Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Risk Management > Flashcards

Risk Management Flashcards

1
Q

What is the CIA of Security?

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which element of the CIA of Security is the goal of keeping data secret from anyone who doesn’t have the need or the right to access that data?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which element of CIA of Security ensures the data and systems stays in an unaltered state when being transferred, received?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which element of CIA of Security ensures that systems and data are available to users when needed?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the act of keeping track of things that on such as who has been logging in, who has made changes to something, etc?

A

Auditing and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A user can’t deny that they have performed a particular action

A

Non-Repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the people and organizations that actually do the attacks called?

A

Threat Actors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which threat actor is known for trivial attacks due to lack of knowledge?

A

Script Kiddies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which threat actor is motivated by intent to make a public social statement?

A

Hacktivist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the motivation of Nation states and advanced persistent threat (APT) threat actors?

A

Intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Who is someone inside the company that has information to gain access that can be used as an attack?

A

Insider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

the potential to harm organizations, people, IT equipment, etc.

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Provides benefits to the organizations; equipment or people

A

Assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Weakness that allows an asset to be exploited

A

vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A discovered action that exploits a vulnerability’s potential to do harm to an asset

A

threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What defines the level of certainty that something is going to happen?

A

Likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the actual harm caused by a threat?

A

Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

an outside party looks for vulnerabilities and reports it

A

Penetration (pen) testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

effort to reduce impact of a risk

A

mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

offload some of the likelihood and risk on a third party

A

risk transference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

reach a point where the likelihood and impact is so high that i simply don’t want to do deal with it

A

risk acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the workflow or methodology process that helps security professionals deal with risk management?

A

Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are two examples of a Risk management framework

A

NIST Risk Management Framework, ISACA Risk IT Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the threshold value to verify expected throughput or action?

A

Benchmark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

manufacturers’ security guides to setup and review configurations

A

platform or security guide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a general purpose guide in terms of risk assessment?

A

a list of security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the three types of security controls?

A

Administrative (management), Technical, Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are some examples of Administrative security control?

A

laws, policies, guidelines, best practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are some examples of Technical security control?

A

computer stuff, firewalls, password links, authentication, encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are some examples of Physical security control?

A

gates, guards, keys, man traps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

In terms of security control functions, what is a deterrent?

A

deters the actor from attempting the threat

32
Q

In terms of security control functions, what is a preventative?

A

deters the actor from performing the threat

33
Q

In terms of security control functions, what is a detective?

A

recognizes an actor’s threat

34
Q

In terms of security control functions, what is a corrective

A

mitigates the impact of a manifested threat

35
Q

In terms of security control functions, what is compensating?

A

provides alternative (usually temporary) fix

36
Q

How is mandatory vacation used a security control

A

requires individuals to take vacation; used to detect fraud and unauthorized activity

37
Q

how is job rotation used as a security control

A

periodically switching jobs prevents fraud and unauthorized activity

38
Q

How is multi-person control used as a security control

A

more than one person is required to do a job; allows for checks and balances of critical functions

39
Q

How is separation of duties used as a security control?

A

one person is not allowed to perform all duties. this is to prevent unauthorized activity

40
Q

users are only granted the privilege needed to perform their job (need to know) This prevents unauthorized access to information

A

principle of least privileged

41
Q

In terms of defense, repeating the same controls at various intervals

A

redundancy

42
Q

In terms of defense , use of variety of controls in a random pattern

A

diversity

43
Q

What are the types of sources for IT Security Governance?

A

Laws and regulations, standards, best practices, common sense

44
Q

defines how we are going to be doing something; broad in nature, used as directives, defines roles and responsibilities

A

Governance policy

45
Q

What defines what a person can or cannot do on company assets?

A

Acceptable use Policy

46
Q

Which policies defines how to get access to data or resources and what type of data users have access to?

A

Access Control Policies

47
Q

Which policy defines how you deal with passwords, password recovery, bad login, retention, reuse, etc.

A

Password policy

48
Q

Which policy defines how to maintain company equipment?

A

Care and Use of Equipment

49
Q

What policy defines how your data or data usage will be shared with other resources?

A

Privacy policies

50
Q

Which policy defines the people that are dealing with our data

A

Personnel Polices

51
Q

What are the sources that frameworks come from?

A

regulatory, non-regulatory, national standards, international standards, industry-specific frameworks

52
Q

What is the first go-to for IT security professionals who want to be able to understand to perform a risk management framework?

A

NIST SP800-37

53
Q

What are the NIST risk management steps?

A

Categorize, Select, Implement, Assess, Authorization, Monitor

54
Q

What is asset value?

A

the value of an asset + the cost of fixing the asset

55
Q

What is exposure value?

A

percentage of an asset that is lost as a result of an incident

56
Q

What is the formula for Single Loss Expectancy?

A

Asset Value * Exposure Factor

57
Q

What is annualized Rate of occurrence (ARO)?

A

in a given year, what are the chances of this particular instance taking place

58
Q

What is the formula for Annualized Loss Expectancy (ALE)?

A

Single Loss Expectancy (SLE) * Annualized rate of occurrence (ARO)

59
Q

What is mean time to repair?

A

time it takes to repair

60
Q

What is mean time to failure?

A

time it takes to fail (how long is it working)

61
Q

What is the mean time between the two failures?

A

The time in between two failures (MTTR+MTTF)

62
Q

What estimates the cost of loss of personal privacy or proprietary data?

A

Privacy Impact Assessment (PIA)

63
Q

What is the min time necessary to restore a critical system to operation?

A

Recovery Time Object (RTO)

64
Q

What is the max data that can be lost without substantial impact?

A

Recovery Point Object (RPO)

65
Q

What allows recipients of the data to know if or how the data can be shared?

A

Data sensitivity/labeling

66
Q

What is the owner in terms of data roles?

A

legally responsible for the data

67
Q

What is the steward/custodian in terms of data roles?

A

maintain the accuracy and integrity of data

68
Q

What is the privacy officer in terms of data roles?

A

ensures data adheres to privacy policies and procedures

69
Q

Which Data (user) role is assigned standard permissions to complete task?

A

User

70
Q

Which Data (user) role has increased access and control relative to a user?

A

Privileged user

71
Q

Which Data (user) role sets policies on data and incident response actions?

A

Executive user

72
Q

Which Data (user) role has complete control over the data or system?

A

System administrator

73
Q

Which Data (user) role has legal ownership and responsibility of data or system?

A

data owner/system owner

74
Q

Manufacturer and vendor guides provide what?

A

Setup suggestions

75
Q

a self-directed combination of administrative, physical, and technical controls is an example of..

A

defense in depth

76
Q

What describes the set of overarching rules that defines how an organization and its employees conduct themselves?

A

Governance

Security+ (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions