Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Security+ 601 > 5.0 Flashcards > Flashcards

5.0 Flashcards

(70 cards)

Start Studying
1
Q

MTBF

A

Mean Time Between Failures
Provides a measure of a system’s reliability and is usually represented in hours. The average time a system or component operates before it fails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RTO

A

Recovery Time Objective
Identifies the maximum amount of time it can take to restore a system after an outage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

MTTR

A

Mean Time To Repair
A common measure of how long it takes to repair a given failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

RPO

A

Recovery point objective

Identifies a point in time where data loss is acceptable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Owner

A

Individual or entity responsible for making decisions about how data is collected, used, protected, and managed within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data Controller

A

Manages the purposes and means by which personal data is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data Processor

A

Entity processing personal data on behalf of a data controller, following instructions provided by the controller and ensuring data protection and security measures are implemented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data Custodian/Steward

A

Individual or team responsible for the physical or technical aspects of data management, including storage, security, access control, and maintenance, ensuring data integrity and compliance with policies and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ALE

A

Annualized Loss Expectancy
Estimated financial impact expected from a specific risk over a year, calculated by multiplying the Single Loss Expectancy (SLE) with the Annualized Rate of Occurrence (ARO).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SLE

A

Single Loss Expectancy
The value (or cost) of a loss expected from a single event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ARO

A

Annualized Rate of Occurrence

Estimation of how often a specific threat or risk is expected to occur within a year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

GDPR

A

General Data Protection Regulation
European Union regulation governing the protection, processing, and transfer of personal data of individuals within the EU and EEA (European Economic Area), focusing on data privacy and rights.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

PCI DSS

A

Payment Card Industry Data Security Standard

Security standard developed by major credit card companies to protect cardholder data, outlining requirements for secure payment processing, data encryption, access control, and compliance validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AUP

A

Acceptable Use Policy

A guideline that defines acceptable and unacceptable behaviors when using a system or service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Managerial controls

A

Focus on the management of risk or the management of the cybersecurity system.
Ex. Risk assessments, Vulnerability assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Operational controls

A

Helps ensure that the day-to-day operations of an organization comply with their overall security plan.
Ex. Awareness and training, Configuration management, Media protection, Physical and environmental protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Technical controls

A

Use technology such as hardware, software, and firmware to reduce vulnerabilities.
Ex. Encryption, Antivirus software, Firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Preventative (control type)

A

Act before an event, preventing it from advancing.
Ex. firewalls, encryption, locks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Detective (control type)

A

Act during an event, alerting operators to specific conditions.
Ex. IDS, SIEM, CCTV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Corrective (control type)

A

Respond to and fix security incidents after they have been detected. They aim to minimize the impact and restore normal operations.

Ex. incident response plans, patches, backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Deterrent (control type)

A

Acts to discourage the attacker by reducing the likelihood of success from the perspective of the attacker.

Ex. security training, warning signs, compliance notices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Compensating (control type)

A

It is used to meet a requirement when there is no control available to directly address the threat.

Ex. encryption, MFA, network segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Physical (control type)

A

Are any controls that you can physically touch.

Ex. Key Card Systems, Biometric Scanners, Fire Suppression Systems, HVAC Systems, Fences and Gates, Bollards, Security Guards, Patrols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

CSA

A

Cloud Security Alliance

A nonprofit organization that promotes best practices for cloud security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Least Privilege
Should have only the rights and privileges necessary to perform its task
26
Gamification
Intertwines game-design elements within user training methods to increase participation and interaction.
27
CTF
Capture the Flag Practice hacking into a server to find data (the flag)
28
CBT
Computer-based training A computer program that has self-paced modules to facilitate skill development across a wide range of skills, and the flexibility.
29
Supply Chain
A set of firms that operate together to manage the movement of goods and services between firms.
30
Vendors
Firms or individuals that supply materials or services to a business
31
SLA
Service Level Agreement A contract between a service provider and a customer that outlines performance expectations, such as minimum uptime and maximum downtime levels.
32
MOU
Memorandum of Understanding A formal agreement between two or more parties that expresses an understanding of their intention to work together toward a common goal.
33
MSA
Measurement Systems Analysis Used to evaluate and assess the reliability and accuracy of measurement systems.
34
BPA
Business Partnership Agreement An agreement that outlines the terms and conditions of a partnership between two or more parties engaged in a business venture.
35
EOL
End of Life When the manufacturer quits selling an item.
36
EOSL
End of Service Life The provider of the item or service will typically no longer sell or update it.
37
Data Retention
The management of the data lifecycle with an emphasis on when data reaches its end of useful life for an organization
38
Data Governance
Managing data quality in enterprise systems through policies due to the involvement of many data owners and users.
39
Change Management
Policies on how configurations should be changed.
40
Change Control
Managing the details of the systems changes.
41
Multi-party risk
Breaches involving multiple parties
42
IP theft
Intellectual Property theft Theft of ideas, inventions, and creative expressions.
43
Risk Transference
Transferring the risk to another party, such as through outsourcing or insurance
44
Risk Acceptance
A business decision to accept the risk and its potential consequences without taking any action.
45
Risk Avoidance
Eliminating the risk by avoiding the activity that creates the risk
46
Risk Mitigation
Decrease the risk level and invest in security systems
47
Risk register
A tool in risk management and project management Sometimes used to fulfill regulatory compliance but often to track potential issues that can derail intended outcomes.
48
Inherent risk
The amount of risk that exists in the absence of controls.
49
Control Risk
Risk that internal controls within an organization may not effectively prevent or detect errors or fraud that could lead to material misstatement in financial reporting.
50
Residual risk
The presence of risks in a system is an absolute—they cannot be removed or eliminated.
51
DRP
Disaster Recovery Plan Detailed plan for resuming operations after a disaster
52
Proprietary Data
Data that is property of an organization
53
PII
Personally Identifiable Information Data that can be used to identify an individual
54
PHI
Protected Health Information Health information associated with an individual
55
PIA
Privacy Impact Assessment An analysis of how PII is handled through business processes and an assessment of risks to the PII during storage, use, and communication.
56
Data Minimization
A principle requiring organizations to limit the data they collect and use
57
Data Masking
Involves the hiding of data by substituting altered values.
58
Anonymization
The process of protecting private or sensitive information by removing identifiers that connect the stored data to an individual. Once done can't undo
59
Pseudo-Anonymization
Replaces PII and other data with pseudonyms or artificial identifiers. Can revert back
60
Single Point of Failure
Is a component within a system that can cause the entire system to fail if the component fails.
61
Qualitative Risk
Assessment involves prioritizing risks based on their potential danger, such as low, medium, and high.
62
Quantitative
Involves assigning numerical values to the likelihood of an event occurring and the impact it would have. Usually involves the use of metrics and models
63
DPO
Data Protection Officers Ensure the organization’s compliance with data protection laws and best practices.
64
Separation of duties
a basic security principle that ensures that no single person can control all the elements of a critical function or system.
65
Separation of Duties
A subject should be given only those privileges necessary to complete their job-related tasks.
66
Least Privilege
A subject should be given only those privileges necessary to complete their job-related tasks.
67
Social Media Analysis
Analysis of a potential employee's social media during the hiring process to understand more about an individual based on their Internet presence.
68
Risk control assessment
Occurs when a company periodically checks that the risk controls that they have in place are still effective with changing technology.
69
Risk control self-assessment
Conducted by employees within the company, often through survey or department-level review. Inherent risk
70
Control risk

CompTIA Security+ 601 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions