Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Managing Risk > Flashcards

Managing Risk Flashcards

1
Q

Risk Calculations

A

Weigh the potential threat against the likelihood of it occurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Residual Risk

A

Risk that will and must remain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Annual Loss Expectancy (ALE)

A

A calculation used to identify risks and calculate the expected loss each year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ALE

A

Annual Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Annualized Rate of Occurrence (ARO)

A

A calculation of how often a threat will occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ARO

A

Annualized Rate of Occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Asset Value (AV)

A

The assessed value of an item

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

AV

A

Asset Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Exposure Factor (EF)

A

The potential percentage of loss to an asset if a threat is realized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

MTD

A

Maximum Tolerable Downtime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

MTBF

A

mean time between failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

MTTF

A

mean time to failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

MTTR

A

mean time to restore

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Recovery point objective (RPO)

A

The point last known good data prior to an outage that is used to recover systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

RPO

A

Recovery point objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Recovery time objective (RTO)

A

The max amount of time that a process or service is allowed to be down and the consequences still be considered acceptable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RTO

A

recovery time objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Redundant Array of Independent Disks (RAID)

A

A configuration of multiple hard disks used to provide fault tolerance should a disk fail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

RAID

A

Redundant Array of Independent Disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

single loss expectancy (SLE)

A

The cost of a single loss when it occurs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SLE

A

single loss expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SLA

A

service level agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SPOF

A

single point of failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk calculation formula

A

SLE x ARO = ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

threat

A

anything that can harm your resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Types of threats

A

Environmental
Manmade
Internal vs External

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

vulnerability

A

a weakness that could be exploited by a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Chief components of a risk assessment process

A
  • Risks to which the organization is exposed
  • Risks that need addressing
  • Coordination with the business impact analysis (BIA)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

BIA

A

business impact analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Threat Vector

A

the way in which an attacker poses a threat (particular tool or means of exploiting)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A privacy impact assessment (PIA) requires what three things?

A
  • To ensure conformance with applicable legal, regulatory, and policy requirements for privacy
  • Determine risks and effects
  • Evaluate protections and alternative processes to mitigate potential privacy risks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

The four possible responses to identifying and assessing the risks that exist

A

Risk Avoidance
Risk Transference
Risk Mitigation
Risk Acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Audits used in risk mitigation

A
  • user rights
  • permission reviews
  • change management
  • incident management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

cloud computing

A

hosting services and data on the Internet instead of hosting it locally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Three ways of implementing cloud computing

A
  • Platform as a Service
  • Software as a Service
  • Infrastructure as a Service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Platform as a Service (PaaS)

A

Vendors allow apps to be created and run on their infrastructure.

Known as ‘cloud platform service’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

PaaS

A

Platform as a Service

38
Q

Software as a Service (SaaS)

A

Applications are remotely run over the web

Costs are usually computed on a subscription basis

39
Q

SaaS

A

Software as a Service

40
Q

Infrastructure as a Service (IaaS)

A

Clients pay a cloud service provider for the resources used

Resembles the traditional utility model

41
Q

Risks associated with virtualization

A
  • Breaking out of the virtual machine
  • Intermingling network and security controls
  • Hypervisor exploits
42
Q

Hypervisor

A

the virtual machine monitor; the software that allows virtual machines to exist

43
Q

SOP

A

Standard Operating Procedure

44
Q

Mandatory Vacation Policy

A

Personnel policy
Requires employees to take time away from work to refresh. It also allows the company to ensure it can fill skill gaps and can help to detect fraud

45
Q

Job Rotation Policy

A

Personnel policy
Defines intervals at which employees must rotate through positions. It prevents a company from being too dependent on a single person for a job.

46
Q

Separation of Duties Policies

A

Personnel policy
Requires more than one person to complete key processes. Requires employees committing fraud to collude with others, thus reducing the possibility of it happening. This policy also reduces overall errors of processes.

47
Q

collusion

A

an agreement between two or more parties established for the purpose of committing deception or fraud

48
Q

Clean Desk Policy

A

Personnel Policy

Limits employees to only having current work on their desk. This increases overall security.

49
Q

Background Check Policy

A

Personnel Policy

Since all employees will handle data that is sensitive, they must have reason to be trusted

50
Q

Nondisclosure Agreements Policy

A

Personnel Policy

NDA policy is used to allow employees to work with sensitive public or proprietary data

51
Q

Onboarding Policies

A

Personnel Policy

The onboarding policies used allow for well-trained employees who feel they are of value to the company

52
Q

Continuing Education Policies

A

Personnel Policy
Continuing education policies are important as they allow employees to rise in value and is required to allow for the maintenance of necessary certifications

53
Q

Exit Interview Policies

A

Personnel Policy

Allow the company to learn and gain honest feedback

54
Q

Role-Based Awareness Training Policy

A

Personnel Policy

Training employees to the level of their privilege adheres to the ‘least privilege principle’

55
Q

Acceptable Use Policies (AUP)

A

Personnel Policy

Describe how the employees in an organization can use company systems and resources

56
Q

pod slurping

A

When portable devices are plugged directly into a machine, they bypass the network security measures (such as a firewall) and allow data to be copied

57
Q

Adverse Actions Policy

A

Personnel Policy
Details what must be done in the event of termination, administrative leave, or any other reprimanding of employees. Includes suspending accounts, revoking privileges, etc

58
Q

General Security Policies

A

Personnel Policy

Define what controls are required to implement and maintain the security of systems, users, and networks

59
Q

False Positive

A

Type I error;

Alert to an event which is not an incident

60
Q

False Negative

A

Type II error;

Lack of an alert for an event which is an incident or any other event which should require an alert

61
Q

Type I error

A

False Positive

62
Q

Type II error

A

False Negative

63
Q

Type III error

A

An error in which you came to the correct conclusion but for all the wrong reasons

64
Q

Leading ways to address business continuity

A

Do a BIA and implement ‘best practices’

65
Q

Business impact analysis (BIA)

A

Business Continuity Best Practice
The process of evaluating all of the critical systems in an organization to define impact and recovery plans. Focuses on the impact a loss would have on the company.

NOT concerned with external threats or vulnerabilities

66
Q

Key components of a BIA

A
  • Identifying critical functions
  • Prioritizing critical business functions
  • Calculating a timeframe for critical systems loss
  • Estimating the tangible and intangible impact on the organization
67
Q

Variables that affect ‘impact’

A
  • Life
  • Property
  • Saftey
  • Finance
  • Reputation
68
Q

Identifying Critical Systems and Components

A

Business Continuity Best Practice

Involves identifying points of failure and maintaining contingency plans

69
Q

Automation/Scripting

A

Business Continuity Best Practice

Automate courses of action for a range of scenarios that do not require human detection and reaction

70
Q

Frameworks and Templates

A

Business Continuity Best Practice

Includes scales for evaluating threats and deciding the best responses to them

71
Q

Master Image

A

Business Continuity Best Practice

Allows the administrator to more easily restore a system if a failure occurs

72
Q

Nonpersistence

A
  • Business Continuity Best Practice*
  • Allows for a ‘snapshot’ of an operating system in an exploited stat to inspect it
  • Allows for rolling back to a known configuration
  • Allows for booting a system with ‘live boot media’
73
Q

Elasticity

A

Business Continuity Best Practice

Ability to scale up (and scale down) resources as needed. Includes ability to pool resources

74
Q

Scalability

A

Business Continuity Best Practice

Allows for elasticity and only utilizing the resources required

75
Q

Distributive Allocation

A

Business Continuity Best Practice

Distributing the load (file requests, data routing, etc) so that no device is overly burdened

76
Q

High Availability (HA)

A

Business Continuity Best Practice
Refers to measures such as redundancy, failover, and mirroring, used to keep services and systems operational during an outage.

77
Q

Planning for Resiliency

A

Business Continuity Best Practice

Capacity to recover quickly from difficulties

78
Q

Redundancy

A

Business Continuity Best Practice

Refers to systems that either are duplicated or ‘fail over’ to other systems in the event of a malfunction

79
Q

Clustering

A

involves multiples systems connected together in such a way that if any of the systems fail, the others take up the slack

80
Q

The major cost of failover systems

A

They can become prohibitively expensive

81
Q

Fault Tolerance

A

Business Continuity Best Practice

The ability of a system to sustain operation even though a critical component has failed

82
Q

Two key components of fault tolerance

A
  • Spare parts

- Electrical power

83
Q

UPS

A

uninterruptible power supply

84
Q

Redundant Array of Independent Disks (RAID)

A

A technology that uses multiples disks to provide fault tolerance

85
Q

RAID

A

Redundant Array of Independent Disks

86
Q

RAID Level 0

A

disk striping; does not include any fault tolerance

87
Q

RAID Level 1

A

disk mirroring; can be implemented as mirroring or duplexing

88
Q

RAID Level 3

A

disk striping with a parity disk

89
Q

RAID Level 5

A

disk striping with parity

90
Q

The focus of ‘change management’

A

How to document and control for a change

91
Q

PIA

A

privacy impact assessment

Security+ (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions