Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

my class > my class > Flashcards

my class Flashcards

cram

1
Q

A __________ consists of multiple servers using ______________.

A

web farm, network load balancing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Bob is the project manager for his company’s security countermeasure implementation project. Michael informs Bob that task #12 (implementing a failover cluster) will not finish on time. Because task #12 is on the project’s __________, Bob knows that the project will not complete on time and sets up a meeting to inform the stakeholders.

A

critical path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following is not commonly included in a cost-benefit analysis (CBA)?

A

A business continuity plan (BCP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

All of the following would be specified in a password policy, except:

A

password management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which tool is most commonly used to prioritize mitigation efforts?

A

Threat likelihood/impact matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are overlapping countermeasures?

A

Different countermeasures that attempt to mitigate the same risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the primary tool used to ensure countermeasures are implemented?

A

Plan of action and milestones (POAM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which approach to firewall rules starts off by blocking all traffic and then adding rules to allow approved traffic?

A

Implicit deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

After being fired, an employee becomes disgruntled. The managers never disabled his login information, and his best friend still works at the company. The disgruntled employee gives his friend his login information for the company’s private network and convinces the friend to delete important files from the company’s database. You are confused when you review the audit logs and see that the disgruntled employee has been logging in from within the office every day for the past week. What has been lost in this scenario?

A

Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following terms is best defined as a weakness?

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

___________ prevents individuals from denying they took an action.

A

Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the purpose of a risk mitigation plan?

A

To implement countermeasures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The National Institute of Standards and Technology (NIST) publishes SP 800-53. This document describes a variety of IT security controls, such as access control, incident response, and configuration management. Controls are grouped into families. Which NIST control family helps an organization recover from failures and disasters?

A

Contingency Planning (CP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following is a physical control that is most likely to be used with a proximity card?

A

A locked door

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Purchasing insurance is the primary way for an organization to __________ or ___________ risk.

A

share, transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following is not a true statement about AES?

A

AES is the primary asymmetric encryption protocol used today.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A hacker wants to launch an attack on an organization. The hacker uses a tool to capture data sent over the network in cleartext, hoping to gather information that will help make the attack successful. What tool is the hacker using?

A

A packet analyzer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What changes plaintext data to ciphered data?

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

__________ provide the detailed steps needed to carry out ___________.

A

Procedures, policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which of the following is not one of the three primary objectives of controls?

A

Eliminate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the purpose of nonrepudiation techniques?

A

To prevent people from denying they took actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Some controls are identified based on the function they perform. What are the broad classes of controls based on function?

A

Preventative, detective, corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following is most likely to describe how to perform test restores?

A

A backup plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A business continuity plan (BCP) is an example of a(n):

A

security plan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Lower recovery time objectives (RTOs) are __________ but __________.

A

achievable, costly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the primary hazard of attempting to recover without a business impact analysis (BIA)?

A

Wasted effort due to a lack of direction as to which resources are most critical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

ABC Wholesale Pet Supply sells pet supplies to retailers. Every transaction results in a duplicate hardcopy paper shipping document and invoice. The person picking up the order signs the documents and takes one copy. Two other copies stay at the warehouse. How would using multiple hardcopies of each transaction affect ABC's recovery point objective (RPO)?

A

Duplicate hardcopies of transactions increase complexity and decrease tolerable data loss.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

A business impact analysis (BIA) identifies an impact that can result from a:

A

disruption in a business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are critical resources?

A

Those that are required to support critical business functions (CBFs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

After developing a business impact analysis (BIA) for her organization, Maria was asked by her manager to update the BIA recommendations with a higher recovery time objective (RTO). What is the most likely reason management would argue for a higher RTO?

A

Lower RTOs are more expensive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the primary purpose of identifying critical resources in the business impact analysis (BIA) process?

A

Identify all IT assets that support critical business functions (CBFs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

By identifying critical business functions (CBFs) first, you use a ________ approach.

A

top-down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which term is sometimes referred to as the maximum tolerable period of disruption (MTPD)?

A

Maximum acceptable outage (MAO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the first two steps in the business impact analysis (BIA) process?

A

Identify the environment and identify stakeholders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which of the following is not a direct cost?

A

Costs to regain market share

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which of the following is not an indirect cost?

A

Cost to re-create or recover data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which of the following can determine that a business function is critical?

A

Any stakeholder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Your team is developing a business impact analysis (BIA). You have identified the critical business functions (CBFs) and associated processes. What should you do next?

A

Map processes to IT systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

A business continuity plan (BCP) program manager within a large organization:

A

usually manages multiple BCP projects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which business continuity plan (BCP) test type brings all participants together in a conference room or similar environment to walk through BCP scenarios?

A

Tabletop exercise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Which key planning principle guides the development of a business continuity plan (BCP)?

A

Length of time expected before returning to normal operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the overall goal of business continuity plan (BCP) exercises?

A

To demonstrate how the BCP will work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Having supplies on hand for continued production:

A

may conflict with other organizational planning principles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Who is the most common person to authorize business continuity plan (BCP) activation in the order of succession if the chief executive officer (CEO) is unavailable?

A

Chief information officer (CIO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the primary difference between a functional exercise and a full-scale exercise?

A

A full-scale exercise is more realistic than a functional exercise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What step of a business continuity plan (BCP) comes after providing training?

A

Testing and exercising plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the primary determination as to whether an incident is included in a business continuity plan (BCP)?

A

Probability of occurrence and impact

48
Q

Which of the following is a business continuity plan (BCP) phase that focuses on returning to normal operations?

A

Reconstitution phase

49
Q

When an emergency is declared, the ____________ contact(s) appropriate teams or team leads.

A

business continuity plan (BCP) coordinator

50
Q

Regarding business continuity, what is the first phase of activity if a disruption occurs?

A

The notification and activation phase

51
Q

What business continuity plan (BCP) team is responsible for declaring the severity of an incident?

A

DAT

52
Q

Functional descriptions of systems are often used for documenting:

A

critical business functions (CBFs).

53
Q

What is the primary benefit of a business continuity plan (BCP)?

A

To better prepare the organization to respond to an interruption

54
Q

In a business continuity plan (BCP), if a system houses data, the data must be protected according to:

A

its level of classification.

55
Q

How are business continuity plans (BCPs) and disaster recovery plans (DRPs) related?

A

A DRP is a part of the larger BCP.

56
Q

Which of the following is not one of the three commonly used business continuity plan (BCP) teams?

A

Critical contractor

57
Q

Who is responsible for activating the business continuity plan (BCP)?

A

BCP coordinator

58
Q

What is the purpose of a business continuity plan (BCP)?

A

To ensure that mission-critical elements of an organization continue to operate during and after a disruption

59
Q

Which of the following mainly applies to any organization that handles health information?

A

HIPAA

60
Q

What is a service level agreement (SLA)?

A

A document that identifies an expected level of performance

61
Q

Which of the following is a significant part of control evaluation to determine which controls to implement?

A

Cost-benefit analysis (CBA)

62
Q

Devaki is the office manager for a small medical practice in California. Part of her duties is to ensure the practice is in compliance with any relevant regulations or standards. Self-pay patients pay for services via cash, check, or payment card. Which of the following does Devaki need to ensure compliance with?

A

HIPAA and PCI DSS

63
Q

The primary risks associated with the User Domain of a typical IT infrastructure are related to:

A

social engineering.

64
Q

The Remote Access Domain of a typical IT infrastructure allows __________ to access the ________ network.

A

remote users, private

65
Q

Health Insurance Portability and Accountability Act (HIPAA) fines for mistakes can be as high as __________ a year.

A

$25,000

66
Q

Wen is performing a cost-benefit analysis (CBA). He needs to determine whether the organization should move workloads from the in-house data center to the cloud. The projected benefit is $50,000. The cost of the control is $1,500. What is the control value?

A

$48,500

67
Q

Tonya has been asked to research compliance and then provide a report to upper management. Management wants to know what the organization must do to comply with a regulation that protects the privacy of citizens in the European Union. Which of the following will Tonya research?

A

General Data Protection Regulation (GDPR)

68
Q

__________ is the biggest problem you can face if you do not identify the scope of your risk management project.

A

Scope creep

69
Q

MAO is sometimes referred to as:

A

MTPOD.

70
Q

Which of the following is not true of the WAN Domain of a typical IT infrastructure?

A

Internal-facing servers are configured in the demilitarized zone between two firewalls.

71
Q

A disaster recovery plan (DRP) simulation:

A

goes through the steps and procedures in a controlled manner.

72
Q

What is the difference between fault tolerance and disaster recovery?

A

Fault tolerance mitigates component failures, and disaster recovery restores operations after a major loss.

73
Q

Which type of alternate location is the hardest to test for disaster readiness?

A

Cold site

74
Q

Which of the following is the most important consideration of a disaster recovery plan (DRP)?

A

Protecting personnel

75
Q

What does the scope section of a disaster recovery plan (DRP) define?

A

What is and is not covered in the plan

76
Q

What key element is necessary for a disaster recovery plan (DRP) to succeed in a time of crisis?

A

Management support

77
Q

What communication elements are important to the success of a disaster recovery plan (DRP)?

A

Recall, users, customers, and a communication plan

78
Q

The recovery time objective (RTO) is derived from what value from the business impact analysis (BIA)?

A

Maximum acceptable outage (MAO)

79
Q

Which term is defined as the minimum level of services that are acceptable to an organization to meet its operational business needs?

A

Minimum business continuity objective (MBCO)

80
Q

What causes a disaster recovery plan (DRP) to be activated?

A

Realizing criteria specified in the DRP

81
Q

What is the primary purpose of a disaster recovery plan (DRP)?

A

To restore critical business processes or systems to operation

82
Q

Critical business functions (CBFs) support:

A

mission-critical operations.

83
Q

A redundant backup site is:

A

hosted by a third-party vendor.

84
Q

What is critical data?

A

Data that supports critical business functions (CBFs)

85
Q

Why should an organization regularly review and update its disaster recovery plan (DRP)?

A

To ensure the plan reflects changes to IT systems

86
Q

Disaster recovery procedures begin after ___________ and ___________.

A

activating the disaster recovery plan (DRP), assessing the damage

87
Q

What is the primary reason for testing a disaster recovery plan (DRP)?

A

To ensure it performs as expected

88
Q

___________ increases the availability of systems even when an isolated outage occurs, while ___________ provides the procedures to recover systems after a major failure.

A

Fault tolerance, disaster recovery

89
Q

Isabella is preparing to write a disaster recovery plan (DRP). What must she have before she proceeds with writing?

A

A clear idea of her primary concerns

90
Q

Wren is defining the scope for his organization's disaster recovery plan (DRP). What items should he consider?

A

Hardware, software, data, and connectivity

91
Q

True or False? Asymmetric encryption uses a public key and a private key.

A

True

92
Q

True or False? A backup plan is often included as part of a business continuity plan (BCP).

A

False

93
Q

True or False? Planned controls have been approved but not installed.

A

True

94
Q

True or False? Certificates in a public key infrastructure (PKI) are used for decoding encrypted data.

A

False

95
Q

True or False? Every control must meet all three primary objectives of controls: prevent, detect, and recover.

A

False

96
Q

True or False? The term "rules of behavior" refers to an acceptable use policy (AUP).

A

True

97
Q

True or False? True or False? The two primary terms related to recovery requirements are RTO and RPO.

A

True

98
Q

True or False? Starting with clear objectives is a best practice for performing a business impact analysis (BIA).

A

True

99
Q

True or False? Critical success factors (CSFs) include elements necessary to perform the mission of an organization.

A

True

100
Q

True or False? In regards to system recovery, RPO stands for recovery policy objective.

A

False

101
Q

True or False? In a small organization, a single person can be responsible for the planning, implementation, and execution of a business continuity plan (BCP).

A

False

102
Q

True or False? Regarding business continuity, recovery planning often takes the format of a business impact analysis (BIA).

A

False

103
Q

True or False? Scope creep can occur if the scope of a business continuity plan (BCP) is not defined.

A

True

104
Q

True or False? Criticality of operations identifies the order of importance of each of the seven domains of the typical IT infrastructure.

A

False

105
Q

True or False? The clear intent of a DRP should be mission-critical functions first and personnel next.

A

False

106
Q

True or False? A disaster recovery plan (DRP) starts by identifying critical assets.

A

False

107
Q

True or False? By addressing critical business functions (CBFs), disaster recovery plans (DRPs) help ensure that critical servers and services continue.

A

True

108
Q

True or False? A warm site is a compromise between a hot site and a cold site.

A

True

109
Q

True or False? Ensuring business impact analyses (BIAs) have been completed is a best practice when implementing a DRP.

A

True

110
Q

True or False? A cost-benefit analysis (CBA) helps determine if a countermeasure should be used.

A

True

111
Q

True or False? Planned countermeasures are the same as in-place countermeasures.

A

False

112
Q

True or False? Because you have scheduled everything when you completed the risk assessment, there is no need to update the plan of action and milestones (POAM) during risk mitigation planning.

A

False

113
Q

True or False? An implicit deny policy starts by allowing all traffic through a firewall.

A

False

114
Q

True or False? The maximum tolerable period of disruption (MTPOD) directly impacts the maximum acceptable outage (MAO) time.

A

False

115
Q

True or False? A service level agreement (SLA) often includes the minimum uptime or the maximum downtime of a service or system.

A

True

116
Q

True or False? How an organization starts its risk mitigation process depends entirely on upper management preference.

A

False

117
Q

True or False? Installing antivirus software is a primary protection implemented in the User Domain of a typical IT infrastructure.

A

False

my class (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions