Risk Management (3) Flashcards
Which of the following are considered inappropriate places to store backup tapes? (Choose two.)
Near a workstation
Near a speaker
Near a CRT monitor
Near an LCD screen
Near a speaker
Near a CRT monitor
Backup tapes should not be stored near power sources such as CRT monitors and speakers. These devices can cause the tapes to be degaussed
You are a member of your company’s security response team and have discovered an incident within your network. You are instructed to remove and restore the affected system. You restore the system with the original disk image and then install patches and disable any unnecessary services to harden the system against any future attacks. Which incident response process have you completed?
Eradication
Preparation
Containment
Eradication
The eradication process involves removing and restoring affected systems by reimaging the system’s hard drive and installing patches
You are a security administrator and have decided to implement a unified threat management (UTM) appliance within your network. This appliance will provide antimalware, spam filtering, and content inspection along with other protections. Which of the following statements best describes the potential problem with this plan?
The protections can only be performed one at a time.
This could create the potential for a single point of failure.
You work with a single vendor and its support department.
You work with a single vendor and its support department.
A unified threat management (UTM) appliance is a single console a security administrator can monitor and manage easily. This could create a single point of failure
You are attending a risk analysis meeting and are asked to define internal threats. Which of the following is not considered an internal threat?
Employees accessing external websites through the company’s hosts
Embezzlement
Threat actors compromising a network through a firewall
Threat actors compromising a network through a firewall
Unauthorized access of a network through a firewall by a threat actor is considered an external threat
You are the network director and are creating the following year’s budget. You submit forensic dollar amounts for the cyber incident response team. Which of the following would you not submit? (Choose two.)
ALE amounts
SLE amounts
Training expenses
Man-hour expenses
ALE amounts
SLE amounts
ALE (annual loss expectancy) is the product of the ARO (annual rate of occurrence) and the SLE (single loss expectancy) and is mathematically expressed as ALE = ARO × SLE. Single loss expectancy is the cost of any single loss and it is mathematically expressed as SLE = AV (asset value) × EF (exposure factor)
Computer evidence of a crime is preserved by making an exact copy of the hard disk. Which of the following does this demonstrate?
Chain of custody
Order of volatility
Capture system image
Capture system image
Capturing the system image involves making an exact image of the drive so that it can be referenced later in the investigation
Which option is an example of a workstation not hardened?
Risk
Threat
Exposure
Risk
Risk is defined as the likelihood of occurrence of a threat and the corresponding loss potential. Risk is the probability of a threat actor to exploit vulnerability. The purpose of system hardening is to remove as many security risks as possible. Hardening is typically performed by disabling all nonessential software programs and utilities from the workstation
Which of the following elements should not be included in the preparation phase of the incident response process?
Policy
Lesson learned documentation
Response plan/strategy
Lesson learned documentation
Lessons learned documentation is a phase of the incident response process
Which of the following does not minimize security breaches committed by internal employees?
Job rotation
Separation of duties
Nondisclosure agreements signed by employees
Nondisclosure agreements signed by employees
Nondisclosure agreements (NDAs) are signed by an employee at the time of hiring, and they impose a contractual obligation on employees to maintain the confidentiality of information. Disclosure of information can lead to legal ramifications and penalties. NDAs cannot ensure a decrease in security breaches
You find one of your employees posting negative comments about the company on Facebook and Twitter. You also discover the employee is sending negative comments from their personal email on the company’s computer. You are asked to implement a policy to help the company avoid any negative reputation in the marketplace. Which of the following would be the best option to fulfill the request?
Account policy enforcement
Change management
Security policy
Security policy
Security policy defines how to secure physical and information technology assets. This document should be continuously updated as technology and employee requirements change
Which of the following statements best describes a differential backup?
Only the changed portions of files are backed up.
All files are copied to storage media.
Files that have changed since the last full backup are backed up.
Files that have changed since the last full backup are backed up.
A differential backup copies files that have changed since the last full backup
During which step of the incident response process does root cause analysis occur?
Preparation
Lessons learned
Containment
Lessons learned
Lessons learned process is the most critical phase because it is the phase to complete any documentation that may be beneficial in future incidents. Documentation should include information such as when the problem was first detected and by whom, how the problem was contained and eradicated, the work that was performed during the recovery, and areas that may need improvement
Which of the following types of testing can help identify risks? (Choose two.)
Quantitative
Penetration testing
Vulnerability testing
Qualitative
Penetration testing
Vulnerability testing
Penetration and vulnerability testing can help identify risk. Before a tester performs these tests, they should receive written authorization
What can a company do to prevent sensitive data from being retrieved by dumpster diving?
Degaussing
Capture system image
Shredding
Shredding
Shredding is the process of reducing the size of objects so the information is no longer usable. Other practices includes burning, pulping, and pulverizing
You are a network administrator and have been asked to send a large file that contains PII to an accounting firm. Which of the following protocols would it be best to use?
Telnet
FTP
SFTP
SFTP
SFTP (secure FTP) encrypts data that is transmitted over the network
