Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Course 002 - Play It Safe: Manage Security Risks > Module 1 - 02-2 > Flashcards

Module 1 - 02-2 Flashcards

Navigate threats, risks, and vulnerabilities

1
Q

Define Asset

A

An item perceived as having value to an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define Threat

A

Any circumstance or event that can negatively impact assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define Social Engineering

A

A manipulation technique that exploits human error to gain private information, access, or valuables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define Phishing

A

A technique that is used to acquire sensitive data, such as user names, passwords, or banking information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or False?
Phishing exploits human error to acquire sensitive data and private information.

A

True

Phishing exploits human error to acquire sensitive data and private information. It is one method of social engineering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Risk

A

Anything that can impact the confidentiality, integrity, or availability of an asset

A basic formula for determining the level of risk is that risk equals the likelihood of a threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How would an organization rate risks at different levels (3)?

A
  • Low
  • Medium
  • High

depending on possible threats and the value of an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define Low-Risk Asset

A

Information that would not harm the organization’s reputation or ongoing operations, and would not cause financial damage if compromised

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are examples of Low-Risk Asset (2)?

A
  • Public information such as website content
  • Published research data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define Medium-Risk Asset

A

Information that’s not available to the public and may cause some damage to the organization’s finances, reputation, or ongoing operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an example of Medium-Risk Asset?

A

The early release of a company’s quarterly earnings could impact the value of their stock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define High-Risk Asset

A

Information protected by regulations or laws, which if compromised, would have a severe negative impact on an organization’s finances, ongoing operations, or reputation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are examples of High-Risk Asset (3)?

A

This could include leaked assets with SPII, PII, or intellectual property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define Vulnerability

A

A weakness that can be exploited by a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What two factors must be present for there to be a risk?

A

Both a Vulnerability and a Threat must be present for there to be a Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are examples of Vulnerabilities (4)?

A
  • An outdated firewall, software, or application
  • Weak passwords
  • Unprotected confidential data
  • People
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define Ransomware

A

A malicious attack where threat actors encrypt an organization’s data then demand payment to restore access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the Layers of the Web (3)?

A
  • Surface Web
  • Deep Web
  • Dark Web
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the Top Layer of the Web?

A

Surface Web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the Middle Layer of the Web?

A

Deep Web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the Bottom Layer of the Web?

A

Dark Web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define Surface Web

A

The surface web is the layer that most people use.
It contains content that can be accessed using a web browser.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define Deep Web

A

The deep web generally requires authorization to access it.
An organization’s intranet is an example of the deep web, since it can only be accessed by employees or others who have been granted access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define Dark Web

A

Lastly, the dark web can only be accessed by using special software.
The dark web generally carries a negative connotation since it is the preferred web layer for criminals because of the secrecy that it provides.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are the three key impacts of threats, risks, and vulnerabilities?
1. Financial 2. Identity theft 3. Reputation
26
Explain the Financial Impact on how it relates to threats, risks, and vulnerabilities
o When an organization's assets are compromised by an attack, such as the use of malware, the financial consequences can be significant for a variety of reasons. o These can include interrupted production and services, the cost to correct the issue, and fines if assets are compromised because of non-compliance with laws and regulations.
27
Explain the impact on how Identity Theft relates to threats, risks, and vulnerabilities
o Organizations must decide whether to store private customer, employee, and outside vendor data, and for how long. o Storing any type of sensitive data presents a risk to the organization. o Sensitive data can include personally identifiable information, or PII, which can be sold or leaked through the dark web. o That's because the dark web provides a sense of secrecy and threat actors may have the ability to sell data there without facing legal consequences.
28
Explain the impact on how Reputation relates to threats, risks, and vulnerabilities
o A solid customer base supports an organization's mission, vision, and financial goals. o An exploited vulnerability can lead customers to seek new business relationships with competitors or create bad press that causes permanent damage to an organization's reputation. o The loss of customer data doesn't only affect an organization's reputation and financials, it may also result in legal penalties and fines.
29
What does NIST stand for?
National Institute of Standards and Technology (NIST)
30
What is does National Institute of Standards and Technology (NIST) provide?
Frameworks that are used by security professionals to manage risks, threats, and vulnerabilities
31
What does RMF stand for?
Risk Management Framework (RMF)
32
What does NIST RMF stand for?
National Institute of Standards and Technology’s Risk Management Framework (NIST RMF)W
33
What are the seven (7) steps in the NIST RMF?
1. Prepare 2. Categorize 3. Select 4. Implement 5. Assess 6. Authorize 7. Monitor
34
What is the first (1st) step in the NIST RMF?
1. Prepare
35
What is the second (2nd) step in the NIST RMF?
2. Categorize
36
What is the third (3rd) step in the NIST RMF?
3. Select
37
What is the fourth (4th) step in the NIST RMF?
4. Implement
38
What is the fifth (5th) step in the NIST RMF?
5. Assess
39
What is the sixth (6th) step in the NIST RMF?
6. Authorize
40
What is the seventh (7th) step in the NIST RMF?
7. Monitor
41
Define the NIST RMF Step 1: Prepare
Activities that are necessary to manage security and privacy risks before a breach occurs. As an entry-level analyst, you'll likely use this step to monitor for risks and identify controls that can be used to reduce those risks.
42
Define the NIST RMF Step 2: Categorize
Used to develop risk management processes and tasks. Security professionals then use those processes and develop tasks by thinking about how the confidentiality, integrity, and availability of systems and information can be impacted by risk. As an entry-level analyst, you'll need to be able to understand how to follow the processes established by your organization to reduce risks to critical assets, such as private customer information.
43
Define the NIST RMF Step 3: Select
Choose, customize, and capture documentation of the controls that protect an organization. An example of the select step would be keeping a playbook up-to-date or helping to manage other documentation that allows you and your team to address issues more efficiently.
44
Define the NIST RMF Step 4: Implement
Implement security and privacy plans for the organization. Having good plans in place is essential for minimizing the impact of ongoing security risks. For example, if you notice a pattern of employees constantly needing password resets, implementing a change to password requirements may help solve this issue.
45
Define the NIST RMF Step 5: Assess
Determine if established controls are implemented correctly. An organization always wants to operate as efficiently as possible. So it's essential to take the time to analyze whether the implemented protocols, procedures, and controls that are in place are meeting organizational needs. During this step, analysts identify potential weaknesses and determine whether the organization's tools, procedures, controls, and protocols should be changed to better manage potential risks.
46
Define the NIST RMF Step 6: Authorize
Being accountable for the security and privacy risks that may exist in an organization. As an analyst, the authorization step could involve generating reports, developing plans of action, and establishing project milestones that are aligned to your organization's security goals.
47
Define the NIST RMF Step 7: Monitor
Be aware of how systems are operating. Assessing and maintaining technical operations are tasks that analysts complete daily. Part of maintaining a low level of risk for an organization is knowing how the current systems support the organization's security goals. If the systems in place don't meet those goals, changes may be needed.
48
What are some common strategies used to manage risks (4)?
* Acceptance * Avoidance * Transference * Mitigation
49
Define the strategy of Acceptance to manage risk
Accepting a risk to avoid disrupting business
50
Define the strategy of Avoidance to manage risk
Creating a plan to avoid the risk altogether
51
Define the strategy of Transference to manage risk
Transferring risk to a third party to manage
52
Define the strategy of Mitigation to manage risk
Lessening the impact of a known risk
53
What does HITRUST stand for?
Health Information Trust Alliance
54
What are two common threats?
* Insider threats * Advanced persistent threats (APTs)
55
Define Insider Threats
Staff members or vendors abuse their authorized access to obtain data that may harm an organization.
56
What does APTs stand for?
Advanced Persistent Threats (APTs)
57
Define Advanced persistent threats (APTs)
A threat actor maintains unauthorized access to a system for an extended period of time
58
What different factors can affect the likelihood of a risk to an organization’s assets (5)?
* External risk * Internal risk * Legacy systems * Multiparty risk * Software compliance/licensing
59
Define External Risk
Anything outside the organization that has the potential to harm organizational assets, such as threat actors attempting to gain access to private information
60
Define Internal Risk
A current or former employee, vendor, or trusted partner who poses a security risk
61
Define Legacy systems
Old systems that might not be accounted for or updated, but can still impact assets, such as workstations or old mainframe systems. For example, an organization might have an old vending machine that takes credit card payments or a workstation that is still connected to the legacy accounting system.
62
Define Multiparty Risk
Outsourcing work to third-party vendors can give them access to intellectual property, such as trade secrets, software designs, and inventions.
63
Define Software Compliance/Licensing
Software that is not updated or in compliance, or patches that are not installed in a timely manner
64
What does OWASP stand for?
Open Web Application Security Project (OWASP) Open Worldwide Application Security Project (OWASP)
65
Define OWASP
A non-profit organization that aims to improve the security of web applications and software It does this by providing guidance on how to develop, purchase and maintain trustworthy and secure software applications
66
What are some vulnerabilities that organizations need to regularly inspect for within their systems (6)?
* ProxyLogon * ZeroLogon * Log4Shell * PetitPotam * Security logging and monitoring failures * Server-side request forgery
67
Define ProxyLogon
A pre-authenticated vulnerability that affects the Microsoft Exchange server. This means a threat actor can complete a user authentication process to deploy malicious code from a remote location.
68
Define ZeroLogon
A vulnerability in Microsoft’s Netlogon authentication protocol. An authentication protocol is a way to verify a person's identity. Netlogon is a service that ensures a user’s identity before allowing access to a website's location.
69
Define Netlogon
A service that ensures a user’s identity before allowing access to a website's location.
70
Define Log4Shell
Allows attackers to run Java code on someone else’s computer or leak sensitive information. It does this by enabling a remote attacker to take control of devices connected to the internet and run malicious code.
71
Define PetitPotam
Affects Windows New Technology Local Area Network (LAN) Manager (NTLM). It is a theft technique that allows a LAN-based attacker to initiate an authentication request.
72
What does NTLM stand for?
New Technology LAN Manager (NTLM)
73
Define NTLM
A suite of security protocols developed by Microsoft to authenticate users and protect their activity A suite of Microsoft security protocols intended to provide authentication, integrity, and confidentiality to users
74
Define Security logging and monitoring failures
Insufficient logging and monitoring capabilities that result in attackers exploiting vulnerabilities without the organization knowing it
75
Define Server-side request forgery
Allows attackers to manipulate a server-side application into accessing and updating backend resources. It can also allow threat actors to steal data.
76
What is a vulnerability? * Any circumstance or event that can negatively impact assets * An organization’s ability to manage its defense of critical assets and data and react to change * A weakness that can be exploited by a threat * Anything that can impact the confidentiality, integrity, or availability of an asset
A vulnerability is a weakness that can be exploited by a threat.
77
Information protected by regulations or laws is a _____. If it is compromised, there is likely to be a severe negative impact on an organization’s finances, operations, or reputation. * high-risk asset * low-risk asset * medium-risk asset * new-risk asset
high-risk asset
78
What are the key impacts of threats, risks, and vulnerabilities? Select three answers. * Employee retention * Financial damage * Identity theft * Damage to reputation
* Financial damage * Identity theft * Damage to reputation
79
The steps in the Risk Management Framework (RMF) are prepare, _____, select, implement, assess, authorize, and monitor. * reflect * categorize * communicate * produce
* categorize

Course 002 - Play It Safe: Manage Security Risks (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions