Chapter 9 Implementing Controls to Protect Assets Flashcards
1
Q
____ ____ _____ help protect access to secure areas
A
Physical security controls
2
Q
____ and ____ _____ strategies help eliminate single points of failure for critical systems.
A
Redundancy and fault-tolerance
3
Q
_____ ensure that data remains available even after data is lost.
A
Backups
4
Q
_____ ______ strategies help ensure mission critical functions continue to operate even if a disaster destroys a primary business location
A
Business continuity
5
Q
____ ___ _____ refers to the security practice of implementing several layers of protection.
A
Defense in depth (aka layered security)
6
Q
True or False: You must implement security at several different layers so if one layer fails you still have additional layers to protect you.
A
True
7
Q
____ _____ is the use of different security control types, such as technical controls, administrative controls, and physical controls.
A
Control diversity
8
Q
_____ ____ such as vulnerability assessments and penetration tests can help verify that these controls are working as expected
A
Administrative controls
9
Q
____ ________ is the practice of implementing security controls from different vendors to increase security.
A
Vendor diversity
10
Q
True or False: Many DMZs use two firewalls and vendor diversity dictates the use of firewalls from different vendors.
A
True
Example: One firewall could be a Cisco firewall and the other one could be a Check Point firewall.
11
Q
_____ _______ also helps provide defense in depth.
A
User training
12
Q
True or False: If users engage in risky behaviors, such as downloading and installing files from unknown sources or responding to phishing emails, they can give attackers a path into an organization’s network.
A
True
13
Q
True or False: Providing regular user training on common threats, and emerging threats, helps them avoid these types of attacks.
A
True
14
Q
A _____ ____ _____ is something you can physically touch, such as a hardware lock, a fence, an identification badge, and a security camera.
A
Physical security control
15
Q
______ _____ _____ ______ attempt to control entry and exits, and organizations commonly implement different controls at different boundaries
A
Physical security access controls
16
Q
List some physical security access controls
A
- Perimeter - Border around land
- Buildings
- Secure work areas - i.e. SOCC, NOC
- Hardware - Cabinet locks, cable locks, etc.
- Airgap
17
Q
An ______ is a physical security control that ensures that a computer or network is physically isolated from another computer or network.
A
Airgap
18
Q
True or False: A complex physical security control is a sign
A
False
It is a simple physical security control
19
Q
True or False: It is common to secure access to controlled areas of a building with door locks, and there are many different lock types.
A
True
20
Q
A ____ ____ ____ is one that only opens after some access control mechanism is used
A
Door access system
21
Q
True or False: When implementing door access systems, it’s not important to limit the number of entry and exit points.
A
False
It is important
22
Q
True or False: In the event of a fire, door access systems should allow personnel to exit the building without any form of authentication.
A
True
23
Q
____ ____ often have four or five buttons labeled with numbers.
A
Cipher locks
24
Q
Cipher locks can be ______ or ______
A
Electronic or manual
25
An _____ _____ _____ automatically unlocks the door after you enter the correct code into the keypad
Electronic cipher lock
26
A _____ _____ _____ requires a user to turn a handle after entering the code.
Manual cipher lock
27
True or False: To add complexity and reduce brute force attacks, many manual cipher locks include a code that requires two numbers entered at the same time.
True
28
True or False: One challenge with cipher locks is that they don't identify the users.
True
29
True or False: Uneducated users cannot give out the cipher code to unauthorized individuals without understanding the risks
False
| They can
30
_______ _____ are small credit card-sized cards that activate when they are in close proximity to a card reader.
Proximity cards
31
True or False: Many self-serve gasoline stations and fast-food restaurants use proximity card readers embedded in credit cards.
True
32
True or False: The proximity card does not require its own power source.
True
The electronics in the card include a capacitor and a coil that can accept a charge from the proximity card reader. When you pass the card close to the reader, the reader excites the coil and stores a charge in the capacitor. Once charged, the card transmits the information to the reader using a radio frequency.
33
True or False: Some door access systems include details on the user and record when the user enter or exists the area
True
When used this way, it's common to combine the proximity card reader with a keypad requiring the user to enter a personal identification number (PIN). This identifies and authenticates the user with multifactor authentication. The user has something (proximity card) and knows something (PIN)
34
It is also possible to use _______ methods as an access control system.
Biometric
35
True or False: One of the benefits with using a biometric method for access control is that it provides both identification and authentication
True
36
True or False: It's important to ensure you use an accurate biometric system and configure it to use a low false acceptance rate.
True
37
_______ occurs when one user follows closely behind another user without using credentials.
Tailgating (also called piggybacking)
38
True or False: If authorized users routinely do tailgating, it indicates the environment is susceptible to a social engineering attack where an unauthorized user follows closely behind an authorized user.
True
39
True or False: Social engineers take advantage of people's polite and courteous manners
True
40
______ ______ areas are most susceptible to tailgating attacks.
High traffic
41
True or False: The best solution for preventing tailgating is a mantrap
True
42
A ____ is a physical security mechanism designed to control access to a secure area through a buffer zone.
Mantrap
43
True or False: Because they only allow one person through at a time, mantraps prevent tailgating
True
44
_______ get their name due to their ability to lock a person between two areas, such as an open access area and a secure access area, but not all of them are that sophisticated.
Mantraps
45
True or False: It's also possible to require identification and authentication before allowing passage through a mantrap.
True
46
Cameras are connected to a _____ ____ ______ system which transmits signals from video cameras to monitors that are similar to TVs
Closed circuit televisions (CCTVs)
47
True or False: In addition to providing security, CCTV can also enhance safety by deterring threats.
True
48
______ _________ provides the most reliable proof of a person's location and activity.
Video surveillance
49
True or False: Access logs provide a record, but it's possible to circumvent the security of an access log.
True
Ex. someone can use another's proximity card to enter an area but it will be recorded as the card owner not the person who used it.
50
True or False: When using video surveillance in a work environment, it's important to respect privacy and to be aware of privacy laws.
True
51
List some things to consider with video surveillance and privacy
1. Only record activity in public areas. It is often illegal to record activity in locker rooms and restrooms
2. Notify employees of the surveillance - If employees aren't notified of the surveillance, legal issues related to the video surveillance can arise.
3. Do not record audio - Recording audio is illegal in many jurisdictions, without the express consent of all parties being recorded.
52
_____ provide a barrier around a property and deter people from entering.
Fences
53
True or False: When using a fence, it's common to control access to the area via specific gates.
True
54
True or False: When additional security is required, organizations sometimes configure dual gates, allowing access into one area where credentials are checked before allowing full access.
True
| This effectively creates a cage preventing full access, but also prevents unauthorized individuals from escaping.
55
True or False: Many organizations use a combination of automation, light dimmers, and motion sensors to save on electricity costs without sacrificing security.
True
56
Installing _____ at all entrances to a building can deter attackers from trying to break in.
Lights
57
_______ provide an additional physical security protection
Alarms
58
True or False: You cannot combine motion detection systems with burglary prevention systems
False
59
_____ ______ sense infrared radiation sometimes called infrared light, which effectively sees a difference between objects of different temperatures
Infrared detectors
60
True or False: The use of infrared detectors can help eliminate false alarms by sensing more than just motion, but motion from objects of different temperatures
True
61
______, ______, and _____ (when combined) all provide layered physical security
Fencing, lighting, and alarms
62
Organizations often use _____, which are short vertical posts, composed of reinforced concrete and/or steel.
Bollards
63
True or False: Orgs often place the bollards in front of entrances about three or four feet apart.
True
64
True or False: Companies that don't have the resources to employ advanced security systems often use hardware locks to prevent access to secure areas
True
65
___ _______ is an important concept to consider when using hardware locks.
Key management
66
True or False: Proper key management ensures that only authorized personnel can access the physical keys
True
67
____ ____ are a great theft deterrent for mobile computers, and even many desktop computers at work.
Cable locks
68
True or False: Another common use of a cable lock is for computers in unsupervised labs.
True
69
True or False: Often in server rooms, administrators use locking cabinets or enclosures to secure equipment mounted within bays.
True
70
You can store smaller devices such as external USB drives or USB flash drives in an ______ ____ or _______ _______ when they aren't in use
Office safe or locking cabinet
71
____ _______ is the process of tracking valuable assets throughout their life cycles.
Asset management
72
True or False: An effective asset management system can help reduce several vulnerabilities
True
73
True or False: Asset management helps reduce architecture and design weaknesses by ensuring that purchases go through an approval process.
True
74
____ ____ occurs when an organization has more systems than it needs, and systems it owns are underutilized
System sprawl
75
True or False: Asset management begins before the hardware is purchased and helps prevent system sprawl by evaluating the purchase
True
76
True or False: Additionally after the asset is purchased, the process ensures the hardware is added into the asset management tracking system.
True
| This ensures that the assets are managed and tracked from cradle to grave.
77
___ _____ ________ methods can track the movement of devices
Radio frequency identification (RFID)
| Same as what stores use to prevent shoplifting
78
True or False: Mobile devices are easy to lose track of, so organizations often use asset tracking methods to reduce losses.
True
79
True or False: Environmental controls directly contribute to the availability of systems
True
80
True or False: Environmental controls include ensuring temperature and humidity controls are operating properly, fire suppression systems are in place, and proper procedures are used when running cables.
True
81
______, _________, and ___ ________ systems are important physical security controls that enhance the availability of systems.
Heating, ventilation, and air conditioning (HVAC)
82
True or False: If systems overheat, chips can actually burn themselves out.
True
83
_____ ______ HVAC systems provide more cooling capacity. This keeps server rooms at lower operating temperatures and results in fewer failures.
Higher tonnage
84
___ ___ ____ _____ help regulate the cooling in data centers with multiple rows of cabinets.
Hot and cold aisles
85
True or False: With hot and cold aisles, the back of all cabinets in one row faces the back of all the cabinets in an adjacent row. The same for the front of the cabinets. This way hot air for two row cabinets and cold air for two row cabinets flows through the same aisle
True
86
An HVAC also includes a _________ as a temperature control and additional humidity controls
Thermostat
87
In HVAC, the _______ ensures that the air temperature is controlled and maintained
Thermostat
88
_____ humidity can cause condensation on the equipment, which causes water damage
High
89
___ humidity allows a higher incidence of electrostatic discharge (ESD)
Low
90
True or False: HVAC systems are not often integrated with fire alarm systems.
False
| They often are to prevent a fire from spreading
91
One of the core elements of a fire is ______
Oxygen
92
True or False: If an HVAC continues to operate normally while a fire is active, it continues to pump oxygen, which feeds the fire
True
93
True or False: When the HVAC is integrated with the fire alarm system, it controls the airflow to help prevent the rapid spread of the fire.
True
94
A _____ fire system can detect a fire and automatically activate to extinguish the fire
Fixed
95
The different components of a fire are ____, ______, ____, and a ______ ______ creating the fire
heat, oxygen, fuel, and a chain reaction
96
True or False: Fire suppression methods attempt to remove or disrupt one of these elements to extinguish a fire.
True
97
List methods of extinguishing a fire
1. Remove the heat. Fire extinguishers but not water for electrical fires
2. Remove the oxygen. Many methods use CO2 to displace oxygen. Common for fighting electrical fires because harmless to equipment.
3. Remove the fuel
4. Disrupt the chain reaction. Some chemicals can disrupt the chain reaction of fires to stop them.
98
True or False: When using CO2 to displace oxygen in a fire, it's important to ensure that personnel can get out before the oxygen is displaced
True
99
True or False: It is important to ensure that an alternative allows personnel to exit even if the proximity card reader loses power.
True
100
True or False: Administrators can review HVAC system logs to review the performance.
True
101
________ helps prevent electromagnetic interference (EMI) and radio frequency interference (RFI) from interfering with normal signal transmissions.
Shielding
102
_______ also protects against unwanted emissions and helps prevent an attacker from capturing network traffic.
Shielding
103
____ comes from different types of motors, power lines, and even fluorescent lights.
EMI
104
____ comes from radio frequency(RF) sources such as AM or FM transmitters.
RFI
105
True or False: Shielding used to block interference from both EMI and RFI is often referred to as simply EMI shielding.
True
106
True or False: EMI shielding fulfills the dual purpose of keeping interference out and preventing attackers from capturing network traffic
True.
107
What is the difference between shielded twisted pair and unshielded twisted pair cabling?
STP has shielding to prevent attackers from capturing network traffic and helps block interference from corrupting data
108
True or False: one method of reducing an attacker from splicing cable and connecting a hug using a protocol analyzer to capture traffic is to run cables through cable troughs or wiring ducts
True
109
True or False: In addition to considering physical security, it's important to keep cables away from EMI sources
True
110
True or False: If techs run cables over or through fluorescent lighting fixtures, the EMI from the lights can disrupt the signals on the cables.
True
111
A ________ ____ is typically a room that prevents signals from emanating beyond the room
Faraday cage
112
A Faraday cage includes electrical features that cause ____ signals that reach the boundary of the room to be reflected back, preventing signal emanation outside of it.
RF
113
True or False: A Faraday cage also provides shielding to prevent outside interference such as EMI and RFI from entering the room
True
114
True or False: The metal shielding around an elevator acts as a Faraday cage, preventing signals from emanating out or signals from entering in.
True
115
________ adds duplication to critical system components and networks and provides _____ _______
Redundancy, fault tolerance
116
True or False: A system with fault tolerance can suffer a fault, but it can tolerate it and continue to operate.
True
117
Organizations often add redundancies to eliminate _____ ______ of ______
Single points of failure
118
List different levels redundancies can be added
1. Disk redundancies using RAID
2. Server redundancies by adding failover clusters
3. Power redundancies by adding generators or an UPS
4. Site redundancies by adding hot, cold, or warm sites
119
A _______ _____ of ______ is a component within a system that can cause the entire system to fail if the component fails.
Single point of failure
120
True or False: Some examples of single points of failure are disk, server, and power
True
121
Any system has four primary resources: _____, _____, ___, and _____
Processor
Memory
Disk
Network interface
122
True or False: The disk is the slowest and most susceptible failure
True
123
______ _____ of ______ _____ subsystems provide fault tolerance for disks and increase the system availability
Redundant Array of Inexpensive Disks (RAID)
124
True or False : RAID-0 doesn't provide any redundancy or fault tolerance
True
It includes two or more physical disks. Files are spread across each of the disks.
125
What is the benefit of a RAID-0?
Increased read and write performance
126
True or False: RAID-1 uses two disks
True
127
In RAID-1 data is written to _____ disks so if one fails the other disk still has all the data and the system can operate without any data loss.
Two
128
True or False: You can add an additional disk controller to a RAID-1 configuration to remove the disk controller as a single point of failure
True
129
Adding a second disk controller to a mirror is called _____ ________
Disk duplexing
130
If you have two 500 GB drives used in a RAID-1 how much storage space do you have?
500 GB since the other 500 GB is dedicated to fault tolerant, mirrored volume.
131
True or False: RAID-2, RAID-3, and RAID-4 are the most commonly used
False
| They are rarely used
132
_______ is three or more disks that are striped together similar to RAID-0
RAID-5
133
______ _______ is striped across each of the drives in a RAID-5 and is used for fault tolerance
Parity information
134
True or False: In a RAID-5 conf if one of the drive fails, the system can read the information on the remaining drives and determine what the actual data should be.
True
135
True or False: If two of the drives fail in a RAID-5, the data is lost
True
136
______ is an extension of RAID-5 and it includes an additional parity block.
RAID-6
137
True or False: A huge benefit with RAID-6 is the disk subsystem will continue to operate even if two disk drives fail.
True
| RAID-6 requires a minimum of four disks
138
______ configuration combines the features of mirroring (RAID-1) and striping (RAID-0).
RAID-10
139
True or False: The minimum number of drives in a RAID-10 is six
False
| It is four
140
When adding more drives to a RAID-10 you add ____ /multiples of ____.
Two
141
If you have four 500 GB drives in a RAID-10 how much usable storage do you have?
1 TB
142
___ _______ refers to a system or service that needs to remain operational with almost zero downtime.
High availability
143
True or False: Utilizing different redundancy and fault-tolerance methods, it's possible to achieve 99.999 percent uptime, commonly called five nines.
True
144
What does five nines equate to in downtime minutes per year?
6 minutes of downtime a year
145
________ _______ are a key component used to achieve five nines
Failover clusters
146
Is five nines considered expensive or cheap?
Expensive
147
True or False: High availability five nines is justifiable if the cost of a potential outage is high.
True
148
_______ _______ is another option to provide both high availability and scalability, though it is typically used primarily in scientific applications.
Distributive allocation
149
True or False: In a distributed application model, multiple computers (often called nodes) are configured within a local network.
True
150
In a distributed application model, a ______ ________ divides the complex problem into smaller tasks then coordinates tasking of the individual nodes and collecting results. If any single node fails, the central processor doesn't task it anymore but overall processing continues, providing high availability.
Central processor
151
True or False: Distributive allocation provides high availability
True
152
The primary purpose of a _______ _______ is to provide high availability for a service offered by a server.
Failover cluster
153
True or False: Failover clusters use two or more servers in a cluster configuration, and the servers are referred to as nodes.
True
154
In a failover cluster, at least ____ server or node is active and at least ___ is inactive.
One, one
155
True or False: In a failover cluster, if an active node fails, the inactive node can take over the load without interruption to clients.
True
156
True or False: In an active-active cluster configuration, the cluster balances the load between the servers
True
157
Nodes need to have _____ to _________ hardware and are often quite expensive, but if a company truly needs to achieve 99.999 percent uptime, it's worth the expense
Close to identical
158
A ____ ________ can optimize and distribute data loads across multiple computers or multiple networks.
Load balancer
159
True or False: A load balancer can be hardware or software
True
160
A ________ based load balancer accepts traffic and directs it to servers based on factors such as processor utilization and the number of current connections to the server.
Hardware
161
A ______ based load balancer uses software running on each of the servers in the load-balanced cluster to balance the load.
Software
162
____ _______ primarily provides scalability, but it also contributes to high availability.
Load balancing
163
______ refers to the ability of a service to serve more clients without any decrease in performance.
Scalability
164
________ ensures that systems are up and operational when needed
Availability
165
True or False: By spreading the load among multiple systems, it ensures that individual systems are not overloaded, increasing overall availability
True
166
To scale ___ you add additional resources such as processors and memory
Up
167
To scale ___ you ad additional servers in a load balancer
Out
168
Some load balancers use source address _____ to direct the requests.
Affinity
169
Source ______ sends requests to the same server based on the requestor's IP address
Affinity
170
True or False: Source affinity effectively sticks users to a specific server for the duration of their sessions
True
171
True or False: An added benefit of many load balancers is that they can detect when a server fails.
True
172
True or False: In general, failover clusters are commonly used for applications such as database applications.
True
173
True or False: Load balancers are often used for services, such as web servers in a web farm.
True
174
____ is a critical utility to consider when reviewing redundancies.
Power
175
An ____ provides fault tolerance for power and can protect against power fluctuations.
UPS
176
_______ provide long-term power in extended outages.
Generators
177
______ are copies of data created to ensure that when the original data is lost or corrupted, it can be restored.
Backups
178
The most common media used for backups is ____
Tape
179
_____ store more data and are cheaper than other media
Tapes
180
List some commonly used backup types
1. Full backup
2. Differential backup
3. Incremental backup
4. Snapshots
181
A _____ _____ backs up all the selected data
Full backup
182
A ______ ______ backs up all the data that has changed or is different since the last full backup
Differential backup
183
A ________ _____ backs up all the data that has changed since the last full or incremental backup
Incremental backup
184
A ______ captures the data at a point in time.
Snapshot (image backup)
185
True or False: It's possible to do a full backup on a daily basis but rare to do in most prod environments
True
186
What two limiting factors are there for doing full backups daily?
1. Time - can take several hours to complete depending on how much data and affects availability of a system
2. Money - requires more resources i.e. media and storage
187
True or False: A full backup is the easiest and quickest to restore
True
188
True or False: Each differential backup are all the deltas since the last full backup.
True
| I.e. Monday captures differential, Tuesday builds on top of Monday's differential and so forth
189
True or False: As time progresses the differential backup steadily grows in size
True
190
True or False: Each incremental backup are all the deltas since the previous day
True
I.e. Sunday is a full, Monday captures deltas from Sunday thru Monday, Tuesday captures deltas from Monday thru Tuesday, etc.
191
True or False: Full/incremental is better suited for orgs where time is priority and Full/Differential is better suited for orgs where restoration is priority
True
192
True or False: Snapshots are commonly used with virtual machines and sometimes referred to as a checkpoint
True
193
True or False: The only way to validate a backup is to perform a test restore
True
194
Performing a _____ ______ is nothing more than restoring the data from a backup and verifying it's integrity
Test restore
195
True or False: It's common to restore data to a different location other than the original source location, but in such a way that you can validate the data.
True
196
What are the two possible outcomes in a test restore
1. Success
| 2. Fail
197
True or False: An additional benefit of performing regular test restores is that it allows administrators to become familiar with the process.
True
198
True or False: Backup media should be protected at the same level as the data that it holds.
True
199
List how backups are protected
1. Storage - clear labeling to identify the data and physical security protection to prevent others from easily accessing it while it's stored
2. Transfer - Data should be protected any time it is transferred from one location to another. Especially true when transferring a copy of the backup to a separate geographical location
3. Destruction - When no longer needed, destroyed. Accomplished by degaussing the media, shredding or burning the media, or scrubbing the media by repeatedly writing varying patterns of 1s and 0s onto the media
200
True or False: Organizations typically create a backup policy to answer critical questions related to backups
True
201
The ______ policy is a written document and will often identify issues such as what data to backup, how often to back up the data, how to test the backups, and how long to retain the backups.
Backup
202
______ backups protect against a disaster such as a fire or a flood.
Off-site
203
True or False: Many organizations have specific requirements related to the distance between the main site and the off-site location.
True
204
The off-site backup ______ should be far enough away that environmental factors at the primary location doesn't affect the off-site location
Location
205
The _____ implications related to backups depends on the data stored in the backups.
Legal
206
____ _______ refers to the legal implications when data is stored off-site.
Data sovereignty
| If the data is stored in other countries, it can be subject to additional laws and regulations
207
The goal of _______ __________ is to ensure that critical business operations continue and the organization can survive the outage.
Business continuity
208
True or False: Organizations often create a business continuity plan (BCP)
True
209
A _______ _____ _______ is an important part of a BCP.
Business impact analysis
210
A ____ _______ ______ helps an organization identify critical systems and components that are essential to the organizations success.
Business impact analysis
211
True or False: A business impact analysis helps identify vulnerable business processes that support mission essential functions
True
212
True or False: The business impact analysis involves collecting information from throughout the organization and documenting the results. This documentation identifies core business or mission requirements.
True
213
True or False: The Business Impact Analysis does not recommend solutions.
True
| It provides management with valuable information so that they can focus on critical business functions.
214
List some key questions that are addressed with a Business Impact Analysis
1. What are the critical systems and functions?
2. Are there any dependencies related to these critical systems and functions?
3. What is the maximum downtime limit of these critical systems and functions?
4. What scenarios are most likely to impact these critical systems and functions?
5. What is the potential loss from these scenarios?
215
True or False: Identifying the maximum downtime limit is extremely important.
True
It drives decisions related to recovery objectives and helps an organization identify various contingency plans and policies.
216
Two tools that organizations can use when completing a business impact analysis are a ______ ______ _______ and a _____ ______ _______
Privacy threshold assessment and privacy impact assessment
NIST SP 800-122 "Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)" covers these in more depth but refers to a privacy threshold assessment as a privacy threshold analysis.
217
The primary purpose of the _____ _______ ________ is to help the organization identify PII within a system.
Privacy threshold assessment
218
Who typically completes a privacy threshold assessment?
System owner or data owner
219
If the system holds PII, the next step is to conduct a ______ ______ _________
Privacy impact assessment
220
True or False: A privacy impact assessment attempts to identify potential risks related to the PII by reviewing how the information is handled
True
221
What is the goal of a privacy impact assessment?
To ensure that the system is complying with applicable laws, regulations, and guidelines. The impact assessment provides a proactive method of addressing potential risks related to PII throughout the life cycle of a computing system.
222
The _____ ___ _______ identifies the maximum amount of time it can take to restore a system after an outage.
Recovery time objective (RTO)
223
A _____ _____ _______ identifies a point in time where data loss is acceptable.
Recovery point objective
224
True or False: When working with a BIA, experts often attempt to predict the possibility of a failure
True
225
____ ____ ____ ______ provides a measure of a system's reliability and is usually represented in hours.
Mean time between failures
226
True or False: Higher MTBF numbers indicate a higher reliability of a product or system.
True
227
___ ___ __ ______ identifies the average time it takes to restore a failed system.
Mean time to recover
228
________ __ ________ _______ focuses on restoring mission-essential functions at a recovery site after a critical outage.
Continuity of operations planning
229
______ is the process of moving mission-essential functions to the alternate site.
Failover
230
A ______ ____ is an alternate processing site that an organization can use after a disaster.
Recovery site
231
List the three primary types of recovery sites
1. Hot sites
2. Cold sites
3. Warm sites
232
True or False: Two other recovery sites are mobile sites and mirrored sites
True
233
A __ ____ would be up and operational 24 hours a day, seven days a week and would be able to take over functionality from the primary site quickly after a primary site failure.
Hot site
234
True or False: In many cases, copies of backup tapes are stored at the hot site as the off-site location.
True
235
True or False: A hot site is the least effective disaster recovery solution for high-availability requirements.
False
| It is the most effective
236
True or False: A hot site is the most expensive to maintain and keep up to date.
True
237
A ____ ____ requires power and connectivity but not much else.
Cold site
238
True or False: With a cold site the organization brings all the equipment, software, and data to the site when it activates it.
True
239
A ____ ____ is the cheapest to maintain, but it is also the most difficult to test.
Cold site
240
A ____ ____ provides a compromise between a hot site and a cold site that an organization can tailor to meet its needs.
Warm site
241
A _____ ____ is a self contained transportable unit with all the equipment needed for specific requirements
Mobile site
| Ex. semitrailer with everything needed for operations
242
_____ ____ are identical to the primary location and provide 100 percent availability.
Mirrored sites
243
True or False: The mirrored site is always up and operational
True
244
True or False: As a best practice, organizations return the least critical functions to the primary site first.
True
245
True or False: By moving the least critical functions back to the primary site first will help to flush out undiscovered problems
True
246
______ ______ is a part of an overall business continuity plan
Disaster recovery
247
True or False: In some cases, an organization will have multiple Disaster Recovery Plans within a Business Continuity Plan
True
248
True or False: A DRP or a BCP will include a hierarchical list of critical systems.
True
| This list identifies what systems to restore after a disaster and in what order.
249
List the different phases of a disaster recovery process
1. Activate the disaster recovery plan
2. Implement contingencies
3. Recover critical systems
4. Test recovered systems
5. After-action report
250
True or False: Business continuity plans and Disaster recovery plans include testing.
True
251
_____ validates that the plan works as desired and will often include testing redundancies and backups.
Testing
252
Two primary types of exercises are ______ and _____
Tabletop and functional
Read NIST SP 800-34 "Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities"
253
A _____ _____ is discussion based
Tabletop exercise
254
_____ _______ provide personnel with an opportunity to test the plans in a simulated operational environment.
Functional exercises
255
In a ______, the participants go through the steps in a controlled manner without affecting the actual system.
Simulation
256
True or False: Running through a simulation will verify that the test works and the amount of time it will take to execute the plan
True
257
List some of the common elements of testing
1. Backups - tested by restoring the data from the backup
2. Server restoration - rebuild a server using a test system without touching the live system
3. Server redundancy
4. Alternate sites
