Security Program Management and Oversight Obj 5.2

Question 1

Risk tolerance

Answer 1

Risk tolerance refers to an organization’s predetermined level of acceptable risk exposure. It represents the extent to which an organization is willing to tolerate potential risks before taking action to mitigate or avoid them.

Question 2

Exposure factor

Answer 2

The exposure factor is a calculation that determines the amount of value that is lost if an event takes place. It doesn’t measure an organization’s level of acceptable risk exposure

Question 3

Grey box test

Answer 3

For a grey box test, the tester has limited information about the target system. This might include specific details about its architecture or certain user credentials. This type of test represents a middle ground, providing a blend of both internal and external perspectives on potential vulnerabilities.

Question 4

White box testing

Answer 4

In a white box test, the tester possesses complete knowledge of the target environment, including its architecture, design, and source code. It allows for an in-depth examination of the system to find vulnerabilities that might be overlooked in other test types. Boundary testing focuses on the system’s input and output data limits. Testers will try to use values at, just below, or just above these boundaries to see if the system behaves unexpectedly or reveals vulnerabilities.

Question 5

Black box testing

Answer 5

A black box test is executed without any prior knowledge of the target environment. The tester approaches the system from an outsider’s perspective, mimicking an external attacker with no insight into the system’s design or functionality.

Question 6

Risk management term to describe the effect of a risk event on an organization, particularly in terms of operational, financial, and reputational harm

Answer 6

Impact is a standard term used in risk management to describe the effect of a risk event on an organization, particularly in terms of operational, financial, and reputational harm?

Question 7

What security awareness practice involves conducting simulated email attacks to educate employees about recognizing and responding to phishing attempts?

Answer 7

Phishing campaigns (Correct)
Anomalous behavior recognition
Reporting and monitoring
User guidance and training

Question 8

In the context of compliance monitoring, which of the following does “due diligence/care” refer to?

Answer 8

Taking steps to meet legal and other requirements. (Correct)
Conducting internal audits on a regular basis.
Reviewing third-party vendor agreements.
Automated compliance checks.