D. Determine protection mechanisms for each classification level.

A

A. Understand the different levels of protection that must be provided.

92
Q

ISO/IEC 27000 is part of a growing family of ISO/IEC information security management systems standards. It comprises information security standards published jointly by the International Organization for Standardization and the International Electrotechnical Commission. Which of the following provides an incorrect mapping of the individual standards that make up this family of standards?
A. ISO/IEC 27002 code of practice for information security management
B. ISO/IEC 27003 guideline for ISMS implementation
C. ISO/IEC 27004 guieldine for information security management measurement and metrics framemwork.
D. ISO/IEC 27005 guideline for bodies providing audit and certification of information security management systems.

A

D. ISO/IEC 27005 guideline for bodies providing audit and certification of information security management systems.

93
Q

CobiT defines

A

goals for the controls that should be used to properly manage IT and ensure IT maps to business needs
Addresses what is to be achieved

94
Q

ITIL defines

A

general activities necessary to achieve goals

Addresses how to achieve goals

95
Q

Name the health care related risk assessment methodology

A

NIST SP-800-66

96
Q

Which information role is responsible for verifying data availability?

A

information custodian

97
Q

What is the job of the information custodian?

A

Carry out the mandates of the information owner

98
Q

What is residual risk?

A

Risk left after countermeasures are implemented.

99
Q

What is the Chief privacy officer responsible for?

A

Ensuring the security of customer, company, and employee data.

cissp (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions