Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Módulo 12 - Risk Management Processes > Flashcards

Módulo 12 - Risk Management Processes Flashcards

1
Q

What is the primary goal of risk management?

A

To identify, assess, and mitigate vulnerabilities and threats to mission essential functions while minimizing risk and disruption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the five phases of risk management?

A
  1. Identify mission essential functions
  2. Identify vulnerabilities
  3. Identify threats
  4. Analyze business impacts
  5. Identify risk responses.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Maximum Tolerable Downtime (MTD)?

A

The longest period a business function can be offline without causing irrecoverable failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the formula for Recovery Time Objective (RTO) and Work Recovery Time (WRT)?

A

RTO + WRT must not exceed MTD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Recovery Point Objective (RPO)?

A

The maximum acceptable amount of data loss, measured in time, that a system can tolerate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Mean Time Between Failures (MTBF)?

A

The average operational time between system or equipment failures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Mean Time to Repair (MTTR)?

A

The average time required to repair and restore a system to full operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the four risk response strategies?

A
  1. Mitigate
  2. Avoid
  3. Transfer
  4. Accept.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is risk transference?

A

Assigning risk to a third party, such as an insurance provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is risk acceptance?

A

Choosing not to implement countermeasures because the risk level is deemed acceptable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the difference between a risk exception and a risk exemption?

A

A risk exception is temporary and must be reviewed periodically.
A risk exemption is a strategic decision to allow risk to remain without mitigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Mission Essential Function (MEF)?

A

A function that cannot be deferred and must be performed continuously or restored first after a disruption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of a Business Process Analysis (BPA)?

A

To identify inputs, hardware, staff, outputs, and process flow for critical systems supporting mission essential functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Business Impact Analysis (BIA)?

A

A process that assesses the effects of disruptions on operations and quantifies potential losses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are common methods for identifying risks?

A
  1. Vulnerability assessments
  2. Penetration testing
  3. Security audits
  4. Threat intelligence.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is residual risk?

A

The remaining risk after applying mitigation, transference, or acceptance measures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is risk appetite?

A

The organization-wide level of residual risk deemed acceptable based on strategic goals and compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Give an example of risk mitigation.

A

Implementing a sprinkler system to reduce the impact of a fire.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Provide an example of risk avoidance.

A

Discontinuing a high-risk software project due to its vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Describe an example of risk transference.

A

Purchasing cybersecurity insurance to cover potential data breach liabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the two main variables used in risk assessment?

A

Likelihood and impact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How is likelihood expressed in qualitative and quantitative analysis?

A

Qualitative: ‘Low,’ ‘Medium,’ ‘High’ or 1-5 scale.
Quantitative: Numerical value (0-1) or percentage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is impact in risk assessment?

A

The severity of a risk event if realized, determined by asset value and cost of disruption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an RCSA?

A

Risk and Control Self-Assessment—a process for identifying risks and evaluating control effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a risk register?

A

A document summarizing risks, their impact, likelihood, owners, and mitigation strategies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the purpose of a heat map in risk assessment?

A

To visually represent risk severity, likelihood, and priorities using a traffic light system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the four types of risk assessments?

A
  1. Ad hoc
  2. Recurring
  3. One-time
  4. Continuous.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define quantitative risk assessment.

A

A method assigning concrete values to risks using metrics like Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is qualitative risk analysis?

A

A method using subjective judgment and qualitative factors to assess risks without numerical data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Single Loss Expectancy (SLE)?

A

The monetary loss from a single risk event, calculated as Asset Value × Exposure Factor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Annualized Loss Expectancy (ALE)?

A

The annual financial loss from a risk, calculated as SLE × Annualized Rate of Occurrence (ARO).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How is exposure factor (EF) used in SLE calculation?

A

EF represents the percentage of the asset value lost during a risk event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is inherent risk?

A

The risk level before applying any mitigation measures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is residual risk?

A

The risk level remaining after implementing mitigation measures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How does risk posture differ from risk appetite?

A

Risk posture reflects the overall state of risk management, while risk appetite defines acceptable levels of risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are Key Risk Indicators (KRIs)?

A

Predictive metrics used to monitor and assess potential risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the role of a risk owner?

A

To manage, monitor, and implement mitigation measures for a specific risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are the four risk response strategies?

A
  1. Mitigate
  2. Avoid
  3. Transfer
  4. Accept.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is risk transference?

A

Assigning risk to a third party, such as through insurance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is risk acceptance?

A

Choosing not to mitigate a risk due to low likelihood or impact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the difference between MTBF and MTTR?

A

MTBF: Mean Time Between Failures (average operational time).
MTTR: Mean Time to Repair (average time to restore functionality).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are the levels of risk appetite?

A
  1. Expansionary
  2. Conservative
  3. Neutral.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is risk reporting?

A

The communication of an organization’s risk profile and risk management effectiveness to stakeholders.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the primary purpose of a Business Continuity Plan (BCP)?

A

To ensure critical business functions (CBFs) continue during disruptions and restore normal operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are the key phases of a BCP during a disaster?

A
  1. Identify the disaster and ensure safety.
  2. Implement short-term recovery.
  3. Stabilize operations.
  4. Restore all functions to normal.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the role of succession planning in BCP?

A

To identify and develop internal candidates for future key roles, ensuring smooth leadership transitions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is COOP, and how does it differ from BCP?

A

COOP ensures critical functions continue during a crisis, focusing on immediate response, while BCP covers broader organizational recovery.

48
Q

What are some COOP strategies for IT systems?

A

Redundant IT systems, off-site backups, failover systems, and alternative work arrangements.

49
Q

Why is regular COOP testing important?

A

To verify effectiveness, identify gaps, and ensure readiness for various disruptions.

50
Q

Why are backups critical in COOP?

A

They safeguard data, ensure recoverability, and minimize downtime during disruptions.

51
Q

What is the importance of testing backups?

A

To validate data integrity, recovery speed, and compliance with regulatory requirements.

52
Q

What is capacity planning?

A

A process to forecast and allocate resources (people, technology, infrastructure) for current and future needs.

53
Q

What are the methods of capacity planning?

A

Trend analysis, simulation modeling, and benchmarking.

54
Q

What risks can poor capacity planning introduce?

A

Overloaded systems, insufficient security, and resource underutilization.

55
Q

What are the three types of recovery sites?

A
  1. Hot site: Immediate failover, fully operational.
  2. Warm site: Requires data loading before use.
  3. Cold site: Empty, requires setup.
56
Q

What is geographic dispersion in disaster recovery?

A

Distributing recovery sites across regions to mitigate the impact of localized disasters.

57
Q

What is failover, and why is it important?

A

Failover ensures seamless transfer of operations to redundant systems during a failure.

58
Q

What are the advantages of using cloud services for DR?

A

Cost efficiency, scalability, geographic diversity, fast deployment, and simplified management.

59
Q

What are the types of resiliency tests?

A
  1. Tabletop exercises
  2. Failover tests
  3. Simulations
  4. Parallel processing tests.
60
Q

Why is regular testing of resiliency plans critical?

A

To identify vulnerabilities, refine strategies, and improve preparedness.

61
Q

What are key components of continuity documentation?

A

Test plans, test scripts, results, and communication reports.

62
Q

What are examples of third-party assessments for BCP testing?

A

ISO 22301, PCI DSS, and SOC 2 evaluations.

63
Q

Why is destroying outdated BCP versions important?

A

To avoid confusion and ensure only current procedures are followed during crises.

64
Q

What are people risks in capacity planning?

A

Insufficient staffing, skill gaps, and reliance on specific individuals.

65
Q

How can cross-training help mitigate workforce risks?

A

By ensuring multiple employees can perform critical tasks, reducing dependency on single individuals.

66
Q

What technologies support remote work continuity?

A

VPNs, remote desktop software, cloud-based tools, video conferencing, and project management platforms

67
Q

What are the main components of third-party risk management processes?

A

Vendor due diligence, risk identification and assessment, ongoing monitoring, and incident response planning.

68
Q

Why is third-party vendor assessment critical?

A

To ensure vendors adhere to security standards, comply with regulations, and mitigate risks to the organization.

69
Q

What is vendor monitoring?

A

The continuous evaluation of vendors to ensure adherence to security standards, compliance, and contractual obligations.

70
Q

What factors are considered during vendor selection?

A

Security practices, financial stability, regulatory compliance, reputation, and risk profile.

71
Q

Name three types of third-party relationships in business

A

Vendor, supply chain partner, and business partner.

72
Q

How does vendor diversity benefit an organization?

A

It reduces cybersecurity risks, promotes resilience, fosters innovation, and mitigates vendor lock-in.

73
Q

What is the purpose of due diligence in vendor assessment?

A

To evaluate a vendor’s suitability, reliability, and risk profile based on predefined criteria.

74
Q

Name and describe a key contractual provision used in vendor assessments.

A

The right-to-audit clause: Allows organizations to audit vendor practices to ensure compliance and security.

75
Q

What is supply chain analysis in vendor risk management?

A

Evaluating risks and vulnerabilities in the supply chain to identify weak links and mitigate potential issues.

76
Q

What tools are used to gather vendor risk information?

A

Questionnaires, site visits, audits, and penetration testing.

77
Q

How do organizations validate responses to vendor questionnaires?

A

By requesting documentation, conducting audits, and using third-party verification services.

78
Q

What is a conflict of interest in vendor assessments?

A

A situation where competing interests may compromise the vendor’s ability to act impartially

79
Q

Name an example of a potential conflict of interest.

A

Financial incentives from partnerships that bias a vendor’s recommendations.

80
Q

What is the purpose of Rules of Engagement (RoE) with vendors?

A

To define responsibilities, security requirements, and communication protocols in vendor relationships.

81
Q

List three key elements in Rules of Engagement.

A

Roles and responsibilities, security requirements, and compliance obligations

82
Q

What is a Non-Disclosure Agreement (NDA)?

A

A binding agreement ensuring confidentiality of shared sensitive information.

83
Q

What is the difference between an MOU and an MOA?

A

An MOU is nonbinding and outlines intentions, while an MOA is binding and defines specific terms and responsibilities.

84
Q

What is the purpose of a Master Service Agreement (MSA)?

A

To define overarching terms for a specific contract, such as scope, pricing, and deliverables.

85
Q

What does a Service Level Agreement (SLA) define?

A

Performance metrics, quality standards, and service levels expected from a vendor.

86
Q

What is a Statement of Work (SOW)?

A

A document detailing a project’s scope, deliverables, timelines, and vendor responsibilities.

87
Q

What is the main purpose of audits in organizational operations?

A

To evaluate processes, controls, and compliance with standards and regulations, identifying gaps and recommending improvements.

88
Q

What do assessments focus on in an organization?

A

Evaluating the effectiveness of cybersecurity, risk management, and internal controls to identify vulnerabilities and risks

89
Q

How do audits and assessments support organizational goals

A

They maintain compliance, mitigate risks, and drive continuous improvement in security and operational performance

90
Q

What is the key difference between internal and external assessments?

A

Internal assessments are conducted by employees for continuous improvement, while external assessments are performed by third parties for impartial evaluations.

91
Q

Name two advantages of combining internal and external audits.

A

Enhanced risk management capabilities and improved stakeholder trust through transparency and accountability.

92
Q

Why are external assessments important?

A

They provide independent, objective evaluations against industry standards and identify areas for improvement missed by internal teams.

93
Q

What are the three main types of internal assessment methods?

A

Compliance assessments, audit committees, and self-assessments.

94
Q

What is the role of an audit committee?

A

To provide independent oversight of financial reporting, internal controls, and risk management practices.

95
Q

What is self-assessment, and who conducts it?

A

A process where internal personnel evaluate their performance against established metrics to identify strengths and weaknesses.

96
Q

What are common external assessment methods?

A

Regulatory assessments, external examinations, general assessments, and independent third-party audits.

97
Q

How do regulatory assessments support compliance?

A

By ensuring organizations adhere to laws, regulations, and standards through inspections, audits, and reviews.

98
Q

What is the benefit of independent third-party audits?

A

They provide unbiased assessments, demonstrating transparency, accountability, and adherence to regulations.

99
Q

What is attestation in the context of audits and assessments?

A

The process of verifying the accuracy and effectiveness of security controls, ensuring compliance with standards and best practices.

100
Q

Who typically conducts attestations?

A

Qualified and trusted external entities like auditors or assessors.

101
Q

How do internal and external assessments complement each other?

A

Internal assessments enable continuous improvement, while external assessments validate compliance and provide independent assurance.

102
Q

How does collaboration between internal and external auditors benefit organizations?

A

It facilitates knowledge sharing, improves assessment quality, and fosters professional development.

103
Q

Acronym:
BCP

A

Business Continuity Plan

104
Q

Acronym:
COOP

A

Continuity of Operations

105
Q

Acronym:
NIST RMF

A

National Institute of Standards and Technology Risk Management Framework

106
Q

Acronym:
PCI-DSS

A

Payment Card Industry Data Security Standard

107
Q

Acronym:
CPA

A

Certified Public Accountant

108
Q

Acronym:
SLA

A

Service Level Agreement

109
Q

Acronym:
SOW

A

Statement of Work

110
Q

Acronym:
MOU

A

Memorandum of Understanding

111
Q

Acronym:
MOA

A

Memorandum of Agreement

112
Q

Acronym:
BPA

A

Business Partnership Agreement

113
Q

Define:
Continuity of Operations (COOP)

A

A strategy to maintain or quickly resume critical functions during disasters or crises

113
Q

Acronym:
MSA

A

Master Service Agreement

114
Q

Define:
Master Service Agreement (MSA)

A

A contract outlining the general terms and conditions for a specific vendor relationship or engagement.

Security+ (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions