IS3350 CHAPTER 14 Flashcards
The number of times a threat might affect an organization during a one-year time frame is called ___?
ANNUAL RATE OF OCCURRENCE (ARO)
The amount of loss that an organization can expect to have each year due to a particular risk is called \_\_\_? ALE is often expressed as the equation: ALE = SLE x ARO. SLE is single loss expectancy ARO is annual rate or occurrence
ANNUALIZED LOSS EXPECTANCY (ALE)
These ___ address the recovery of an organization’s business processes and functions in the event of a disaster.
These tend to be comprehensive plans for returning an organization to normal operating conditions.
BUSINESS CONTINUITY (BC) PLANS
A process that identifies key business operations and the resources used to support those processes is called ___?
This also identifies maximum tolerable down-time for critical business functions.
BUSINESS IMPACT ANALYSIS (BIA)
A basic type of disaster recovery and business continuity test that checks to make sure that supplies and inventory items needed to an organization’s business recovery are on hand is called ___?
CHECKLIST TEST
A backup site for disaster recovery and business continuity planning purposes that is little more than reserved space is called ___?
It doesn’t have any hardware or equipment ready for business operations.
It will have electrical service, but most likely won’t have network connectivity.
It can take weeks to months for an organization to ready this site for business operations.
COLD SITE
Any situation where a person’s private interests and professional obligations collide is called ___?
Independent observers might question whether a person’s private interests improperly influence his or her professional decisions.
CONFLICT OF INTEREST
A sudden, unplanned event that negatively affects the organizations’ critical business functions for an unknown period is called ___?
DISASTER
Plans that address the recovery of an organization’s information technology systems in the event of a disaster is called ___?
DISASTER RECOVERY (DR) PLANS
The percentage of asset loss that is likely to be caused by an identified threat or vulnerability is called ___?
EXPOSURE FACTOR
A disaster recovery and business continuity test where an organization stopes all of its normal business operations and transfers those operations to its backup site is called ___?
This is the most comprehensive form of disaster recovery and business continuity plan testing; also the most expensive.
FULL INTERRUPTION TEST
An operation backup site for disaster recovery and business continuity planning purposes is called ___?
It has equipment and infrastructure that is fully compatible with an organization’s main facility.
It is not staffed with people.
It can become operational within minutes to hours after a disaster.
HOT SITE
An event that adversely affects the confidentiality, integrity, and/or availability of an organization’s data and information technology systems is called ____?
INCIDENT
A contingency plan that helps an organization respond to attacks against an organizations’ information technology infrastructure is called ___?
INCIDENT RESPONSE (IR)
The amount of time that critical business processes and resurrect can be offline before an organization begins to experience irreparable business harm is called ___?
MAXIMUM TOLERABLE DOWNTIME (MTD)
A fully operational backup site for disaster recovery and business continuity planning purposes is called ___?
This site actively runs an organization’s information technology functions in parallel with the organization’s mail processing facility.
It is fully staffed.
It has all necessary data and equipment to continue business operations.
MIRRORED SITE
A disaster recovery and business continuity test where an organization tests its ability to recover its information technology systems and its business data is called ___?
In this test, the organization brings its backup recovery sites online.
It will then use historical business data to test the operations of those systems.
PARALLEL TEST
A marketing field that manages an organization’s public image is called ___?
PUBLIC RELATIONS (PR)
A risk analysis method that uses scenarios and ratings systems to calculate risk and potential harm is called ___?
This does not attempt to assign money value to assets and risks.
QUALITATIVE RISK ANALYSIS
A risk analysis method that uses real money costs and values to determine the potential monetary impact of threats and vulnerabilities is called ___?
QUANTITATIVE RISK ANALYSIS
The loss that an organization has when a potential threat actually occurs is called ___?
REALIZED RISK
A process for identifying threats and vulnerabilities that an organization faces is called ___?
This can be qualitative or quantitative or both.
RISK ASSESSMENT (RA)
The process that an organization uses to identify risks, asses them, and reduce them to an acceptable level is called ___?
RISK MANAGEMENT (RM)
A disaster recovery and business continuity test where an organization role plays a specific disaster scenario is called ___?
This type of test doesn’t interrupt normal business operations and activities.
SIMULATION TEST
The amount of money that an organization stands to lose every time a specified risk is realized is called ___?
SINGLE LOSS EXPECTANCY (SLE)
A basic type of disaster recovery and business continuity test that reviews a disaster recovery/business continuity plan to make sure that all of the assumptions and tasks stated in the plan are correct is called ___?
WALK-THROUGH TEST
A partially equipped backup site for disaster recovery and business continuity planning purposes is called ___?
This is space that contains some, but not all, of the equipment and infrastructure that an organization needs to continue operations in the event of a disaster.
It is partially prepared for operations and has electricity and network connectivity.
WARM SITE
- A parallel test uses current processing data to test IT system operation.
TRUE OR FALSE
FALSE
- Which item is NOT part of the risk management process?
- Risk analysis
- Risk response
- Continuous monitoring
- Training employees
- All the above are parts of the risk management process
All are parts of the risk management process
Risk analysis
Risk response
Continuous monitoring
Training employees
- What does a risk assessment do?
A risk assessment identifies the threats and vulnerabilities to IT resources.
- Which type of contingency plan test is the least expensive?
- Full interruption test
- Parallel test
- Simulation test
- Checklist test
- None of the above
Checklist test
- Which type of risk analysis uses real numbers to calculate risk?
- Quantitative
- Qualitative
- Quasi-quantitative
- Quasi-qualitative
- None of the above
Quantitative
- The ___ is the percentage of assets loss that is likely to be caused by an identified threat.
Exposure factor
- How is annualized loss expectancy calculated?
The annualized loss expectancy (ALE) is the amount of loss that an organization can expect to have each year due to a particular risk.
ALE = SLE x ARO
SLE is single loss expectancy
ARO is annual rate of occurrence
- What is the main benefit of a qualitative risk assessment?
- Measures the money cost of a risk
- Scope of the assessment can be easily changed
- Easy to administer
- All the above
- None of the above
Easy to administer
- Which of the following is a qualitative risk assessment methodology?
- CRAMM
- ISO
- MTD
- BIA
- None of the above
CRAMM
- Which risk response eliminates all risk of harm posted by a threat or vulnerability?
- Risk transfer
- Risk mitigation
- Risk acceptance
- Risk avoidance
- None of the above
Risk avoidance
- Which type of contingency plan reacts to attacks against an organization’s IT infrastructure?
- BC plan
- DR plan
- IR plan
- 1 & 2 only
- None of the above
IR plan
- A(n) ___ is an event that adversely affects the confidentiality, integrity, and/or availability of an organization’s data and IT systems.
Incident
- A(n) ___ is a sudden, unplanned event that negatively affects the organization’s critical business functions for an unknown period.
Disaster
- Which backup site is a fully operational backup site?
- Mirrored site
- Hot site
- Warm site
- Cold site
- None of the above
Mirrored site
- A business impact analysis identifies key business operations and resources.
TRUE OR FALSE
TRUE
