Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia SEC+ > Section 5.4 Risk Management Processes & Concepts > Flashcards

Section 5.4 Risk Management Processes & Concepts Flashcards

1
Q

What is the act of identifying, assessing and reducing the risk of issues that can impact your organizations operations and assets?

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What kind of risk comes from elements within the organization’s control?

A

Internal Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What kind of risk is usually the type of risk that the organization has limited control over?

A

External Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The cost of reducing a risk is mitigated by what?

A

The potential cost of dealing with a security breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Ultimately, __________ is a cost/benefit analysis of your security infrastructure.

A

Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

________ involves identifying both types of assets and determining asset value?

A

Asset Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Asset value should consider?

A

Repair/Replace Costs
Deprecation,
Revenue Generated
Value to competition
Exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What identifies the critical risks that pose a security threat?

A

Risk analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What kind of risk analysis is a numerical calculation of the exact cost of the loss of a specific company asset because of disaster?

A

Quantative risk analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What kind of risk analysis considers tangible and intangible factors in determining costs?

A

Qualitative risk analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The consolidation of many different types of services on the same hardware creates a security risk known as?

A

Single Point of Failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What allows a computer to host multiple instances of an operating system environment, all running from the same computer on the same hardware?

A

Use of Virtualization Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What do you call the current awareness of the risk associated with an organization, both internal and external?

A

Risk awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What do you call the amount of risk that is acceptable to an organization?

A

Risk Tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What do you call the level of risk that an organization is willing to take before actions are taken to reduce the risk?

A

Risk Appetite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What do you call the untreated risk, or the level of risk before any controls have been put into place to mitigate or counter risk?

A

Inherent risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What do you call the risk that occurs when internal controls either fail to reduce risk or misstate the amount of risk that is present or being mitigated?

A

Control risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do you call the level of risk that remains after controls are put into place to mitigate or reduce risk?

A

Residual Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What depicts the rating of various risks according to the likelihood of occurrence and potential impact?

A

Risk Matrix Format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What will dictate how much funds need to be budgeted for risk countermeasures and mitigation?

A

Likelihood and Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The funds that are budgeted for risk countermeasures and mitigation?

A

Annualized Loss Expectancy (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The annualized loss expectancy (ALE) is calculated by multiplying?

A

Annualized Rate of Occurrence (ARO) x Single Loss Expectancy (SLE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What concept prevents sensitive and private data from being intercepted or read by unauthorize users?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Ensuring confidentiality for risk control often entails including:

A

Encryption and Access Control Measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What concept ensures that your data is consistent and never modified by unauthorized persons or manipulated in any intentional or accidental manner?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What concept ensures information can be trusted from the supposed sender?

A

Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Data integrity includes the use of what for protecting data against manipulation?

A

Proper authentication
Authorization Security Techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Data integrity includes the use of what for protecting data from corruption?

A

Redundancy Planning
Fault Tolerant Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the common risk control methods of ensuring integrity?

A

Hashing
Digital Signatures
Certificates

30
Q

What concept ensures that your systems and networks are always operation and providing service to users?

A

Availability

31
Q

When considering risk control, what ensures availability?

A

Implementation of Hot\Warm\Cold sites
Site Sharing Agreements

32
Q

What concept ensures that personnel will be safe and then that organizational priorities will be carried out?

A

Safety

33
Q

The cost of risk management solutions should not exceed the value of?

A

The asset if it is lost

34
Q

What do you call a living document use to track different types of data elements, most commonly risk factors and risk scenarios?

A

Risk Register

35
Q

What risk management strategy opts to avoid the risk all together?

A

Risk avoidance

36
Q

What risk management strategy transfers, or “passes on” the risk to a 3rd party?

A

Risk Transference

37
Q

What risk management strategy decides to just deal with the risk?

A

Risk Acceptance

38
Q

What risk management strategy decides to use countermeasures?

A

Risk Mitigation

39
Q

What types of disasters occur based on location?

A

Environmental

40
Q

Environmental disasters are protected against by?

A

Data Backups
Offsite Locations

41
Q

What types of disasters can be accidental or intentional?

A

Person-made

42
Q

Person-made disasters are protected against by?

A

Access Controls
Physical Security

43
Q

What kind of disasters happen to a company that is permanently connected to the internet and can come from inside and outside of the network?

A

Network and Hacking Attacks

44
Q

What kind of disasters are caused by special programs able to replicate themselves?

A

Virus attacks

45
Q

Protection against virus attacks include:

A

Antivirus Software
User Education

46
Q

What are extremely important in preventing downtime for your organization in the event of equipment or communications failure?

A

Disaster Recovery
Operations Planning

47
Q

What do you call a step by step plan to recover your networks and systems in the event of a disaster?

A

Disaster Recovery Plan

48
Q

Who are responsible for creating and executing business continuity activities and a disaster recovery plan that outlines the goals for restoring company operations and functionality as quickly as possible following a disaster?

A

Disaster Recovery Team

49
Q

What assessment looks for single points of failures and looks to replace them with redundant or fault tolerant systems?

A

Site Risk Assessments

50
Q

What analysis outlines your organizations most critical functions and how they’ll be affected during a disaster?

A

Business Impact Analysis (BIA)

51
Q

What do you call the most important functions to complete?

A

Mission Essential Functions (MEF)

52
Q

Critical business functions and their associated systems must be prioritized so that in case of a disaster, they’ll be what?

A

They will be made operation before other less critical functions and systems

53
Q

Most important in the BIA will be examining?

A

Total Financial loss incurred through certain types of disasters

54
Q

What analysis’s purpose is to determine if a system is using privacy information or connecting to one that is?

A

Privacy Threshold analysis

55
Q

The most important part of an organization to get operational in the event of a disaster is what?

A

Communications

56
Q

Inside of DRP documentation, what includes a list of people and businesses to notify in case of a disaster?

A

Notification List

57
Q

Inside of DRP documentation, what includes phone numbers and contact information for employees, vendors, data recovery agencies, and offsite facilities?

A

Contact information

58
Q

Inside of DRP documentation, what included blueprints and diagrams of all networking and facilities infrastructure so they can be re-created at the new site?

A

Networking and facility diagrams

59
Q

Inside of DRP documentation, what includes configuration information for all servers, applications, and networking equipment?

A

System configurations

60
Q

Inside of DRP documentation, what includes step-by-step information on how to restore data from the backup media?

A

Backup restoration procedures

61
Q

Inside of DRP documentation, what includes the operating system software, appropriate license keys, and backup media?

A

Location of Backup and licensing media

62
Q

To complete your disaster recovery plan, you should do what to ensure that all parts of the plan work as they should?

A

Test it

63
Q

What is it called when departments sit together and go through scenarios?

A

Tabletop excercises

64
Q

What do you all a report that allows you to give an honest assessment of the testing, detail the areas that should be improved upon, and identify the path forward for filling any gaps?

A

After Action Report(AAR) or Lessons learned report

65
Q

High availability systems want to provide what?

A

Uninterrupted service consistently

66
Q

What term specifies in measurable terms the level of service to be received, such as the percentage of time services are available?

A

Service Level

67
Q

What industry-standard term refers to the average length of time from the moment a component fails until it is repaired?

A

Mean Time to Repair (MTTR)

68
Q

What industry-standard term refers to the length of time that a component is expected to last in regular service?

A

Mean Time to Failure (MTTF)

69
Q

What industry-standard term refers to the average length of time a specific component is expected to work until it fails?

A

Mean Time between Failures (MTBF)

70
Q

What industry-standard term refers to the maximum amount of time that is considered tolerable for a service or certain business function to be unavailable?

A

Recovery Time Objective (RTO)

71
Q

What industry-standard term refers to the maximum acceptable amount of lost data due to an outage or disaster?

A

Recovery Point Objective (RPO)

72
Q

What is a strategy to deflect threats in order to avoid the costly and disruptive consequences of a damaging event?

A

Risk avoidance

Comptia SEC+ (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions