IS3110 CHAP 6 Flashcards
You are beginning an RA for a system. You should define both the operational characteristics and the mission of the system in the early stages of the RA.
TRUE OR FALSE
TRUE
Which of the following should you identify during a risk assessment?
- Assets
- Threats
- Vulnerabilities
- Countermeasure
- All the above
Assets
Threats
Vulnerabilities
Countermeasure
Of the following choices, what would be considered an asset?
- Hardware
- Software
- Personnel
- Data and information
- All the above
Hardware
Software
Personnel
Data and information
When defining the system for the risk assessment, what should you ensure is included?
- Only the title of the system
- The current configuration of the system
- A list of possible attacks
- A list of previous risk assessments
The current configuration of the system
What can you use to identify relevant vulnerabilities?
- Historical data
- Threat modeling
- CBA
- A and B only
- None of the above
None of the above
Which type of assessment can you perform to identify weaknesses in a system without exploiting the weaknesses?
- Vulnerability assessment
- Risk assessment
- Exploit assessment
- Penetration test
Vulnerability assessment
An acceptable use policy is an example of an ___ security control.
Administrative
Your organization requires users to log on with smart cards. This is an example of a ___ security control.
Technical
You use video cameras to monitor the entrance of secure areas of your building. This is an example of a ___ security control.
Physical
Which of the following should you match with a control to mitigate a relevant risk?
- Threats
- Vulnerabilities
- Threat/vulnerability pair
- Residual risk
Threat/vulnerability pair
What does a qualitative RA use to prioritize a risk?
- Probability and impact
- SLE, ARO, and ALE
- Safeguard value
- Cost-benefit analysis
Probability and impact
What does a quantitative RA use to prioritize a risk?
- Probability and impact
- SLE, ARO, and ALE
- Safeguard value
- Cost-benefit analysis
SLE, ARO, and ALE
Your organization purchased a control and installed it on several servers. This control is consuming too many server resources, and the servers can no longer function. What was not evaluated before the control was purchased?
- The cost and time to implement the control
- The operational impact of the control
- The in-place and planned controls
- The impact of the risk
The operational impact of the control
What is included in an RA that helps justify the cost of a control?
- Probability and impact
- ALE
- CBA
- POAM
CBA
What is created with a risk assessment to track the implementation of the controls?
- CBA
- POAM
- ALE
- SLE
POAM
Control in place from the rules and guidelines directed by upper-level management.
Administrative security control
A list used in a spam filter to block email. It is a list of email addresses or email domains. You add the addresses or domains to the list to ensure that email from these sources is always marked as spam.
Blacklist
A security control or safeguard. It is put into place to reduce a risk. It reduces the risk by reducing the vulnerability or threat impact.
Countermeasure
An attempt to discover what vulnerabilities an attacker can exploit. Exploit assessments are also called penetration tests.
Exploit assessment
An automated management tool. You can configure a setting once and it will apply to all users or computers equally. It is much more efficient than configuring the setting on individual computers.
Group Policy
A measure that is currently installed. Countermeasures can be in place or planned.
In-Place countermeasure
The effect of a security control on operations. It frequently consumes resources. These resources can impact normal operations if not controlled.
Operational impact
Controls the physical environment. It includes locks and guards to restrict physical access. It also includes heating and cooling systems to control the environment.
Physical security control
This is planned to be added at some point in the future and can be in place or planned.
Planned countermeasure
A control that uses computers or software to protect systems and provides automation.
Technical security control
A process used to identify possible threats on a system. Threat modeling attempts to look at a system from the attacker’s perspective.
Threat modeling
A process used to discover weaknesses in a system. The assessment will then prioritize the vulnerabilities to determine which weaknesses are relevant.
Vulnerability assessment
A list used in a spam filter to allow email. It is a list of email addresses or email domains. You add the addresses or domains to ensure that email from these sources is not marked as spam.
Whitelist
