Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CASP+ > Topic 1 - Supporting IT Governance and Risk Management > Flashcards

Topic 1 - Supporting IT Governance and Risk Management Flashcards

1
Q

What are two widely used “Information Classification” systems?

A

Government Classification System, which focuses on Confidentiality, and Commercial Classification System with focuses on Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What’s the equation to calculate Single Loss Expectancy (SLE)?

A

Asset Value (AV) x Exposure Factor (EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define Mergers and Acquisitions

A

The combination of two or more commercial companies into a single surviving entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the name of a risk report containing the findings, information, assessments, and recommendations for an organization?

A

Risk assessment report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an IT Audit?

A

An examination of controls within an information technology system or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Ranking elements of a risk assessment by non-monetary values is to do a…

A

Qualitative Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Assigning a monetary value to elements of a risk assessment is to do a …

A

Quantitative Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the four categories of the Commercial Classification System?

A

Public, Sensitive, Private, Confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is FISMA?

A

Federal Information Security Management Act addresses info sec requirements for no n-national security government agencies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain the final phase of the risk management process, “continuous monitoring “

A

Continuous monitoring allows organizations to evaluate the effectiveness of controls on a near or real-time basis since it occurs immediately or closely after events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are examples of insecure data transmission protocols?

A

FTP, Telnet, HTTP, SMTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who is responsible for identifying and analyzing risks?

A

The risk management team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define a “Risk Detterence”

A

A process, policy or system that discourages others from exploiting a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is COBIT?

A

Control Objectives for Information Related Technology. It is a leading governance framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define the ESA framework SABSA

A

Sherwood Applied Business Security Architecture is a strategy based on an architectural viewpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is GLBA?

A

Gramm-Leach-Bliley Act is a law overhauling financial services regulation in the US and applies to financial institutions.

Subtitle A requires institutions to make disclosures about privacy policies and opt-out capability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an SLA?

A

Service Level Agreement that defines performance targets for hardware and software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are SLA examples?

A

Help Desk and Caller Services, Uptime and Availability Agreements,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is FISMA 2014?

A

The updated version of the original 2002 Federal Information Security Management Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is ISAM?

A

INFOSEC Assessment Methodology - A qualitative assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is an HSM?

A

Hardware Security Module. It’s a type of secure cryptoprocessor targeted at managing keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is “business continuity planning”?

A

The formation of a plan on what to do if your business suffers a disruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are policies?

A

High-level documents that outline the security goals and objectives of the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the measurement called that tracks the time it takes to go from a failure to repaired for an asset

A

MTTR - Mean time to Repair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Define a Partnership business model

A

A model where two or more entities share potential profit and risk with each other.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a vulnerability?

A

A vulnerability can be described as a weakness in hardware or software that may be exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Encrypted file system (EFS) and VeraCrypt are examples of?

A

Software encryption options for data-at-rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

A group risk assessment that allows people to contribute anonymously is known as …

A

Delphi Technique

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the IT Governance Institute Framework?

A

A process that begins with setting objectives for the enterprise’s IT , providing initial direction and then evolving into a continuous loop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Outsourcing?

A

An arrangement in which one company provides services for another company that may or may not have been provided in-house

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is GDPR?

A

General Data Protection Regulation in the EU that affects multi-national companies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define “Asset Identification”

A

The process of identifying all of the organization’s assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is a vulnerability window?

A

When an IT asset is most vulnerable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the types of business models?

A

Outsourcing, Partnerships and Mergers and Acquisitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a TPM?

A

Trusted Platform Module.

A specialized chip that can be installed on the motherboard of a computer and is used for hardware authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Define the ESA framework EA

A

Enterprise Architecture used by the federal government to ensure business strategy and IT investments are aligned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is an asset?

A

An asset is an item of value to an institution, such as data, hardware, software or physical property.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are the four categories of the Government Classification System?

A

Unclassified, Confidential, Secret and Top Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are examples of risk sources?

A

The source of a risk can be either internal or external. Internal example is a disgruntled employee and external example is a natural disaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is HIPAA?

A

Health Insurance Portability and Accountability Act is a law regarding privacy that has three major purposes:

  1. To provide consumers with access to their health information
  2. To improve quality of health care in the US by restoring trust in the system
  3. Creating a national framework for health privacy protection
41
Q

What are examples of “Tangible Assets”?

A

Hardware and software

42
Q

List the three security control types

A

Physical controls (door locks), technical controls (cameras, anti-virus), operation controls (background checks, security awareness training)

43
Q

A quick risk assessment based on a series of questions is known as …

A

FRAP - Facilitated Risk Assessment Process

44
Q

List potential risks in a Partnership business model

A

Loss of Competency, broken agreements, service deterioration, poor cultural fit, hidden costs

45
Q

What is a Zero-Day?

A

An exploit the vendor either doesn’t know about, or that no patch or mitigation exists for

46
Q

What is a network boundary?

A

The point at which your control ends

47
Q

List proper equipment disposal methods

A

Drive wiping, zeroization, degaussing, physical destruction

48
Q

Define Annualized Rate of Occurrence (ARO)

A

Frequency at which a specified risk will be realized over a single year

49
Q

What are threat examples that pertain to IT security?

A

Natural disaster, malicious code, breach of physical security, hacker attack, DDoS, cyberterrorism

50
Q

Define “Risk Appetite”

A

The amount of risk a company is willing to accept

51
Q

What is a threat?

A

Any situation that affects confidentiality, availability or integrity of an IT asset

52
Q

What does “CVE” stand for?

A

Common vulnerabilities and exposures. It’s a system to normalize data about a vuln so fixing or mitigating is less of a challenge

53
Q

What is SOX?

A

Sarbanes-Oxley Act mandated reforms to enhance corporate responsibility, enhance financial disclosures and combat corporate and accounting fraud. Section 302 requires the CEO and CFO to certify personally that the org has proper internal controls. Section 404 requires infrastructure designed to archive records and data while protecting it from destruction and loss.

54
Q

What are examples of “Intangible Assets”?

A

Reputation and services

55
Q

Define “RPO” and “RTO”

A

Recovery Point Object - the tolerable period of time between the last backup and the failure, which is what data would be lost. A 5 minute RPO provides you with data lost only over the last 5 minutes.

Recovery Time Objective - The amount of time required to bring the systems back online and restore normal access that the company wants to tolerate

56
Q

What do you call an unmitigated risk when discussing risk assessment?

A

An exemption

57
Q

Explain “Risk Mitigation Planning”

A

Comes after a quantitative or qualitative assessment and is to make a determination and decide which security controls should be applied.

58
Q

What is the name of a predictable interval between failures of an asset?

A

MTBF - Mean time between failures

59
Q

What is Operational Risk?

A

Either a company’s internal and external practices, or external sources such as government agencies or regulatory requirements.

60
Q

List two common “Enterprise Security Architecture (ESA)” frameworks

A

Enterprise Architecture (EA) and Sherwood Applied Business Security Architecture (SABSA)

61
Q

Define Exposure Factor (EF)

A

The percentage of loss experienced IF a specific asset were attacked. Based on asset value

Examples: Perhaps an attack doesn’t render an asset totally inaccessible or inoperable

62
Q

What is Risk?

A

Risk is the probability/likelihood of the occurrence or realization of a threat

63
Q

What is motivation?

A

The driving force behind an activity

64
Q

List the four alternatives for handling potential risks

A

Avoid, Accept, Transfer, Mitigate

Avoid - to eliminate - examples being withdraw from a practice or not become involved
Accept - acknowledging it has been understood and evaluated but senior management has made the decision that the benefits of moving forward outweigh the risk.
Transfer - Deflect to a third party
Mitigate - A control is used to reduce the risk

65
Q

What is the equation to calculate Annualized Loss Expectancy (ALE)

A

Annualized Rate of Occurrence (ARO) x Single Loss Expectancy (SLE)

66
Q

Define compliance

A

Being in accordance with agreed-upon guidelines, specifications, legislation, or regulations

67
Q

Enterprise Resilience is ..

A

An approach to risk management that anticipates disruptions, better ensures recovery, and protects business profitability

68
Q

Explain the purpose of “Risk Assessment”

A

To evaluate risks in terms of the likelihood and the magnitude of an impact, to determine a response strategy and to monitor progress in reducing the threat.

69
Q

What are the four strategic responses to positive risks?

A

exploit, share, enhance and accept

70
Q

List the Qualitative risk assessment grade scale

A

Low, Medium and High across CIA

Low = Minor inconvenience
Medium = Can  Result in damage to an organization
High = Will result in a loss of goodwill, legal action or fine
71
Q

What is the CIA triad?

A

Confidentiality, Integrity and Availability

72
Q

Define Confidentiality and list the most common controls…

A

Keeping good data away from bad actors | Encryption, data classification, awareness training

73
Q

Define Integrity and list the most common controls..

A

Change control for data with no unauthorized modification without knowledge and consent of data owner | hashing, IDS, strict access controls

74
Q

Define Availability and list the most common controls..

A

Authorized subjects can access objects in a timely manner without interruption | redundant system design, continuous monitoring and testing of backups

75
Q

Define IT governance

A

A concept in which stakeholders ensure that those who govern IT resources are fulfilling objectives and strategies

76
Q

What is “Due Diligence”

A

Good governance/good oversight. Loosely, overseeing action, directing it with governance, policy and providing strategy so people understand objectives

77
Q

What is “Due Care”

A

Good actions/acting aligned with the structure from due diligence so we are doing the right things, not wrong things.

Loosely, if you are at a pool and there are rules on the wall, like no running, the actions abiding by those rules is Due Care.

78
Q

What is a countermeasure (control)?

A

mechanism to minimize risk

79
Q

What is residual risk?

A

remaining risk after countermeasures applied

80
Q

Define the risk management cyclical process

A

Identify, Assess, Analyze and Respond

81
Q

What is ERM

A

Enterprise Risk Management - process of evaluation, measuring and mitigating risks at an organization level

82
Q

What is a semi-quantitative analysis

A

Attempts to find a middle ground between the two types

83
Q

What is a security framework?

A

A reference point with common language. Examples: SOX, NIST, SABSA,

84
Q

What is a policy?

A

Direction from senior management (strategic)

85
Q

What is a standard?

A

Formalized from external guidance (regulatory example GDPR)

86
Q

What is a procedure?

A

Step by step method of accomplishing something (tactical)

87
Q

What is a Guideline?

A

best practice re commendation

88
Q

What is de-perimeterization?

A

The process of shifting, reducing or removing some enterprise boundaries to facilitate interactions with the world outside of it’s domain

89
Q

When talking system-specific risk analysis, what are common questions to ask?

A

How can the attack be performed? / Can the attack be performed in the current network?

90
Q

What is a Aggregate CIA score?

A

A subjective score on a sliding scale of harm. The highest risks are rated a 10, the lowest risks are rated at 1 and data having no risk is rated at 0.

The CIA attributes of information are compared to the threat that each attribute faces, then multiplied to produce a total. Value x threat = total for an attribute

The total risk for each attribute are added to produce the aggregate CIA score for that entire risk.

91
Q

What is the “Golden Rule”

A

It’s very important to incorporate stakeholder input as part of the process.

Seek the blessing and the authorization and the acceptance of senior leadership before you implement anything.

92
Q

What is the CVSS?

A

Common Vulnerability Scoring System - A risk management approach where vuln data is quantified and then the degrees of risk to systems or information are taken into account. v3.1 is the current vector.

Metrics are base (AV/AC/PR/UI/S/C/I/A), temporal (E/RL/RC), environmental or specific context (

Used to score vulnerabilities in CVE

93
Q

What is a Business Impact Analysis (BIA)

A

Business Impact Analysis - Used to determine impact a disruptive event would have on an org.

Goals: determine criticality/ estimate max downtime / evaluate resource requirements

Steps: gather requirements & info/vuln assessment/risk anlysis/ communicate findings

94
Q

What are examples of documents that support security initiatives

A

MSA - Master Services Agreement - Expedites agreement process
SOA - Statement of applicability - identifies controls in place
BIA - Business Impact Analysis - identifies present organizational risks
IA - Interoperability Agreement - general term for any doc that outlines a business partnership
ISA - Interconnection security agreement -
MOU - Memorandum of Understanding - not legally binding
SLA - Service Level Agreement - clearly defines what services are to be provided to the client
OLA - Operating Level Agreement - identifies and defines the working relationships between groups or divisions
NDA - Non Disclosure Agreement - an agreemnt between entities stipulating you will not share specific information with unauthorized third parties
BPA - Business Partner Agreement - defines how a partnership between business entities will be conducted

95
Q

What are all the ways you can measure downtime?

A 
Maximum allowable downtime (MAD)/ Maximum tolerable downtime (MTD )
recovery time objective (RTO)
recovery point objective (RPO)
mean time to failure (MTTF)
meant time to repair (MTTR)
mean time between failures (MTBF)
96
Q

What are the 5 steps of incident response?

A

Detection, Response, Reporting, Recovery, Remediation and Review

97
Q

Describe two-man control

A

Two operators review and approve each other’s work

98
Q

What are the MIL levels for a Cyber Resilience Review (CRR)

A 
MIL0 - Incomplete
MIL1 - Performed
MIL2 - Planned
MIL3 - Managed
MIL4 - Measured
MIL5 - Defined

CASP+ (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions