Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia CYSA+ > Risk Mitigation > Flashcards

Risk Mitigation Flashcards

1
Q

Risk Identification Process

A

Frame
Assess
Respond
Respond

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The comprehensive process of evaluating, measuring, and mitigating the many
risks that pervade an organization

A

The comprehensive process of evaluating, measuring, and mitigating the many
risks that pervade an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Establish a strategic risk management
framework that is supported by
decision makers at the top tier of the
organization

A

Frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Identify and prioritize business
processes/workflow

A

Assess

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Mitigate each risk factor through the deployment of managerial, operational, and
technical security controls

A

Respond

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Evaluate the effectiveness of risk response measures and identify changes that
could affect risk management processes

A

Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Most business assets have a specific value associated with them
In security terms, assets are valued according to the cost created by their loss or damage

A

Conducting an Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A loss associated with no longer being able to fulfill contracts and
orders due to the breakdown of critical systems

A

Business Continuity Loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A loss created by organizational liability due to prosecution (criminal
law) or damages (civil law)

A

Legal Costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A loss created by negative publicity and the consequential loss of
market position or consumer trust

A

Reputational Harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The systematic identification of critical systems by compiling an
inventory of the business processes and the tangible and intangible
assets and resources that support those processes

A

System Assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A business or organizational activity that is too critical to be deferred for anything
more than a few hours (if at all)

A

Mission Essential Function (MEF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The use of a software or hardware solution to track and
manage any assets within an organization

A

Asset/Inventory Tracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An ongoing process of assessing assets against a set of known
threats and vulnerabilities

A

Threat and Vulnerability Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk Calculation

A

Risk = Probability x Magnitude

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Probability

A

Probability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The impact of a successful exploit or a risk event

A

Magnitude

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A risk analysis method that is based on assigning concrete values
to factors

A

Quantitative Method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

AV x EF = SLE

A

Single Loss Expectancy (SLE) only provides the value for a single
occurrence or loss

20
Q

AV

A

Asset Value

21
Q

EF

A

Exposure Factor

22
Q

SLE

A

Single Loss Expectancy

23
Q

The cost of a given risk on an annual basis based on the single loss
expectancy

A

Annual Loss Expectancy (ALE)

24
Q

SLE x ARO = ALE

A

Annual Loss Expectancy

25
Q

ARO

A

Annual Rate of Occurrence

26
Q

ALE

A

Annual Loss Expectancy

27
Q

A risk analysis method that uses opinions and reasoning to measure the likelihood
and impact of risk

A

Qualitative Method

28
Q

A risk analysis method that uses a mixture of concrete values with opinions and
reasoning to measure the likelihood and impact of risk

A

Semi-Quantitative Method

29
Q

A systematic activity that identifies organizational risks and determines their
effect on ongoing, mission critical operations

A

Business Impact Analysis

30
Q

The longest period of time a business can be inoperable without
causing irrevocable business failure

A

Maximum Tolerable Downtime (MTD

31
Q

The length of time it takes after an event to resume normal business
operations and activities

A

Recovery Time Objective (RTO)

32
Q

The length of time in addition to the RTO of individual systems to
perform reintegration and testing of a restored or upgraded system
following an event

A

Work Recovery Time (WRT)

33
Q

The longest period of time that an organization can tolerate lost data
being unrecoverable

A

Recovery Point Objective (RPO)

34
Q

A risk response that reduces a risk to fit within an organization’s risk appetite

A

Risk Mitigation

35
Q

A risk response that involves ceasing an activity that presents risk

A

Risk Avoidance

36
Q

A risk response that involves moving or sharing the responsibility of risk to
another entity

A

Risk Transference

37
Q

A risk response that involves determining that a risk is within the organization’s
risk appetite and no countermeasures other than ongoing monitoring will be
needed

A

Risk Acceptance

38
Q

Control is required by framework, best practice, or regulation

A

Security Control Prioritization

39
Q

Amount of risk a control mitigates

A

Cost of control

40
Q

A metric to calculate whether a security control is worth the cost of deploying and
maintaining it

A

Return on Security Investment (RSOI)

41
Q

An assessment of the benefit of risk reduction against the increased complexity or
cost in a system design or specification

A

Engineering Tradeoff

42
Q

Your job is to explain risk in plain and simple language

A

Communicating Risk

43
Q

A type of security control that acts as a substitute for a principal control

A

Compensating Controls

44
Q

A formal process that is used to document each case where a function or asset is
noncompliant with written policy and procedural controls

A

Exception Management

45
Q

The hostile or attacking team in a penetration test or incident
response exercise

A

Red Team

46
Q

The defensive team in a penetration test or incident response
exercise

A

Blue Team

47
Q

Staff administering, evaluating, and supervising a penetration
test or incident response exercise

A

White Team

Comptia CYSA+ (37 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions