Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CASP > Chapter 1 Risk Management > Flashcards

Chapter 1 Risk Management Flashcards

1
Q

An item of value to an institution, such as data, hardware, software, or physical property. An asset is an item or collection of items that has a quantitative (numeric) or qualitative (subjective) value to a company.

A

Asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The probability or likelihood of the occurrence or realization of a threat.

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A weakness in hardware, software, or components that may be exploited in order for a threat to destroy, damage, or compromise an asset.

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Any agent, condition, or circumstance that could potentially cause harm, loss, damage, or compromise to an IT asset or data asset.

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Probability of occurrence or the odds that the event will actually occur.

A

Likelihood of Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Driving force behind the activity.

A

Motivation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some common motivations of risk activities such as hacking?

A

prestige, money, fame, and challenge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are some examples of Internal Risk?

A
  • disgruntled employee
  • failed hard drive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are some examples of External Risk?

A
  • Natural disasters such as floods
  • Person-made events such as strikes and protests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Internal or external cause of risk

A

Risk Source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Events over which we have no control, such as bad weather (hurricanes, snowstorms, tornadoes), fires, floods, earthquakes, and tsunamis, but could also include global events like pandemics.

A

Natural Disaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

All forms of damaging programs, such as viruses, worms, Trojans, keyloggers, and so forth. This software is distinguishable in that it is developed to damage, alter, expose, or destroy a system or data. For example, viruses are executable programs that can replicate and attach to and infect other executable objects. Some viruses also perform destructive or discreet activities (payload) after replication and infection are accomplished.

A

Malicious Code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Instigated by a trusted insider or an untrusted outsider. Intruders, vandals, and thieves remove sensitive information, destroy data, or physically damage or remove hardware such as hard drives and mobile devices.

A

Breach of Physical Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Stolen, lost, damaged, or modified data. Loss or damage to an organization’s data can be a critical threat if there are no backups or external archiving of the data as part of the organization’s data recovery and business continuity plan. Also, if the compromised data is of a confidential nature, this can also be a critical threat to the organization, depending on the potential damage that can arise from this compromise.

A

Hacker Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attack on a network or web-based system is designed to bring down the network or prevent access to a particular device by flooding it with useless traffic. Can be launched in several ways. What was done manually with simple tools before is now automated and coordinated, on a massive scale with multiple systems.

A

Distributed Denial of Service (DDoS) Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When attackers use computers, Internet communications, and other cyber tools to penetrate and disrupt critical national infrastructures such as water, electric, and gas plants; oil and gasoline refineries; nuclear power plants; waste management plants; and so on.

A

Cyberterrorism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Identify weaknesses and gaps in the deployment of controls and to identify more accurately what areas require the highest level of protection.

A

Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Process of identifying all of the organization’s assets.

A

Asset Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the two types of assets?

A

Tangible and Intangible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are some types of tangible assets?

A

Documentation, Data, Hardware, Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are some types of intangible assets?

A

Reputation, Services, Knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the 5 aspects of the Risk Assessment Process?

A
  1. Asset Identification
  2. Information Classification
  3. Risk Assessment
  4. Risk Analysis
  5. Implementing Controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the CIA Security Triad?

A

Confidentiality, Integrity, and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Strengthens the organization in many ways. Labeling information secret or strictly confidential helps employees see the value of the information and give it a higher standard of care.

A

Information Classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Specifies how employees are to handle specific information. For example, company policy might state, “All sensitive documents must be removed from the employee’s desk when leaving work. We support a clean desk policy.”

A

Information Classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the two widely used classification systems?

A

Government Classification System and Commercial Classification System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which aspect of the CIA Triad does the Government Classification System focus on?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which aspect of the CIA Triad does the Commerical Classification System focus on?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the four categories of the Government Classification System?

A

Unclassified, Confidential, Secret, and Top Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which Governmental Information Classification, if disclosed, would cause grave damage to national security.

A

Top Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which Governmental Information Classification, if disclosed, would be expected to cause serious damage to national security.

A

Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which Governmental Information Classification, if disclosed, could cause damage to national security and should be safeguarded against.

A

Confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which Governmental Information Classification, does not have sensitive information and need not be protected unless For Official Use Only (FOUO) is appended to the classification.

A

Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Information that would not normally cause damage, but over time FOUO information could be compiled to deduce information of a higher classification.

A

Unclassified Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which Commercial Information Classification has the most sensitive rating.

A

Confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which Commercial Information Classification includes the information that keeps a company competitive.

A

Confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which Commercial Information Classification includes information that is internal use only, but its release or alteration could seriously affect or damage a corporation.

A

Confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which Governmental Information Classification includes information that requires the highest level of control.

A

Top Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which Governmental Information Classification includes information that may divulge significant scientific, technological, operational, and logistical as well as many other developments.

A

Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which Commercial Information Classification includes restricted information that is considered personal in nature and might include medical records or human resource information.

A

Private

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Which Commercial Information Classification includes information that requires controls to prevent its release to unauthorized parties. Damage could result from its loss of confidentiality or its loss of integrity.

A

Sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which Commercial Information Classification includes information, if disclosed, that could result in damage to the company due to loss of confidentiality or loss of integrity.

A

Sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which Commercial Information Classification includes information similar to unclassified information in that its disclosure or release would cause no damage to the corporation.

A

Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Step of the Risk Assessment Process where potential risks and threats are identified and their impact determined.

A

Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Responsible for identifying and analyzing risks. Its members should consist of managers and employees from across the company.

A

Risk Management Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the two techniques of Risk Analysis?

A

Quantitative and Qualitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Method of the Risk Assessment Process that assigns a cost (monetary value) to the elements of risk assessment and the assets and threats of a risk analysis.

A

Quantitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Method of the Risk Assessment Process that ranks threats by nonmonetary value and is based on scenario, intuition, and experience.

A

Qualitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the two most widely used Quantitative Risk Assessment formulas?

A
  1. SLE = AV x EF
  2. ALE = ARO x SLE
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What does SLE stand for in the SLE = AV x EF formula?

A

Single Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What does AV stand for in the SLE = AV x EF formula?

A

Asset Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What does EF stand for in the SLE = AV x EF formula?

A

Exposure Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What does ALE stand for in the ALE = ARO x SLE formula?

A

Annualized Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What does ARO stand for in the ALE = ARO x SLE formula?

A

Annualized Rate of Occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What does SLE stand for in the ALE = ARO x SLE formula?

A

Single Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are some examples of the resulting loss of a threat or vulnerabiity?

A
  • Financial loss
  • Danger or injury to staff, clients, or customers
  • Breach of confidence or violation of law
  • Exposure of confidential information
  • Theft of equipment, hardware, or software
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are the quantifiable steps to calculate a loss?

A
  1. Determine the asset value (AV) for each information asset.
  2. Identify threats to the asset.
  3. Determine the exposure factor (EF) for each information asset in relation to each threat.
  4. Calculate the single loss expectancy (SLE).
  5. Calculate the annualized rate of occurrence (ARO).
  6. Calculate the annualized loss expectancy (ALE).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is the strength of a quantitative risk assessment?

A

It assigns dollar values and dollar values are easy to understand.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is the primary disadvantage of a quantitative risk assessment?

A

Because it is dollar-based, the team must attempt to compute a dollar value for all elements, which can be time consuming.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Type of risk assessment that is scenario-based and does not attempt to assign dollar values to the components of the risk analysis.

A

Qualitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Risk assessment method that ranks the potential of a threat and sensitivity of assets by grade or scale such as low, medium, or high

A

Qualitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Potential impact level assigned for risks that are a minor inconvenience.

A

Low

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Potential impact level assigned for risks that can result in damage to an organization, cost a moderate amount of money to repair, and result in negative publicity.

A

Medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Potential impact level assigned for risks that will result in a loss of goodwill between the company and client or employee.

A

High

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Potential impact level assigned for risks that may result in a large legal action or fine or cause the company to lose significant revenue or earnings.

A

High

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Potential impact level assigned for risks that can be tolerated for a short period of time but will not result in financial loss.

A

Low

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is a disadvantage of Qualitative Risk Assessments?

A

It does not provide cost values.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What are some examples of Qualitative assessment techniques?

A

ISAM, Delphi, and FRAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What does ISAM stand for?

A

INFOSEC Assessment Methodology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Provides nongovernment organizations with the ability to complete a qualitative assessment that ranks assets as critical, high, medium, or low and to determine the impact based on CIA.

A

ISAM or INFOSEC Assessment Methodology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Group assessment process that allows individuals to contribute anonymous opinions and is often used to forecast the likelihood and outcomes of different types of events.

A

Delphi Technique

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What does FRAP stand for?

A

Facilitated Risk Assessment Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Subjective process that obtains results by asking a series of questions. It is designed to be completed in a matter of hours, making it a quick process to perform.

A

FRAP or Facilitated RIsk Assessment Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What are the two assessment techniques used to study failures?

A
  1. Failure modes and effects analysis (FMEA)
  2. Failure mode, effects, and criticality analysis (FMECA).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What does FMEA stand for?

A

failure modes and effects analysis (FMEA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What does FMECA stand for?

A

failure mode, effects, and criticality analysis (FMECA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is the next step after a quantitative or qualitative risk assessment is complete?

A

Make a risk determination and decide which security controls should be applied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What is an assessment technique that can assist with examining loss and impact?

A

Risk Ranking using Aggregate Score

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

The total amount of risk the company is willing to accept.

A

Risk Appetite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Which alternative for handling potential risk eliminates the risk, to withdraw from the practice, or to not become involved. This may be a viable option; there may also be an opportunity cost associated with avoiding the activity.

A

Avoid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Which alternative for handling potential risk means that it is understood and has been evaluated. Senior management has made the decision that the benefits of moving forward outweigh the risk. If those in charge have not been provided with good data on risk or have made invalid assumptions, poor choices may be made. This can give rise to disasters with global impact (BP, Fukushima, Chernobyl, Challenger, and so on).

A

Accept

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Which alternative for handling potential risk deflects it to a third party. For example, insurance is obtained. Instead of managing the risk directly, the organization incurs an ongoing continual cost from that third party.

A

Transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Which alternative for handling potential risk uses a control to reduce the risk. For example, installing a firewall is one method by which risk can be mitigated.

A

Mitigate

84
Q

The risk that remains after your organization has taken proper precautions and implemented appropriate controls.

A

Residual Risk

85
Q

Recognizes the areas where you are not compliant in regard to laws, policies, or regulations.

A

Risk Exception

86
Q

Having some process, policy, or system in place that discourages others from exploiting a vulnerability that, if exploited, would realize the risk.

A

Risk Deterrence

87
Q

What does AATM stand for?

A

Avoid, Accept, Transfer, Mitigate

88
Q

What is the next step of the Risk Assessment Process after a decision has been made on how to handle identified risk?

A

Implement Controls

89
Q

What document drives the process of Implementing Controls?

A

Risk Assessment Report

90
Q

What is contained in the Risk Assessment Report

A

Findings, information, assessments, and recommendations

91
Q

What are the three types of security controls?

A

Physical, Technical, and Operational

92
Q

What types of security controls include locks, fences, CCTV, lights, gates, and guards.

A

Physical

93
Q

What types of security controls include encryption, VPNs, security protocols (IPsec, SSL, TLS, and so on), VLANs, firewalls, and IDSs and are based on CIA requirements and organizational policies?

A

Technical

94
Q

What types of security controls include hiring practices, security awareness training, employment practices, termination practices, business continuity, and disaster testing and training.

A

Operational

95
Q

What are some of the purposes that security controls serve?

A

Prevention, deterrence, correction, mitigation

96
Q

What is the purpose of implementing controls?

A

Address identified risks, threats, and vulnerabilities.

97
Q

What is put in place to determine what controls are needed and determines total cost of an asset or countermeasure?

A

Total Cost or Ownership (TCO) Report

98
Q

What types of costs are included in the TCO Report?

A

Purchase price, maintenance fees, updates, insruance, etc. All costs are included.

99
Q

Used to verify that the employee has a clean background and that any negative history is uncovered before employment.

A

Background Check

100
Q

Act of verifying someone’s educational background.

A

Education Verification

101
Q

Defines what employees, contractors, and third parties are authorized to do on the organization’s IT infrastructure and its assets.

A

Acceptable Use Policy (AUP)

102
Q

Contract that establishes confidentiality between two parties—the owner of the information and the recipient of that information.

A

Non-disclosure Agreement (NDA)

103
Q

What issues does an employee handbook address?

A
  • Security practices, policies, and procedures
  • Paid holiday and vacation policy
  • Work schedule and overtime policy
  • Moonlighting and outside employment
  • Employee evaluations
  • Disaster response and emergency procedures
  • Disciplinary procedures for noncompliance
104
Q

Just because an employee is cleared to access a particular file, document, or physical location, this doesn’t mean that they should be able to do so.

A

The principle of lease privilege

105
Q

What are some common employee controls?

A
  • Mandatory Vacations
  • Job Rotation
  • Dual Control
  • Separation of Duties
  • Least Privilege
106
Q

Which employee control uncovers misuse and gives the organization a time to audit the employee while they are not at work.

A

Mandatory Vacations

107
Q

Which employee control rotates employees to new areas of assignment.

A

Job Rotation

108
Q

What are the benefits of Job Rotation?

A

*Helps ensure backup if an employee is not available.
*Reduces fraud or misuse by providing the company with a means of moving people to prevent an individual from having too much control over an area.

109
Q

Where is the Mandatory Vacation control most widely used?

A

Financial firms or applied to job roles where money is handled.

110
Q

Which employee control requires employees to work together to complete critical actions, thereby forcing employees who are planning anything illegal to collude with others. A common example is that of a combination or code for a safe. Two employees are required to open it successfully.

A

Dual Control

111
Q

Which employee control is closely related to Dual Control, where an activity, such as cryptographic recovery, is divided up among several individuals so that no one person acting alone can perform the entire key recovery process?

A

M of N Concept

112
Q

Which employee control limits what one employee can do. For example, one employee may be able to write a check, but another must approve it.

A

Separation of Duties

113
Q

Which employee control restricts the employee’s access to only what is needed to do the job and nothing more. This control is closely related to need to know.

A

Least Privilege

114
Q

What are some common training methods?

A
  • Apprenticeship programs
  • Classroom training
  • Continuing education programs
  • Degree programs
  • In-house training
  • On-the-job training
  • Vendor training
115
Q

Technique used to determine whether a planned action is or is not acceptable.

A

Cost-benefit Analysis

116
Q

What common way to determine cost-benefit analysis is calculated by dividing net profits by total assets?

A

Return on Investment (ROI)

117
Q

Maintaining control over your inventory, which must be identified, managed, and continually monitored to derive a reliable return on investment.

A

Asset Management

118
Q

Determines how much time will lapse before accrued benefits will overtake accrued and continuing costs.

A

Payback Analysis

119
Q

What are the three steps of cost-benefit analysis?

A
  1. calculate costs
  2. calculate benefits
  3. compare the results
120
Q

Purchase price of an asset plus the cost of operation; commonly overlooked when evaluating intangible benefits in a cost-benefit analysis.

A

Total Cost of Ownership (TCO)

121
Q

What all is included in the TCO?

A

purchase price, cost of operations (costs of environmental modifications, compatibility with other countermeasures, maintenance costs, testing costs, support contracts, etc.)

122
Q

Allows organizations to evaluate the operating effectiveness of controls on or near a real-time basis.

A

Continuous Monitoring

123
Q

What should continuous monitoring include?

A
  • Configuration management
  • Control processes
  • Security impact analyses
  • Assessment of selected security
  • Security status reporting
  • Active involvement of asset owners
124
Q

What should continuous monitoring address?

A
  • Reporting progress
  • Addressing vulnerabilities
  • Describing how the information system owner intends to address those vulnerabilities
125
Q

Risks continously reviewed, assessed, and monitored as new assets are identified.

A

Risk Management Lifecycle

126
Q

Involved at nearly every step of the risk management process; contains each risk as it is identified, assessed, owned by someone, responded to, and ultimately reassessed and monitored.

A

Risk Register

127
Q

Processes used to plan, allocate, and control information security resources; used for IT governance and include people, processes, and technologies.

A

Enterprise Security Architecture (ESA) Framework

128
Q

What are two examples of Enterprise Security Architecture (ESA) Frameworks?

A

Enterprise Architecture (EA) and Sherwood Applied Business Security Architecture (SABSA)

129
Q

ESA framework that is used by the federal government to ensure that business strategy and IT investments are aligned.

A

Enterprise Architecture (EA)

130
Q

ESA framework that is a strategy based on an architectural viewpoint.

A

Sherwood Applied Business Security Architecture (SABSA)

131
Q

What are defined metrics are typically included in an ESA framework?

A
  • Strategic alignment
  • Effective risk management
  • Value delivery
  • Resource management
  • Performance measurement
  • Process assurance integration
132
Q

What are some of the most popular ESA frameworks?

A

11.FISMA risk management framework
COSO Enterprise Risk Management Framewor*k
ISO 31000 for Risk Management

133
Q

What is the Prudent Person Rule?

A

Legal principle that is used to restrict the choices of the financial manager of an account to the types of investments that a person seeking reasonable income and preservation of capital might buy for their own portfolio.

134
Q

Defines a company’s primary goal.

A

Mission Statement

135
Q

Formation of a plan for what to do should the business suffer an interruption.

A

Business Continuity Planning (BCP)

136
Q

Formal process designed to identify mission-essential functions in an organization and facilitate the identification of the critical systems that support those functions that must be continued during an emergency.

A

Business Impact Analysis

137
Q

Any event that has the potential to disrupt an organization’s business.

A

Disaster

138
Q

Triggered by an event that has the potential to disrupt an organization’s business; identifies and prioritizes the risks posed to the facility by an internal or external disaster.

A

Disaster Recovery Plan

139
Q

What are the two key concepts in business continuity planning?

A

Recovery Point Objective (RPO) and Recovery Time Objective (RTO).

140
Q

Set duration of time that a business can still function and process information after experiencing a significant interruption to its operations. That is the time that the business has to recover operations.

A

Recovery Point Objective (RPO)

141
Q

Amount of actual time (duration) since the beginning of the interruption that is deemed tolerable before the interruption is considered intolerable to the business.

A

Recovery Time Objective (RTO)

142
Q

Percentage measurement (0–100 percent) of how much computing power is needed. This is based on a percentage of the production system that you will need during an emergency.

A

Recovery Service Level (RSL)

143
Q

The length of time between an interruption and the recovery from that interruption.

A

Mean Time to Recovery (MTTR)

144
Q

Measure of the reliability of a system or component. It’s a crucial element of maintenance management, representing the average time that a system or component will operate before it fails.

A

Mean Time Between Failure (MTBF)

145
Q

What are the four types of Disaster Recovery Sites?

A

Cold Site, Warm Site, Hot Site, Mobile Site

146
Q

Cheapest Disaster Recovery Site that will require the most time to have running. Likely initial steps involve opening boxes, equipment is available to set up but partial setup and configuration are not done.

A

Cold Site

147
Q

Disaster Recovery site that is probably already running but still requires considerable effort to resume operations. Likely initial steps involve restoring backups, equipment is set up and configured and ready to turn on.

A

Warm Site

148
Q

Disaster Recovery site that with minimal efforts to resume operations. Likely initial steps involve assuring minimal data loss since the disaster event place with equipment setu up and running as a copy to the lost data center.

A

Hot Site

149
Q

A Disaster Recovery site that can be moved or mobilized to a new location. Picture a truck trailer filled with equipment to mirror your data center.

A

Mobile Site

150
Q

What are some methods to review and evaluate the effectiveness of existing security controls?

A

Gap Analysis, Audits, Vulnerability Assessments, and Ethical Hacking

151
Q

Security control evaluation method that involves an examination of an area or environment designed to report the difference between “where we are” and “where we want to be.”

A

Gap Analysis

152
Q

Security control evaluation method that is typically a review of a company’s technical, physical, and administrative controls.

A

Information Security Audit

153
Q

Security control evaluation method that utilizes tools and scanners to provide information on vulnerabilities within a targeted application or system or an entire network.

A

Vulnerability Assessment Tools

154
Q

How are vulnerabilities ussally graded in a vulnerability assessment tool?

A

High, Medium, or Low

155
Q

Security control evaluation method that is the process of looking at a network in the same way as an attacker would.

A

Ethical Hacking

156
Q

What is the goal of the Ethical Hacker evaluation method?

A

Attempting to determine what the attacker can access and obtain, what an attacker can do with that information, and whether anyone would notice what the attacker is doing.

157
Q

What is another name for Ethical Hacking?

A

Penetration Testing

158
Q

What is the purpose of Lessons Learned?

A

Determine the effectiveness of processes, identify improvements, and provide insights and recommendations for when these processes are repeated.

159
Q

Written contract that specifies the levels of service that will be provided by the vendor and what the customer can do if the vendor fails to meet the terms.

A

Service Level Agreement (SLA)

160
Q

What is another name for Lessons Learned?

A

After Action Review

161
Q

A method of measuring something, or the results obtained from this.

A

Metrics

162
Q

Help an organization better measure important metrics such as scalability, availability, and reliability.

A

Key Performance Indicator (KPI)

163
Q

Metrics that predict potential risks that can negatively impact businesses.

A

Key Risk Indicators (KRI)

164
Q

Accomplishment of a given task measured against preset known standards of accuracy, completeness, cost, and speed.

A

Performance

165
Q

One of the most well-known types of SLAs that detail the agreed-on amount of uptime. For example, they can be used for network services such as a WAN link or equipment like servers.

A

Uptime Agreements

166
Q

The percentage of help-desk or response calls answered within a given time.

A

Time Service Factor

167
Q

The number of callers who hang up while waiting for a service representative to answer.

A

Abandon Rate

168
Q

The number of resolutions that are made on the first call and do not require the user to call back to the help desk to follow up or seek additional measures for resolution.

A

First Call Resolution

169
Q

Delay; determine how long it takes an application to respond or even the amount of delay in a WAN network.

A

Latency

170
Q

The ability of a program, application, or network to continue to function as scale, volume, or throughput is changed.

A

Scalability

171
Q

The ability to meet or achieve a specific goal.

A

Capability

172
Q

The extent to which a product can be used by specified users to achieve specified goals.

A

Usability

173
Q

Must meet the criteria of usability to be viable and effective.

A

Security Requirements

174
Q

Identify problems that demand finding a balance between different factors, such as the time and cost.

A

Trade-off Analysis

175
Q

Defines the capability to restore systems to the exact point in time at which the failure occurred.

A

Recoverability

176
Q

Usable through the expected time of use.

A

Maintainability

177
Q

The functional state of a system and, in the networking world, is often simplified to uptime.

A

Availability

178
Q

Total operating time divided by the number of failures

A

mean time between failure (MTBF)

179
Q

The amount of time it takes to restore a system if and when a failure occurs.

A

mean time to recovery (MTTR)

180
Q

First step in prevention that provide a planned approach to practice procedures, such as those drafted for disaster recovery.

A

Testing Plans

181
Q

What are five types of Testing Plans?

A

Walk-through, Checklist, Tabletop Exercise, Parallel and Simulation Tests, and Full Interruption Test

182
Q

Straightforward exercise where you manually perform and analyze the steps of disaster recovery without causing any real disruption.

A

Walk-through

183
Q

The easiest form of testing; read through procedures and steps toward disaster recovery. Any glaring gaps or concerns are analyzed further.

A

Checklist

184
Q

Raise situational awareness in the context of information security, foster discussion of incident response, demonstrate scenarios that are most likely to occur.

A

Tabletop Exercise

185
Q

Simulates a disaster recovery by running through all the steps alongside the disaster recovery systems and processes.

A

Parallel Test

186
Q

Going through all motions in the disaster recovery process but leaving production systems running.

A

Simulation Test

187
Q

True test of confidence in disaster recovery planning. Production systems are temporarily taken offline once disaster recovery systems are set up and ready to assume the place of the shutdown systems.

A

Full Interruption Test

188
Q

Audit conducted to improve an entity’s operations; monitors the operations of the organization regarding the improvement of effectiveness, control, governance processes, and risk management.

A

Internal Audit

189
Q

Audit of the organization by an independent audit firm, which is not controlled by the organization that it is auditing

A

External Audit

190
Q

Why are external audits performed?

A

Statutory requirements to verify whether security controls, processes, and documentation are in accordance with acceptable standards and regulatory requirements.

191
Q

Why are internal audits performed?

A

Provide an independent opinion and consultancy to senior management and those charged with governance.

192
Q

You’ve been told there is a problem. Obtain a specific description of the problem.

A

Define the Problem

193
Q

Ask yourself questions when something fails or is not working properly.

A

Gather the Facts

194
Q

Think about all the possibilities for why something doesn’t work or why something is behaving in a certain way.

A

Brainstorm

195
Q

Make a step-by-step list of the possibilities for testing. Test each possibility to see if it corrects the problem.

A

Implement

196
Q

Think back to what you have done, and then document causes and solutions to the problem.

A

Evaluate

197
Q

Risk assessment technique that is more subjective, not monetary-based, and uses descriptors such as critical, high, medium, and low.

A

Qualitative

198
Q

Risk assessment technique that assigns and uses monetary values against known risks.

A

Quantitative

199
Q

Provide the necessary information about an organization’s IT infrastructure and its assets’ current level of security so that the assessor can provide recommendations for increasing or enhancing that level of security.

A

Risk and Vulnerability Assessments

200
Q

True or False: Conducting a Risk Assessment is difficult and prone to errors.

A

True

201
Q

What should the cost of a control not exceed?

A

The value of the asset.

202
Q

Threats coupled with vulnerabilities can lead to what?

A

Loss

203
Q

True or False: Business continuity and DR plans must be practiced periodically.

A

True

204
Q

Formalized approach to risk prioritization that lets an organization conduct reviews in a structured manner.

A

Risk Assessment

205
Q

Process of applying controls to reduce the probability or impact of a risk.

A

Risk Mitigation

CASP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions