Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Chapter 1: Managing Risk > Flashcards

Chapter 1: Managing Risk Flashcards

1
Q

Anything that can harm your resources. There are three types:

A

A threat; Environmental, Manmade, Internal vs. External

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A graphical tool that is often used to identify threats

A

A risk register

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Deals with the threats, vulnerabilities, and impacts of a loss of information-processing capabilities or a loss of information itself.

A

Risk Assessment (a.k.a risk analysis or risk calculation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A weakness that could be exploited by a threat

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Three chief components of a risk assessment:

A
  1. ) Risks to Which the Organization Is Exposed
  2. ) Risks That Need Addressing
  3. ) Coordination with BIA (Business Impact Analysis)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A monetary measure of how much loss you could expect in a year.

A

Annual Loss Expectancy (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Monetary value that represents how much you could expect to lose at any one time

A

Single Loss Expectancy (SLE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The value of the item

A

Asset value (AV)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

the percentage of the asset threatened

A

Exposure Factor (EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The likelihood, often drawn from historical data, of an event occurring within; a year

A

Annualized Rate of Occurence (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

To compute Risk Assessment:

A

SLE(AV * EF) * ARO = ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A score representing the the possibility of threat initiation.

A

Likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Used to look at the vendors your organization works with strategically and potential risks they introduce.

A

Supply chain assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The way in which an attacker poses a threat

A

Threat vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The measure of the anticipated incidence of failure for a system or component.

A

Mean Time Between Failures (MTBF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The average time to failure for a nonrepairable system.

A

Mean Time to Failure (MTTF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The measurement of how long it takes to repair a system or component once a failure occurs.

A

Mean Time to Restore (MTTR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The maximum amount of time that a process or service is allowed to be down and then consequences still to be considered acceptable.

A

Recovery Time Objective (RTO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Defines the point at which the system needs to be restored

A

Recovery Point Objective (RPO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Often associated with a business impact analysis, and it identifies the adverse impacts that can be associated with the destruction, corruption, or loss of accountability of data for the organization.

A

Privacy Impact Assessment (PIA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.

A

Personally Identifiable Information (PII)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

More commonly known as “analysis” rather than “assessment.” This is the compliance tool used in conjunction with PIA.

A

Privacy Threshold Assessment (PTA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Involves identifying a risk and making the decision not to engage any longer in the actions associated with that risk.

A

Risk Avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Share some of the burden of the risk completely to another entity; like moving some services to the cloud.

A

Risk Transference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Accomplished any time you take steps to reduce risk.

A

Risk Mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

A system that monitors the content of systems (workstations, servers, and networks) to make sure that key content is not deleted or removed.

A

Data Loss Prevention (DLP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The choice that you must make when the cost of implementing any of the other responses exceeds the value of harm that would occur that would occur if the risk came to fruition

A

Risk Acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Hosting services and data on the internet instead of hosting it locally.

A

Cloud Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Vendors allow apps to be created and run on their infrastructure.

A

Platform as a Service (PaaS) a.k. cloud platform services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Applications are run remotely over the web.

A

Software as a Service (SaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Utilizes virtualization, and clients pay a cloud service provider for resources used.

A

Infrastructure as a Service (IaSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Allows one set of hardware to host multiple virtual machines

A

Virtualization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

The software that allows the virtual machines to exist.

A

Hypervisor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Provide the people in an organization with guidance about their expected behavior.

A

Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Outlines what the policy intends to accomplish and which documents, laws, and practices the policy addresses.

A

Scope statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Provides the goal of the policy, why it’s important, and how to comply with it.

A

Policy overview statement

37
Q

Informs the policy readers about the substance of the policy

A

Policy statement

38
Q

Addresses who is responsible for ensuring that the policy is enforced and provides additional information to the reader about who to contact if a problem is discovered.

A

Accountability Statement

39
Q

Provides specific guidance about the procedure or process that must be followed in order to deviate from the policy.

A

Exception Statement

40
Q

Deals with specific issues or aspects of a business.

A

Standard

41
Q

What are the key aspects of standards documents?

A
  1. Scope and Purpose
  2. Roles and Responsibilities
  3. Reference Documents
  4. Performance Criteria
  5. Maintenance and Administrative Requirements
42
Q

The process of evaluation.

A

Audit

43
Q

Help an organization implement or maintain standards by providing information on how to accomplish the policies and maintain the standards.

A

Guidelines

44
Q

What are the four items that make up the minimum contents of a good guidelines document?

A
  1. Scope and Purpose
  2. Roles and Responsibilities
  3. Guideline Statements
  4. Operational Considerations
45
Q

Provide the step-by-step instructions or procedures on how to accomplish a task in a specific manner.

A

Guideline Statements

46
Q

Specify and identify what duties are required and at what intervals.

A

Operational Considerations

47
Q

Serves as the baseline for business and, if properly written, covers what is expected on a regular basis and outlines what to do when things aren’t running as well as they should.

A

Standard Operating Procedure (SOP)

48
Q

Outlines responsibilities and obligations (as well as the sharing of profits and losses) between business partners.

A

Business Partner Agreements (BPA)

49
Q

Define the terms and conditions for securely sharing data and information resources.

A

Memorandum of Understanding (MOU) and Memorandum of Agreement (MOA)

50
Q

Documents the technical and security requirements for establishing, operating, and maintaining the interconnection.

A

Interconnection Security Agreement (ISA)

51
Q

Requires employees to take time away from work and refresh, and it is primarily used in jobs related to the financial sector.

A

Mandatory Vacation Policy

52
Q

Defines intervals at which employees must rotate through positions.

A

Job Rotation Policy

53
Q

Designed to reduce the risk of fraud and to prevent other losses in an organization by requiring more than one person to complete.

A

Separation of Duties Policies

54
Q

An agreement between two or more parties established for the purpose of committing deception or fraud.

A

Collusion

55
Q

Give users only the permissions that they need to do their work and no more.

A

Least Privilege Policy

56
Q

Describe how the employees in an organization can use company systems and resources, both software and hardware.

A

Acceptable Use Policies (AUPs)

57
Q

The act of using of small, portable devices to download large amounts of data on an unauthorized basis.

A

Pod slurping

58
Q

Defines what controls are required to implement the security of systems, users, and networks.

A

Security policies

59
Q

Events that aren’t really incidents.

A

False positives (Type I Error)

60
Q

Deviations from the established rules of acceptance.

A

Anomalies

61
Q

Events that seem like they aren’t incidents but actually are.

A

False negatives (Type II Error)

62
Q

The process of evaluating all of the critical systems (important to core business functions) in an organization to define impact and recovery plans.

A

Business Impact Analysis (BIA)

63
Q

What are the critical components of a BIA?

A
  1. ) Identifying Critical Functions
  2. ) Prioritizing Critical Business Functions
  3. ) Calculating a Timeframe for Critical Systems Loss
  4. ) Estimating the Tangible and Intangible Impact on the Organization
64
Q

Part of a system that, if it fails, will stop the entire system from working.

A

Single Point of Failure (SPOF)

65
Q

A plan designed to take a possible future event or circumstance into account.

A

Contingency Plan

66
Q

The ability to scale of resources as needed.

A

Elasticity

67
Q

Distributing the load (file requests, data routing, and so on) so that no device is overly overburdened.

A

Distributive Allocation

68
Q

The measures used to keep services and systems operational during an outage.

A

High availability (HA)

69
Q

The capacity to recover quickly from difficulties.

A

Resiliency

70
Q

Refers to systems that either are duplicated or fail over to other systems in the event of a malfunction.

A

Redundancy

71
Q

Refers to the process of reconstructing a system or switching over to other systems when a failure is detected.

A

Fail over

72
Q

Involves multiple systems connected together cooperatively (which provides load balancing) and networked in such a way that if any of the systems fail, the other systems take up the slack and continue to operate.

A

Clustering

73
Q

The ability of a system to sustain operations in the event of a component failure.

A

Fault tolerance

74
Q

What are two key components of fault tolerance should not be overlooked?

A

Spare parts and electrical power.

75
Q

A device that allows a computer to keep running for at least a short time when the primary power source is lost.

A

Uninterruptible Power Supply (UPS)

76
Q

An appliance that runs off of gasoline, propane, natural gas, or diesel and generate the electricity needed to provide steady power.

A

Backup generator

77
Q

A technology that uses multiple disks to provide fault tolerance.

A

Redundant Array of Disks (RAID)

78
Q

RAID Level that uses multiple drives and maps them together as a single physical drive. Done primarily for performance, not for fault tolerance. If any drive fails in this RAID, the entire logical drive becomes unstable. (Uses two disks)

A

RAID Level 0 (Disk Striping)

79
Q

RAID Level that provides 100% redundancy because everything is stored on two disks. Each drive keeps an exact copy of all information, which reduces the effective storage capability to 50 percent of the overall rated storage. (Uses two disks)

A

RAID Level 1 (Disk Mirroring)

80
Q

Disk ______ is where one controller card writes sequentially to two disks while disk _______ uses two controllers to write to two disk at the same time.

A

(Disk) mirroring, (disk) duplexing

81
Q

RAID Level that is disk striping with a a dedicated parity disk. (Uses three disks.)

A

RAID Level 3

82
Q

A technique that checks whether data has been lost or written over when it is moved from one place in storage to another or when it is transmitted between computers.

A

Parity information

83
Q

RAID Level that is disk striping with distributed parity. (Uses three disks.)

A

RAID Level 5

84
Q

The discipline of focusing on how to document and control for change.

A

Change management

85
Q

Which business matters must be evaluated?

A
  • Policies
  • Standards
  • Guidelines
86
Q

What are the three categories of control types? (Exam Essential)

A

The three types of controls that can be administered are technical, management, and operational.

87
Q

Risk can calculated either _______ (subjectively) or _______(objectively). (Exam Essential)

A

Qualitatively, Quantitatively

88
Q

The basic formula for quantitative calculations is ____________. (Exam Essential)

A

SLE * ARO = ALE

89
Q

What are the four difference approaches to risk? (Exam Essential)

A

The four risk response strategies are avoidance (don’t engage in that activity), transference (think insurance), mitigation (take steps to reduce the risk), and acceptance (be willing to live with the risk.)

Security+ (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions