Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > SY0-701: 5.0 (Security Program Management and Oversight) > Flashcards

SY0-701: 5.0 (Security Program Management and Oversight) Flashcards

1
Q

Social Engineering Motivational Triggers (5.6)

A

Authority
Urgency
Social Proof
Scarcity
Likability
Fear

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Soc Eng Trigger- Authority (5.6)

A

The power or right to give orders, make decisions, and enforce obedience

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Soc Eng Trigger- Urgency (5.6)

A

Compelling sense of immediacy or time-sensitivity that drivers individuals to act swiftly or prioritize certain actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Soc Eng Trigger- Social Proof (5.6)

A

Psychological phenomenon where individuals look to the behaviors and actions of others to determine their own decisions or actions in similar situations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Soc Eng Trigger- Scarcity (5.6)

A

Psychological pressure people feel when they believe a product, opportunity, or resource is in limited or in short supply

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Soc Eng Trigger- Likability (5.6)

A

Associated with being nice, friendly, and socially accepted by others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Soc Eng Trigger- Fear (5.6)

A

Feeling afraid of someone or something, as likely to be dangerous, painful, or threatening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data Ownership (5.1)

A

Process of identifying the person responsible for the confidentiality, integrity, availability, and privacy of the information assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Data Owner (5.1)

A

Senior executive role who has the responsibility for maintaining the confidentiality, integrity, and availability of the information asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Data Controller (5.1)

A

Entity that holds responsibility for deciding the purposes and methods of data storage, collection, and usage and for guaranteeing the legality of processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Data Processor (5.1)

A

Group or individual hired by the Data Controller to help with tasks like collecting, storing, or analyzing data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data Steward (5.1)

A

Focused on the quality of the data and the associated metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Data Custodian (5.1)

A

Responsible for handling the management of the system on which the data assets are stored (e.g. SysAdmin)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Privacy Officer (5.1)

A

Role that is responsible for the oversight of any kind of privacy-related data, like PII (Personally Identifying Information), SPI (Sensitive Personal Information), PHI (Personal Health Information)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk Management (5.2)

A

Fundamental process that involves identifying, analyzing, monitoring, and reporting risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk Management Lifecycle (5.2)

A
  1. Risk identification
  2. Risk analysis
  3. Risk treatment
  4. Risk monitoring
  5. Risk reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk Assessment Frequency (5.2)

A

Refers to how often the risk assessment process is conducted within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Risk Assessment Frequency Types (5.2)

A

Ad-hoc
Recurring
One-Time
Continuous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Ad-hoc (5.2)

A

Conducted as and when needed, often in response to a specific event or situation that has the potential to introduce new risks or change the nature of existing risks; associated with specific events or situations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Recurring (5.2)

A

Conducted at regular intervals, such as annually, quarterly, or monthly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

One-Time (5.2)

A

Conducted for a specific purpose and are not repeated; associated with a specific project or initiative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Continuous (5.2)

A

Ongoing monitoring and evaluation of risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Risk Identification (5.2)

A

Recognizing potential risks that could negatively impact an organizations ability to operate or achieve its objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

RTO (5.2)

A

Recovery Time Objective- Represents the maximum acceptable length of time that can elapse before the lack of a business function severely impacts the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

RPO (5.2)

A

Recovery Point Objective- Represents the maximum acceptable amount of data loss measured in time (if business has RPO of 4 hours then it can handle 4 hours of down time)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

MTTR (5.2)

A

Mean Time To Repair- Represents the average time required to repair a failed component or system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

MTBF (5.2)

A

Mean Time Between Failure- Represents the average time between failures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

BIA (5.2)

A

Business Impact Analysis- Process that involves evaluating the potential effects of disruption to an organizations business functions and processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Risk Register (Risk Log) (5.2)

A

A document detailing identified risks, including their description, impact likelihood, and mitigation strategies; contains:
Risk description
Risk impact
Risk likelihood
Risk outcome
Risk level
Cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Risk description (5.2)

A

Entails identifying and providing a detailed description

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Risk impact (5.2)

A

Potential consequences if the risk materializes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Risk likelihood (5.2)

A

Chance of a particular risk occurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Risk outcome (5.2)

A

Result of a risk, linked to its impact and likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Risk level / Threshold (5.2)

A

Determined by combining the impact and likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Cost (5.2)

A

Pertains to its financial impact on the project, including potential expenses if it occurs or the cost of risk mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Risk Tolerance / Risk Acceptance (5.2)

A

Refers to an organizations or individuals willingness to deal with uncertainty in pursuit of their goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Risk Appetite (5.2)

A

Signifies an organizations willingness to embrace or retain specific types and levels of risk to fulfill its strategic goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Expansionary Risk Appetite (5.2)

A

Organization is open to taking more risk in the hopes of achieving greater returns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Conservative Risk Appetite (5.2)

A

Implies that an organization favors less risk, even if it leads to lower returns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Neutral Risk Appetite (5.2)

A

Signifies a balance between risk and return

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

KRIs (5.2)

A

Key Risk Indicators- Essential predictive metrics used by organizations to signal rising risk levels in different parts of the enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Risk Owner (5.2)

A

Person or group responsible for managing the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Qualitative Risk Analysis (5.2)

A

A method of assessing risks based on their potential impact and the likelihood of their occurrence (usually described as Low, Medium, High); Subjective and high level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Quantitative Risk Analysis (5.2)

A

A method of evaluating risk that uses numerical measurements (usually described as a number); Objective and numerical evaluation of risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

EF (5.2)

A

Exposure Factor- Proportion of an asset that is lost in an event (expressed as a percentage)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

SLE (5.2)

A

Single Loss Expectancy- Monetary value expected to be lost in a single event (expressed as a monetary amount)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

ARO (5.2)

A

Annualized Rate of Occurrence- Estimated frequency with which a threat is expected to occur within a year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

ALE (5.2)

A

Annualized Loss Expectancy- Expected annual loss from a risk (SLE x ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Risk Management Types (5.2)

A

Transfer
Accept
Avoid
Mitigate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Risk Transference (Risk Sharing) (5.2)

A

Involves shifting the risk from the organization to another party (most common type is insurance)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Contract Indemnity Clause (5.2)

A

A contractual agreement where one party agrees to cover the others harm, liability, or loss stemming from the contract (form of risk transference)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Risk Acceptance (5.2)

A

Recognizing a risk and choosing to address it when it arises

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Exemption (5.2)

A

Provision that grants an exception from a specific rule or requirement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Exception (5.2)

A

Provision that permits a party to bypass a rule or requirement in certain situations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Risk Avoidance (5.2)

A

Strategy of altering plans or approaches to completely eliminate a specific risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Risk Mitigation (5.2)

A

Implementing measures to decrease the likelihood or impact of a risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Risk Monitoring (5.2)

A

Involves continuously tracking identified risks, assessing new risks, executing response plans, and evaluating their effectiveness during a projects lifecycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Residual Risk (5.2)

A

Likelihood and impact after implementing mitigation, transference, or acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Risk Reporting (5.2)

A

Process of communicating information about risk management activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Third Party Vendor Risk (5.3)

A

Potential security and operational challenges introduced by external entities (vendors, suppliers, or service providers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

MSP (5.3)

A

Managed Service Providers- Individuals hired by companies to manage IT services on behalf of an organization

62
Q

Supply Chain Attack (5.3)

A

Attack that involves targeting a weaker link in the supply chain to gain access to a primary target

63
Q

CHIPS Act (5.3)

A

US federal statute that provides roughly $280 billion in new funding to boost research and manufacturing of semiconductors inside the United States

64
Q

Steps to minimize supply chain attacks (5.3)

A

Vendor due diligence
Regular monitoring and audits
Education and collaboration
Incorporating contractual safeguards

65
Q

Vendor Assessment (5.3)

A

Process that organizations implement to evaluate the security, reliability, and performance of external entities

66
Q

Penetration Testing (5.3)

A

Simulated cyberattack against the suppliers system to check for exploitable vulnerabilities

67
Q

Right-to-Audit Clause (5.3)

A

Grants organizations the right to evaluate vendors

68
Q

Internal Audit (5.3)

A

Vendors self-assessment where they evaluate their own practices against industry standards or organizational requirements

69
Q

Independent Assessment (5.3)

A

Evaluation conducted by third-party entities that have no stake in the organizations or vendors operations

70
Q

Supply Chain Analysis (5.3)

A

Used to dive deep into a vendors entire supply chain and assess the security and reliability of each link

71
Q

Vendor Assessment (5.3)

A

Process that organizations implement to evaluate the security, reliability, and performance of external entities

72
Q

Due Diligence Topics (5.3)

A

Financial Stability
Operational History
Client Testimonials
On-the-Ground Practices

73
Q

Conflict of Interest (5.3)

A

Arises when personal or financial relationships could potentially cloud the judgment of individuals involved in vendor selection

74
Q

Vendor Questionnaires (5.3)

A

Comprehensive documents that potential vendors fill out to offer insights into the operations, capabilities, and compliance

75
Q

Rules of Engagement (5.3)

A

Guidelines that dictate the terms of interaction between an organization and its potential vendors

76
Q

Vendor Monitoring (5.3)

A

Mechanism to ensure that the chosen vendor still aligns with the organizational needs and standards

77
Q

Feedback Loops (5.3)

A

Involve a two-way communication channel where both the organization and the vendor share feedback

78
Q

Basic Contract (5.3)

A

Versatile tool that formally establishes a relationship between two parties

79
Q

SLA (5.3)

A

Service-Level Agreement- The standard of service a client can expect from a provider

80
Q

MOA (5.3)

A

Memorandum of Agreement- Formal agreement and outlines the specific responsibilities and roles of the involved parties

81
Q

MOU (5.3)

A

Memorandum of Understanding- Less binding than a MOA and more of a declaration of mutual intent

82
Q

MSA (5.3)

A

Master Service Agreement- Blanket agreement that covers the general terms of engagement between parties across multiple transactions

83
Q

SOW (5.3)

A

Statement of Work (sometimes called Scope of Work or Work Order)- Used to specify details for a particular project

84
Q

NDA (5.3)

A

Non-Disclosure Agreement- Commitment to privacy that ensures that any sensitive information shared during negotiations remains confidential between both parties

85
Q

BPA (5.3)

A

Business Partnership Agreement (sometimes called a Joint Venture or JV)- Document that goes a step beyond the basic contract when two entities decide to pool their resources for mutual benefit

86
Q

Governance (5.1)

A

Strategic leadership, structures, and processes that ensure an organizations IT infrastructure aligns with its business objectives

87
Q

GRC Triad (5.1)

A

Governance, Risk Management, and Compliance

88
Q

Monitoring (5.1)

A

Regularly reviewing and assessing the effectiveness of the governance framework

89
Q

Revision (5.1)

A

Updating the governance framework to address these gaps or weaknesses

90
Q

Governance- Boards (5.1)

A

A board of directors is a group of individuals elected by shareholders to oversee the management of an organization

91
Q

Governance- Committees (5.1)

A

Subgroups of a board of directors, each with a specific focus

92
Q

Governance- Government Entities (5.1)

A

They establish laws and regulations that organizations must comply with

93
Q

Governance- Centralized Structures (5.1)

A

Decision-making authority is concentrated at the top levels of management

94
Q

Governance- Decentralized Structures (5.1)

A

Distributes decision-making authority throughout the organization

95
Q

AUP (5.1)

A

Acceptable Use Policy- A document that outlines the do’s and don’ts for users when interacting with an organizations IT systems and resources

96
Q

Information Security Policy

A

Outline how an organization protects its information assets from threats, both internal and external; handles:
Data Classification
Access Control
Encryption
Physical Security

97
Q

Business Continuity Policy (5.1)

A

Focuses on how an organization will continue its critical operations during and after a disruption

98
Q

Disaster Recovery Policy (5.1)

A

Focuses specifically on how an organization will recover its IT systems and data after a disaster

99
Q

Incident Response Policy (5.1)

A

A plan for handling security incidents

100
Q

SDLC Policy (5.1)

A

Software Development Lifecycle- Guides how software is developed within an organization

101
Q

Change Management Policy (5.1)

A

Aims to ensure that changes are implemented in a controlled and coordinated manner, minimizing the risk of disruptions

102
Q

Password Standards (5.1)

A

Dictate the complexity and management of passwords, which are the first line of defense against unauthorized access

103
Q

Access Control Standards (5.1)

A

Determine who has access to what resources within an organization

104
Q

Access Control Types (5.1)

A

DAC- Discretionary Access Control
MAC- Mandatory Access Control
RBAC- Role-Based Access Control

105
Q

DAC (5.1)

A

Discretionary Access Control- Allows owner of information or resource decide who can access it

106
Q

MAC (5.1)

A

Mandatory Access Control- Uses labels or classifications to determine access

107
Q

RBAC (5.1)

A

Role-Based Access Control- Uses roles within an organization to determine access

108
Q

Physical Security Standards (5.1)

A

These standards cover the physical measures taken to protect an organizations assets and information

109
Q

Encryption Standards (5.1)

A

Ensure that data intercepted or accessed without authorization remains unreadable and secure

110
Q

Procedures (5.1)

A

Systematic sequences of actions or steps taken to achieve a specific outcome (e.g. Emergency Evacuation Procedure)

111
Q

Change Management (5.1)

A

Systematic approach to dealing with changes within an organization

112
Q

Onboarding/Offboarding (5.1)

A

The process of integrating new employees into the organization / The process of managing the transition when an employee leaves

113
Q

Playbooks (5.1)

A

Checklist of actions to perform to detect and respond to a specific type of incident

114
Q

Regulatory Considerations (5.1)

A

These regulations can cover a wide range of areas, from data protection and privacy to environmental standards and labor laws

115
Q

Legal Considerations (5.1)

A

Closely tied to regulatory considerations, but they also encompass other areas such as contract law, intellectual property, and corporate law

116
Q

Industry Considerations (5.1)

A

The specific standards and practices that are prevalent in a particular industry

117
Q

Geographic Considerations (5.1)

A

Local ordinance, state regulations, national laws, regulations implemented by countries

118
Q

Compliance Reporting (5.4)

A

Systematic process of collecting and presenting data to demonstrate adherence to compliance requirements

119
Q

Internal Compliance Reporting (5.4)

A

Collection and analysis of data to ensure that an organization is following its internal policies and procedures

120
Q

External Compliance Reporting (5.4)

A

Demonstrating compliance to external entities such as regulatory bodies, auditors, or customers, often mandated by law or contract

121
Q

Compliance Monitoring (5.4)

A

The process of regularly reviewing and analyzing an organizations operations to ensure compliance with laws, regulations, and internal policies

122
Q

Due Diligence (5.4)

A

Conducting an exhaustive review of an organizations operations to identify potential compliance

123
Q

Due Care (5.4)

A

The steps taken to mitigate the risks revealed from their due diligence

124
Q

Attestation (5.4)

A

Formal declaration by a responsible party that the organizations processes and controls are compliant

125
Q

Acknowledgement (5.4)

A

Recognition and acceptance of compliance requirements by all relevant parties

126
Q

Internal Monitoring (5.4)

A

Regularly reviewing an organizations operations to ensure compliance with internal policies

127
Q

External Monitoring (5.4)

A

Third-party reviews or audits to verify compliance with external regulations or standards

128
Q

Automation in Compliance (5.4)

A

Automated compliance systems can streamline data collection, improve accuracy, and provide real-time compliance monitoring

129
Q

Non-Compliance Consequences (5.4)

A

Fines
Sanctions
Reputational Damage
Loss of License
Contractual Impacts

130
Q

Audits (5.5)

A

Systematic evaluations of an organizations information systems, applications, and security controls (can be internal or external)

131
Q

Assessments (5.5)

A

Performing a detailed analysis of an organizations security systems to identify vulnerabilities and risks

132
Q

Assessment Types (5.5)

A

Risk Assessments
Vulnerability Assessments
Threat Assessments

133
Q

Compliance (5.5)

A

Ensuring that information systems and security practices meet established standards, regulations, and laws

134
Q

Audit Committee (5.5)

A

Group of people responsible for supervising the organizations audit and compliance functions

135
Q

Internal Assessment (5.5)

A

An in-depth analysis to identify and assess potential risks and vulnerabilities in an organizations information systems

136
Q

Self-Assessment (5.5)

A

Internal review conducted by an organization to gauge its adherence to particular standards or regulations

137
Q

Independent Third-Party Audit (5.5)

A

Offers validation of security practices, fostering trust with customers, stakeholders, and regulatory authorities

138
Q

Physical Pentesting (5.5)

A

Testing an organizations physical security through testing locks, access cards, security cameras, and other protective measures

139
Q

Offensive Pentesting (5.5)

A

aka Red Team- Proactive approach that involves use of attack techniques, akin to real cyber threats, that seek and exploit system vulnerabilities

140
Q

Defensive Pentest (5.5)

A

aka Blue Team- Reactive approach that entails fortifying systems, identifying and addressing attacks, and enhancing incident response times

141
Q

Integrated Pentesting (5.5)

A

aka Purple Team- Combination of aspects of both offensive and defensive testing into a single penetration test

142
Q

Reconnaissance (5.5)

A

An initial phase where critical information about a target system is gathered to enhance an attacks effectiveness

143
Q

Active Reconnaissance (5.5)

A

Direct engagement with the target system, offering more information but with a higher detection risk

144
Q

Passive Reconnaissance (5.5)

A

Gathering information without direct engagement with the target system, offering lower detection risk but less data (e.g. OSINT)

145
Q

Known Enviroonment (5.5)

A

Detailed target infrastructure information from the organization is received prior to the test

146
Q

Partially Known Environment (5.5)

A

Involves limited information provided to testers, who may have partial knowledge of the system

147
Q

Unknown Environment (5.5)

A

Testers receive minimal to no information about the target system

148
Q

Metasploit (5.5)

A

Multi-purpose computer security and penetration testing framework that encompasses a wide array of powerful tools, enabling the execution of penetration tests

149
Q

Attestation (5.5)

A

Similar to a pentest report but also includes proof

150
Q

Software Attestation (5.5)

A

Involves validating the integrity of software by checking that it hasn’t been tampered with or altered maliciously

151
Q

Hardware Attestation (5.5)

A

Involves validating the integrity of hardware components

152
Q

System Attestation (5.5)

A

Involves validating the security posture of a system

Security+ (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions