Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IS3340 SEC. STRAT. IN WINDOWS PLATFORM & APPS. > IS3340 CHAPTER 14 > Flashcards

IS3340 CHAPTER 14 Flashcards

1
Q

The number of times a threat might affect an organization during a one-year time frame is called ___?

A

ANNUAL RATE OF OCCURRENCE (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The amount of loss that an organization can expect to have each year due to a particular risk. (The equation
ALE=SLE x ARO is used) This is called ___?

A

ANNUALIZED LOSS EXPECTANCY (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Plans that address the recovery of an organization’s business processes and functions in the event of a disaster. They tend to be comprehensive for returning an organization to normal operating conditions. This is called ___?

A

BUSINESS CONTINUITY (BC) PLANS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A process that identifies key business operations and the resources used to support those processes. It also identifies maximum tolerable down-time for critical business functions and is called ___?

A

BUSINESS IMPACT ANALYSIS (BIA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A basic type of disaster recovery and business continuity test that checks to make sure that supplies and inventory items needed for an organization’s business recovery are on hand is called ___?

A

CHECKLIST TEXT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A backup site for disaster recovery and business continuity planning purposes that is little more than reserved space. It does not have any hardware or equipment ready for business operations. It will have electrical service, but most likely won’t have network connectivity. It can take weeks to months for an organization ready this site for business operations and is called a ___?

A

COLD SITE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Any situation where a person’s private interests and professional obligations collide. Independent observers might question whether a person’s private interests improperly influence his or her professional decision. This is called ___?

A

CONFLICTS OF INTEREST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A sudden, unplanned event that negatively affects the organization’s critical business functions for an unknown period is called a ___?

A

DISASTER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Plans that address the recovery of an organization’s information technology systems in the event of a disaster is called ___?

A

DISASTER RECOVERY (DR) PLANS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The percentage of asset loss that is likely to be caused by an identified threat or vulnerability is called ___?

A

EXPOSURE FACTOR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A disaster recovery and business continuity test where an organization stops all of its normal business operations and transfers those operations to its backup site. This is the most comprehensive form of disaster recovery and business continuity plan test. This is called ____?

A

FULL INTERRUPTION TEST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

An operational backup site for disaster recovery and business continuity planning purposes. It has equipment and infrastructure that is fully compatible with an organization’s main facility. It is not staffed with people. It can become operational within minutes to hours after a disaster and is called ___?

A

HOT SITE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A contingency plan that helps an organizations respond to attacks against an organization’s information technology infrastructure is called___?

A

INCIDENT RESPONSE (IR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The amount of time that critical business processes and resources can be offline before an organization begins to experience irreparable business harm is called ___?

A

MAXIMUM TOLERABLE DOWNTIME (MTD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A fully operational backup site for disaster recovery and business continuity planning purposes. This site actively runs an organization’s information technology function in parallel with the organization’s mail processing facility. It is fully staffed and has all necessary data and equipment to continue business operations. This is called ___?

A

MIRRORED SITE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A disaster recovery and business continuity test where an organization tests its ability to recover its information technology systems and its business data. In this type of test, the organization brings its backup recovery sites online. It will then use historical business data to test the operations of those systems. This is called ___?

A

PARALLEL TEST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A marketing field that manages an organization’s public image is called ___?

A

PUBLIC RELATIONS (PR)

18
Q

A risk analysis method that uses scenarios and ratings systems to calculate risk and potential harm. This analysis does not attempt to assign money value to assets and risk. This is called ___?

A

QUALITATIVE RISK ANALYSIS

19
Q

A risk analysis method that uses real money costs and values to determine the potential monetary impact of threats and vulnerabilities is called ___?

A

QUANTITATIVE RISK ANALYSIS

20
Q

The loss that an organization has when a potential threat actually occurs is called ___?

A

REALIZED RISK

21
Q

A process of identifying threats and vulnerabilities that an organization faces. It can be quantitative, qualitative, or a combination of both and is called ___?

A

RISK ASSESSMENT (RA)

22
Q

The process that an organization uses to identify risks, assess them, and reduce them to an acceptable level is called ___?

A

RISK MANAGEMENT (RM)

23
Q

A disaster recovery and business continuity test where an organization real-plays a specific disaster scenario. This type of test does not interrupt normal business operations and activities and is called ___?

A

SIMULTATION TEST

24
Q

The amount of money that an organization stands to lose every time a specified risk is realized is called ___?

A

SINGLE LOSS EXPECTANCY (SLE)

25
Q

A basic type of disaster recovery and business continuity test that reviews a disaster recovery/business continuity plan to make sure that all of the assumptions and tasks stated in the plan are correct. This type of test is sometimes called a tabletop walk-through test or tabletop test but often is called a ___?

A

WALK-THROUGH TEST

26
Q

A partially equipped backup site for disaster recovery and business continuity planning purposes. It is a space that contains some, but not all, of the equipment and infrastructure that an organization needs to continue operations in the event of a disaster. It is partially prepared for operations and has electricity and network connectivity. This is called a ___?

A

WARM SITE

27
Q
  1. A parallel test uses current processing data to test IT system operation.
    TRUE OR FALSE
A

FALSE

28
Q
  1. Which item is NOT part of the risk management process?
  2. Risk analysis
  3. Risk response
  4. Continuous monitoring
  5. Training employees
  6. All the above are parts of the risk management process
A

All the above are parts of the risk management process

Risk analysis
Risk response
Continuous monitoring
Training employees

29
Q
  1. What does a risk assessment do?
A

A risk assessment identifies the threats and vulnerabilities to IT resources.

30
Q
  1. Which type of contingency plan test is the least expensive?
  2. Full interruption test
  3. Parallel test
  4. Simulation test
  5. Checklist test
  6. None of the above
A

Checklist test

31
Q
  1. which type of risk analysis uses real numbers to calculate risk?
  2. Quantitative
  3. Qualitative
  4. Quasi-quantitative
  5. Quasi-qualitative
  6. None of the above
A

Quantitative

32
Q
  1. The ___ is the percentage of asset loss that is likely to be caused by an identified threat.
A

Exposure factor

33
Q
  1. How is annualized loss expectancy calculated?
A 
The annualized loss expectancy (ALE) is the amount of loss that an organization can expect to have each year due to a particular risk.  
ALE is often expressed in the equation:
ALE=SLE x ARO.
SLE is single loss expectancy
ARO is annual rate of occurrence
34
Q
  1. What is the main benefit of a qualitative risk assessment?
  2. Measures the money cost of a risk
  3. Scope of the assessment can be easily changed
  4. Easy to administer
  5. All the above
  6. None of the above
A

Easy to administer

35
Q
  1. Which of the following is a qualitative risk assessment methodology?
  2. CRAMM
  3. ISO
  4. MTD
  5. BIA
  6. None of the above
A

CRAMM
(UK’s Central Computer and Telecommunications Agency (CCTA) CCTA created CRAMM (CCTA Risk Analysis and Management Method

FYI: CRAMM has been commercialized and is sold as a software program. It is a Qualitative Risk Analysis method and relies on international standards for its RA methodology.

36
Q
  1. Which risk response eliminates all risk of harm posted by a threat or vulnerability?
  2. Risk transfer
  3. Risk mitigation
  4. Risk acceptance
  5. Risk avoidance
  6. None of the above
A

Risk avoidance

37
Q
  1. Which type of contingency plan reacts to attacks against an organization’s IT infrastructure?
  2. BC plan
  3. DR plan
  4. IR plan
  5. 1 & 2 only
  6. None of the above
A

IR plan

38
Q
  1. A(n) ___ is an event that adversely affects the confidentiality, integrity, and/or availability of an organization’s data and IT systems.
A

Incident

39
Q
  1. A(n) ___ is a sudden, unplanned event that negatively affects the organization’s critical business functions for an unknown period.
A

Disaster

40
Q
  1. Which backup site is fully operational backup site?
  2. Mirrored site
  3. Hot site
  4. Warm site
  5. Cold site
  6. None of the above
A

Mirrored site

41
Q
  1. A business impact analysis identifies key business operations and resources.
    TRUE OR FALSE
A

TRUE

IS3340 SEC. STRAT. IN WINDOWS PLATFORM & APPS. (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions