Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ > Risk Management > Flashcards

Risk Management Flashcards

1
Q

Looking to define threats specific to your infrastructure

A

Threat Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Control Function

Recognized an actors threat

A

Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Control Function

Mitigates the impact of manifested threat

A

Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CIA

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Organizing Data

-Limited to authorized viewing as agreed on by the parties involved

A

Confidential Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Differential Backup

A

Everyday you’d make a backup of any changes since the full backup - to do a full system recovery you’d need the original backup plus the last differential backup made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Outside company checks your vulnerabilities by trying to get in but not doing anything harmful

A

Penetration(Pen) Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Security Policies

-Define the importance or nature of the data

A

Data Sensitivity and Classification Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Control actions towards IT security

  • laws
  • policies
  • guidelines
  • best practices
A

Administrative Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security Control Function

Deters the actor from attempting the threat

A

Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ARO

A

Annualized Rate of Occurence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data User Roles

-Set policy on data and incident response actions

A

Executive User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Control Actions IT systems make toward IT Security

  • computer stuff
  • firewalls
  • password links
  • authentication
  • encryptions
A

Technical Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Role Based Data Controls

-Read only access but can look at all business data

A

Executive User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Threats x Vulnerability

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk Response - offload some of the impact to 3rd party

A

Risk transference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In-house document of how they store data

A

Privacy Threshold Assessment (PTA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Security Policies

-Defines what a person can or can not do when using company assets

A

Acceptable Use Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Use a variety of physical, administrative, and technical controls to have good…

A

Defense in Depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data User Roles

-Complete control over data and could delete everything - sets permissions

A

System Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Structural threat

A

Physical system failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Defense in Depth

-different types of controls

A

Diversity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Organizing Data
-Health Insurance Portability and Accounting Act
HIPAA

A

Private Health Information (PHI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

3 Security Controls

A

Administrative/Techincal/Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Initiates a threat

A

Threat Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Data Roles

-Person who is in charge of ensuring data adheres to privacy policies and procedures

A

Privacy Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Security Policies

  • How you maintain equipment
  • How you borrow equipment
A

Care and Use of Equipment Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Apply to infrastructure to protect and remediate current and potential problems

A

Security Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data Roles

-Maintain the accuracy and integrity of the data

A

Steward/Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Incremental Backup

A

Everyday you’d make a backup of any changes since the last incremental backup - to do a full system recovery you’d need the original backup plus all the incremental backups made since

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Scan that shows vulnerabilities

A

NESSUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

PIA

A

Privacy Impact Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Data User Roles

-Assigned standard permissions to complete tasks

A

User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Accidental threat

A

Someone innocently corrupts or damages something

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Security Policies

  • How you deal with passwords
  • Password recovery/retention/reuse/ect.
A

Password Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Role Based Data Controls

  • Defines the security of the data
  • Defines the protection of data
  • Works with system owner to protect data
  • Defines access to the data
A

Data Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

PII

A

Personally Identifiable Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Security Control Function

Deters the actor from performing the threat

A

Preventative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Security Policies

  • How to get access to data or resources
  • What kind of data do users have access to
A

Access Control Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What does this help with?

-Separation of duties?

A

Requires dual execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Data User Roles

-Increased access and control relative to a user

A

Privileged User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Defense in Depth

-same type of control but many of them as backups

A

Redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Agreement used by Government and Private Sector…

  • Service to be provided
  • Minimum up-time
  • Response time
  • Start and end dates
A

Service Level Agreement (SLA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Threat Actors - Motivation is intelligence

A

Nation States/Advanced Persistent Threat(APT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Documents that define how to do something

A

Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

A Memorandum of Understanding/Agreement is a….

A

Notice that specifies the responsibilities of each party and defines the terms of the agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Qualitative likelihood

A

Perceived

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q 
Mandatory vacation
Job rotation
Multi person control
Separation of duties
Principals of least privilege
A

Interesting Security Controls

49
Q

SLE(Single Loss Expectancy) x ARO(Annualized Rate of Occurence) =

A

ALE(Annualized Loss Expectancy)

50
Q

Data Roles

-Legal responsibility for the data

A

Owner

51
Q

Risk Response - seek to avoid hazards/risk entirely

A

Risk avoidance

52
Q

Adversarial threat

A

Hacker/Malware

53
Q

Threat Actors - Intent is motivation

A

Hacktivist

54
Q

ALE

A

Annualized Loss Expectancy

55
Q

BPA

A

Business Partners Agreement

56
Q

Guidelines

A

Are optional and don’t have to be clearly defined

57
Q
  1. Categorize
  2. Select
  3. Implement
  4. Assess
  5. Authorize
  6. Monitor
    ^Example of a ….
A

Framework

58
Q

NIST

A

National Institute of Standards and Technology

59
Q

Role Based Data Controls

  • Has special access to data beyond the typical user
  • Works closely with system admins to ensure data security
A

Privileged User

60
Q

Maximum amount of data that can be lost without substantial impact

A

Recovery Point Objective (RPO)

61
Q

Threat Actors - Motivation is money

A

Organized Crime

62
Q

MTBF

A

Mean Time Between Failures

63
Q

-Disable accounts(never delete)
-Return credentials
-Exit interview
^Examples of what?

A

Offboarding

64
Q

Sandbox

A

The attacker thinks they’re on a real system but it’s just a virtual system designed to look like the real one

65
Q

cve.mitre.org

A

Common vulnerabilities and exposures

66
Q

Interconnections security agreement (ISA) are used in the…

A

Public Sector (Government)

67
Q

Vulnerability/Threat assesment

A

Risk Identification/Assesment

68
Q

Which type of agreement is needed when two private-sector people or organizations wish to work together?

A

Business Partners Agreement (BPA)

69
Q
  • Determine mission processes
  • Identify critical systems
  • Single foint of failure
  • Identify resources requirements
  • Identify recovery priorities
A

Business Impact Analysis

70
Q

Role Based Data Controls

  • Accesses and uses the assigned data responsibly
  • Monitors and reports security breaches
A

User

71
Q

Security Policies

  • Deals with the people dealing with the data
  • Backgrounds/Clearances
A

Personnel Policies

72
Q

Asset Value x Exposure Factor =

A

Single Loss Expectancy (SLE)

73
Q

PCI-DSS

A

Payment Card Industry Data Security Standard

74
Q

Organizing Data

-Private but also specific in identifying someone

A

Personally Identifiable Information (PII)

75
Q

PTA

A

Privacy Threshold Assessment

76
Q

Organizing Data

-Limited to only the individual whom the information is shared

A

Private Data

77
Q

-Max time system can be down before you’re in trouble, or minimum amount of time necessary to restore system to operation

A

Recovery Time Objective (RTO)

78
Q

Data User Roles

-Usually corporation that has legal ownership over this data set or system

A

Data Owner/System Owner

79
Q

MTTF

A

Mean Time to Failure

80
Q

Buffer overflow attempt

A

Occurs when a program or process attempts to write more data to a fixed length block of memory (a buffer), than the buffer is allocated to hold. By sending carefully crafted input to an application, an attacker can cause the application to execute arbitrary code, possibly taking over the machine
Identified by an intrusion detection/prevention system

81
Q

Actual harm caused by a threat

A

Impact

82
Q

APT

A

Advanced Persistent Threat

83
Q

Risk Response - cost out-ways damage

A

Risk acceptance

84
Q

Organizing Data

  • Like private but at corporate level
    ex: formula for coca-cola
A

Proprietary Data

85
Q

Security Policies

-These are often for customers

A

Privacy Policy

86
Q

(Blank) is key for good Defense in Depth

A

Diversity

87
Q

Things that can be Impacted

A
  • Property
  • People
  • Finance
  • Reputation
88
Q

What is the monetary loss if a single event occurs?

ex:laptop stolen

A

Single Loss Expectancy

89
Q

IOS

A

International Organization of Standardization

90
Q

Set of overarching rules that define how an organization and it’s employees conduct themselves
Influences how the organization conducts IT security

A

Governance

91
Q

Threat Actors - Trivial attack knowledge

A

Script Kiddies

92
Q

What does this help with?

-Job Rotation

A

Backup/Cross Training

93
Q

What does this help with?

-Mandatory Vacations

A

Required dependency issues

94
Q

Role Based Data Controls

  • Management level
  • Maintains security of system
  • Defines system Admin
  • Works with data owners to ensure data security
A

System Owner

95
Q

Anything in infrastructure we’re worried about getting harmed

  • People
  • Equipment
  • Reputation
  • Location/Building
A

Assets

96
Q

MTTR

A

Mean Time to Repair

97
Q

Quantitative Risk Calculations

-Percentage of an asset that’s lost as the result of an incident

A

Exposure Factor

98
Q

Organizing Data

-No restriction/public domain

A

Public Data

99
Q

Quantitative Likelihood

A

Can be measured

100
Q

Control actions in the real world

  • gates
  • guards
  • keys
A

Physical Controls

101
Q

Discovered action that exploits a vulnerability’s potential to do harm to an asset

A

Threats

102
Q

Environmental threat

A

Fire/water/earthquake/ect.

103
Q

Step by step process of how to do something

A

Procedure

104
Q

Weakness that allows an asset to be exploited

A

Vulnerabilities

105
Q

Level of certainty that something will happen

A

Likelihood

106
Q

Workflow that helps deal with risk management

Ex: NIST / ISACA

A

Framework

107
Q

SLE

A

Single Loss Expectancy

108
Q

RPO

A

Recovery Point Objective

109
Q

Defines the acceptable level of performance of policy - more detailed than policy

A

Organizational Standard

110
Q

-Background check
-NDA non-disclosure agreement
-Standard operating procedures
-Specialized issues
-Rules of behavior(acceptable use policy)
-General security policies
^Examples of what?

A

Onboarding

111
Q

Threat Actors - Other businesses/not a big problem now a days

A

Competitors

112
Q

Assessment that tells you what the impact would be to the company if the privacy data they control gets out

A

Privacy Impact Assessment (PIA)

113
Q

RTO

A

Recovery Time Objective

114
Q

Security Control Function

Provides alternative fixes to any of the security control functions

A

Compensating

115
Q

Threat Actors - Not always an employee/Works within the infrustructure

A

Insiders

116
Q

Role Based Data Controls

  • Day to day admin of system
  • Implements system security controls
A

System Admininstrator

117
Q

Risk Response - effort to reduce impact of risk

A

Mitigation

118
Q

PHI

A

Private Health Information

CompTIA Security+ (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions