Thor's 100 Questions Set 1 Flashcards

Question

What is the FIRST step in the security assessment process? Develop and implement security controls Identify assets and vulnerabilities Conduct risk analysis Establish security requirements

Answer 1

Establish security requirements Why: Establishing security requirements is a critical initial step in the security assessment process. It involves determining what needs to be protected and the level of protection required. This step sets the foundation for the entire security assessment, by defining the security objectives, compliance requirements, and the criteria against which the security posture will be evaluated. Before you can identify assets and vulnerabilities, conduct a risk analysis, or develop security controls, you need to understand what you are protecting and why, which is determined by your security requirements.

Answer 2

The sender cannot deny sending the message Why: The FIRST principle of nonrepudiation is that the sender cannot deny sending the message. This ensures that the sender cannot later claim that they did not send the message, which would be necessary in the case of a legal dispute or contract negotiation.

Answer 3

The door is locked when power is lost. Why: Fail secure doors are designed in such a way that when the power is lost or the system is not working, the door defaults to a locked state. This ensures that the property remains secure even during power outages or system failures. It is the essential characteristic and primary indicator that a fail secure door is functioning as it should be.

Answer 4

The scope of the test Why: Because the scope of the test provides the most accurate evaluation of the system's vulnerabilities and risks.

Answer 5

The practice of granting users the minimum access necessary to perform their job functions Why: The practice of granting users the minimum access necessary to perform their job functions is the most accurate definition of least privilege. This security principle ensures that users only have access to the resources and systems that they need to do their job, and are not granted unnecessary privileges that could potentially be exploited by attackers.

Answer 6

Availability Why: When an attack results in data deletion, the leg of the CIA triad most affected is 'Availability.' The concept of availability in the CIA triad refers to the assurance that systems and data are accessible by authorized users when needed. If data has been deleted, it directly hampers availability as the data or the system becomes inaccessible to the users who need it. Therefore, the availability leg of the triad is most affected in this scenario.

Answer 7

Likelihood and impact matrix Why: A qualitative risk analysis approach focuses on identifying the risks involved in a project or any business activity and assesses them based on their potential impact and the likelihood of their occurrence. It doesn't involve numerical or financial measures but rather uses descriptive or categorical scales. The risk is evaluated based on its perceived impact and the probability or likelihood of its occurrence, which is why a "likelihood and impact matrix" would be used in a qualitative risk analysis approach. This matrix helps in prioritizing risks based on their potential effect and the probability of their occurrence.

Answer 8

Cloud-based data backup Why: This is because it provides a scalable, cost-effective, and reliable solution for storing and securing important data offsite. This helps small businesses ensure business continuity and prevent data loss due to hardware failures, natural disasters, or cyberattacks.

Answer 9

Forward the email to your IT security team for further analysis. Why: The initial response to a potential phishing attack should involve forwarding the suspicious email to the IT security team. They possess the necessary tools and expertise to properly analyze the email and validate its source and intent. They can conduct a risk assessment and help develop a response strategy, which might include contacting the vendor, communicating with employees, or enhancing technical safeguards. Prioritizing analysis minimizes the potential for exposure of sensitive data and ensures informed decision-making.

Answer 10

Activation phase Why: The activation phase is the stage of a Disaster Recovery Plan (DRP) where the actual disaster recovery procedures are carried out. This phase is activated when a disaster is declared, and the previously planned and tested procedures are put into action. This can include everything from failover to secondary systems, notification of personnel, data restoration from backups, or relocation to a recovery site.

Answer 11

Automated daily scanning Why: Automated daily scanning allows for real-time monitoring and detection of potential security threats, making it the most effective method for implementing continuous monitoring.

Answer 12

To protect the confidentiality, integrity, and availability of the organization's assets Why: The primary goal of a company's information security program is to protect the confidentiality, integrity, and availability of the organization's assets. This ensures that sensitive information is kept private, data is not altered or corrupted, and systems are available for authorized users to access. This applies not just to digital data but also to physical assets like servers and network infrastructure.

Answer 13

Implementing two-factor authentication Why: Two-factor authentication (2FA) requires a user to present two separate forms of identification before they can access sensitive data. This typically involves something the user knows (such as a password) and something the user has (like a text message sent to their phone, or a physical token). This method provides an additional layer of security beyond a single-factor authentication method (like a password), as it ensures that even if a password is compromised, an attacker would still need the second factor to gain access.

Answer 14

Only one device can transmit at a time. Why: Half-duplex is a type of communication system in which data can flow in both directions between two devices, but not at the same time. This means that only one device can transmit data at a time, while the other device receives. This is similar to a walkie-talkie system where when one person is talking, the other one has to wait for their turn to respond. Hence, a key feature of a half-duplex solution is that it allows only one device to transmit data at a given time.

Answer 15

Implementing an uninterruptible power supply (UPS) system to provide backup power during outages Why: An uninterruptible power supply (UPS) system is specifically designed to provide power backup during outages, ensuring continuous availability of systems even when there is a sudden power loss. A UPS offers immediate power via its battery to the connected systems, allowing them to keep running without interruption. For a bank facing frequent power outages, the UPS system becomes essential to ensure the availability of its critical systems during such outages. It prevents abrupt system shutdowns, potential data losses, and keeps services accessible to customers.

Answer 16

Network security focuses on protecting the physical infrastructure, while data security focuses on protecting data from unauthorized access. Why: Network security refers to the measures taken to protect an organization's network infrastructure from threats like malware, hacking, and denial of service (DoS) attacks. It mainly concerns itself with the prevention of unauthorized intrusion into the network. This involves securing the hardware, software, and the rules and procedures that govern network traffic. On the other hand, data security is about protecting data from unauthorized access, alteration, or destruction. This could involve various strategies like data encryption, access controls, data backup and recovery, etc. While network security could be seen as a component of data security, as it can help prevent unauthorized access to data, the two concepts focus on different aspects of security.

Answer 17

The organization's current security policies Why: The first thing a security consultant should consider when evaluating the security controls of a client's organization is the organization's current security policies. These policies give the consultant insight into the existing controls, security procedures, and the organization's overall approach to security. By evaluating these policies, the consultant can identify potential weaknesses or areas for improvement and then make informed recommendations.

Answer 18

Clean desk policy. Why: A Clean Desk Policy instructs employees to clear their desks and securely store all documents when they are not at their workstations. The presence of hard copies of Protected Health Information (PHI) in the facility suggests that employees are not properly organizing and disposing of sensitive materials. The clean desk policy specifies that employees should keep their work areas clean and tidy, including properly storing or shredding any sensitive documents to prevent unauthorized access. This policy helps to prevent sensitive information from being accessed by unauthorized individuals, particularly in areas where non-employees may have access.

Answer 19

Transport layer Why: The Transport layer is responsible for providing the most reliable delivery of data packets from the source to the destination. This layer ensures end-to-end communication by managing the flow control, error detection, and correction. In the case of TCP (Transmission Control Protocol), one of the main transport layer protocols, it provides reliability by using sequence numbers, acknowledgements, and retransmission of lost or corrupted packets.

Answer 20

Vulnerability scan Why: A vulnerability scan is a technique used to identify and classify the security holes (vulnerabilities) in a computer, network, or communications infrastructure. It is not an attack vector but a security tool that is used to improve network security. It's part of a proactive approach to managing network security and is typically performed by the organization's own security team or a third-party security service.

Answer 21

The practice of following all applicable laws, regulations, and standards. Why: Compliance, in a general business and security context, is defined as the process of ensuring that an organization operates by a set of guidelines, laws, or regulations established by a particular standard, regulatory authority, or the government. This can range from data protection laws, such as GDPR, to industry-specific regulations like HIPAA for healthcare. Non-compliance can result in penalties, fines, and loss of customer trust.

Answer 22

Vulnerability Analysis Prioritization Why: Vulnerability Analysis Prioritization: While vulnerability analysis and prioritization is an essential part of any strong security posture, it is not a component of the defense-in-depth strategy. Defense-in-depth is more about having multiple layers of security in place so that if one layer fails, others will still provide protection. Vulnerability analysis and prioritization comes under risk management but not specifically under defense-in-depth.

Answer 23

Utilize Secure Erase commands or data wiping software specifically designed for SSDs Why: ecure Erase commands and specialized data wiping software designed for SSDs work with the drive's firmware to ensure that all data, including data in spare and reserved areas, is securely erased. These methods take into account the specific characteristics of SSDs, such as wear leveling and flash memory architecture, to ensure that all data is wiped completely. This option is in line with best practices for data sanitization and is the most effective method for securely erasing data from an SSD without physically damaging the drive, making it the correct answer to the question.

Answer 24

Implementing a patch management policy and regularly monitoring patches Why: Implementing a patch management policy and regularly monitoring patches is the most effective method because it ensures that patches are being regularly evaluated and applied in a timely manner. This proactive approach can help prevent security incidents caused by unpatched vulnerabilities.

Answer 25

Strategic processes Why: Strategic processes focus on the long-term direction and goals of an organization. They involve high-level planning and decision-making, determining the organization's leadership, purpose, and priorities. Top management typically sets these processes and long-term impacts on the entire organization.

Answer 26

Digital signature Why: A digital signature is a cryptographic technology that is used to verify the authenticity and integrity of a digital message, software, or document. It provides non-repudiation services because it prevents someone from denying having signed a message or document after the fact. It achieves this by creating a unique hash of the data, which is then encrypted using the sender's private key. If the receiver can decrypt the hash using the sender's public key and it matches the hash of the data, it proves that the data came from the sender and was not tampered with, therefore providing non-repudiation.

Answer 27

Access control Why: Access control is the MOST important design principle in ensuring secure network architectures as it involves defining and enforcing rules for controlling access to resources within the network. This includes authentication and authorization mechanisms to ensure only authorized users have access to sensitive data and systems.

Answer 28

Determining the root cause of the incident Why: The primary focus of a security incident investigation is to determine the root cause of the incident so that appropriate measures can be taken to prevent it from happening again in the future. By understanding the root cause, the organization can respond effectively and improve their overall security posture.

Answer 29

Continuous monitoring Why: Continuous monitoring is a method used to regularly and consistently monitor and analyze security events to identify potential threats and vulnerabilities. This includes the ongoing scanning of network traffic, the regular analysis of system logs, and the continuous observation of user activity to identify any suspicious or anomalous behavior. Continuous monitoring helps in keeping a real-time eye on all activities, thereby allowing timely detection and prevention of any malicious activities or security breaches.

Answer 30

Obtaining the latest firmware from the manufacturer Why: Obtaining the latest firmware from the manufacturer: This is the correct answer because it is essential to have the new firmware available before you can perform any other steps in the update process. The manufacturer will typically provide the latest firmware version, along with release notes, to inform users of the improvements and bug fixes made.

Answer 31

Insufficient network bandwidth Why: Although network bandwidth may be a concern for some IoT devices, it is not necessarily a security concern as other factors such as unsecured connectivity and lack of strong authentication mechanisms pose greater risks to IoT security.

Answer 32

Notify employees and evacuate the premises Why: The first step in protecting the organization's assets during a natural disaster is to ensure the safety of all employees. Before addressing technological or infrastructural aspects of a disaster, organizations must prioritize human life. This includes notifying employees about the disaster and evacuating the premises to ensure their safety. Other procedures related to data recovery or damage assessment are secondary to human safety.

Answer 33

Social engineering Why: Social engineering involves manipulating people to reveal sensitive information or gain unauthorized access to systems or facilities. Social engineering can be highly effective because it exploits human psychology and trust, which are often considered the weakest links in security.

Answer 34

To manage and maintain the company's technology infrastructure and assets Why: The primary goal of a company's IT department is to manage and maintain the company's technology infrastructure and assets, including hardware, software, networks, and data. This includes ensuring the security and availability of these assets, as well as their ongoing maintenance and updates. They are responsible for ensuring that the company's technology is functioning efficiently and securely, which in turn supports the company's operations and strategic goals.

Answer 35

Access control list Why: An ACL is a mechanism used to define who (or what) is allowed access to a specific system resource, and what operations they are allowed to perform on that resource. In the context of ensuring only authorized employees can access sensitive data, ACLs can specify which users or groups of users have access to certain data or network segments, and the type of access they have (e.g., read, write, execute).

Answer 36

The user has full control over the software Why: The user has full control over the software: In the Software as a Service (SaaS) model, the service provider is responsible for the underlying infrastructure, including the software itself. The service provider maintains, updates, and upgrades the software, providing users with access typically via the internet. Therefore, the user does not have full control over the software. They can generally manage user access and may have some level of configuration control, but they don't control the software's core aspects, like source code or infrastructure. This lack of control is often a trade-off for the convenience of not having to worry about maintenance and updates, which are handled by the provider.

Answer 37

Using strong, unique passwords for all accounts Why: Using strong, unique passwords for all accounts: This is the most effective preventive measure among the options listed. Strong, unique passwords make it much harder for thieves to access your accounts, even if they do manage to obtain some of your personal information. For best practice, use a combination of letters, numbers, and symbols in your passwords, and avoid using easily guessed information like birthdays or pet names. Additionally, using a different password for each account can help ensure that if one account is compromised, the others remain secure.

Answer 38

3 Why: When we talk about striping with redundancy in RAID configurations, we are typically referring to RAID 5. RAID 5 requires at least three disks. The data is striped across all but one of the disks (similar to RAID 0), and the last disk stores parity information which provides the redundancy. This parity information allows data to be rebuilt if one disk fails, hence providing fault tolerance.

Answer 39

Data security Why: When choosing a cloud service provider for storing and managing information, data security should be the most important factor to consider. As the prevalence of data breaches and cyber attacks continues to rise, the need for robust data security measures becomes increasingly critical. Cloud storage providers must be able to demonstrate that they have strong encryption for data in transit and at rest, secure data centers, and robust procedures for handling data breaches, among other security measures. Additionally, they must be compliant with various global and industry-specific regulations, such as GDPR or HIPAA. If data security is compromised, it can lead to serious reputational damage, financial loss, and legal issues, making it the most important factor when choosing a cloud service provider.

Answer 40

Conduct a risk assessment Why: The first step in implementing a new security policy is conducting a risk assessment. This is important because it allows an organization to understand its current security posture, identify potential vulnerabilities, and evaluate the potential impact of threats. It provides a foundation for the development of a new security policy, ensuring that it addresses the specific security needs and risks of the organization.

Answer 41

Data sensitivity levels Why: The MOST important factor to consider when implementing a data classification scheme is the sensitivity levels of the data. Understanding how sensitive different types of data are is the key to determining how they should be handled, who should have access to them, and what kinds of protections should be put in place. Data sensitivity often pertains to the impact on the organization should the data be inappropriately accessed, disclosed, modified, or destroyed. This could relate to legal implications, financial consequences, reputational damage, or effects on national security.

Answer 42

Conducting external assessments Why: External assessments, also known as external audits, are performed by independent third parties who are not familiar with the organization's security systems. This allows them to identify potential vulnerabilities and weaknesses that may not be easily noticeable by those who are familiar with the systems. These assessments can provide valuable insights and recommendations for improving the organization's security posture.

Answer 43

Conducting a risk assessment Why: Conducting a risk assessment is the first step in implementing a defense-in-depth strategy. This process involves identifying assets, vulnerabilities, threats, and the potential impacts of these threats. By conducting a risk assessment, an organization can understand its security posture and prioritize resources to build an effective multilayered defense strategy based on the identified risks.

Answer 44

All of these. Why: All of these options: hard disks, backup tapes, and data sent over the network: should be encrypted when dealing with sensitive data. Encryption is a critical part of a data security strategy. Hard disks: Hard disks often contain sensitive data, and if the computer is stolen or accessed by unauthorized individuals, this data can be at risk. By encrypting the hard disk, this data is protected, even if the hard disk itself falls into the wrong hands. Backup tapes: Like hard disks, backup tapes can contain large amounts of sensitive data. If they're lost, stolen, or mishandled, that data can be compromised. Encrypting backup tapes ensures that this data remains secure. Data sent over the network: When data is sent over a network, it's potentially exposed to anyone else who has access to that network. Encryption protects this data while in transit, ensuring that even if it is intercepted, it cannot be read without the proper decryption key.

Answer 45

Encrypting the data on the tape Why: Encrypting the data on the tape: Encryption refers to the process of converting data into a code to prevent unauthorized access. If the data on the backup tape were encrypted, it would appear as random, unreadable characters to the thief. Even if they possess the physical tape, they wouldn't be able to interpret the data on it without the appropriate decryption key. This is the most effective means of protecting sensitive data from being accessed if it falls into the wrong hands. It's a standard practice in data security, especially for data at rest or in transit.

Answer 46

Identifying the root cause of the failure Why: Before any corrective actions can be taken to address identification and authentication failures, it is crucial to first understand the underlying issue that is causing the problem. This is accomplished by identifying the root cause of the failure. In some instances, it might be due to incorrect user credentials, system malfunctions, or network-related issues. Understanding the root cause enables the appropriate steps to be taken in resolving the issue effectively. It also aids in making informed decisions on the implementation of security controls, assessment strategies, or any other measures required to rectify the situation.

Answer 47

More secure communication between parties Why: Asymmetric encryption uses two different keys, a public and a private key, to encrypt and decrypt messages. This means that only the intended recipient has the private key needed to decrypt the message, providing a higher level of security compared to symmetric encryption which uses the same key for both encrypting and decrypting.

Answer 48

Ensuring compliance with regulatory requirements Why: Mandatory reporting refers to the legal requirement to report specific incidents or categories of information to regulatory bodies or appropriate authorities. The primary purpose of compulsory reporting is to ensure that organizations comply with these legal and regulatory requirements. Non-compliance can lead to significant fines, legal actions, and other repercussions.

Answer 49

Regularly updating the device's operating system Why: Keeping the operating system of a mobile device updated is the most effective measure among the given options for securing a mobile device against malware. These updates often include patches for known vulnerabilities that malware could exploit. By staying updated, users can reduce the risk of infection.

Answer 50

Biometric authentication Why: This is the correct answer. Biometric authentication is an access control mechanism that verifies an individual's identity based on physical or behavioral characteristics. These characteristics could include fingerprints, face recognition, voice patterns, or iris scans. This method of authentication is considered to be very secure because these physical or behavioral characteristics are unique to each individual and extremely difficult to replicate.

Answer 51

Containing the breach and conducting a thorough investigation Why: The best course of action for an IRT in the case of a data breach is to contain the breach as quickly as possible to prevent any further damage. This may involve disconnecting affected systems from the network, isolating the source of the breach, and conducting a thorough investigation to determine the cause and scope of the breach.

Answer 52

The use of the smallest possible key length for encryption Why: Compliance requirements for a company's information security policy typically include the use of strong password policies, the use of encryption for data at rest, and the use of biometric authentication. The smallest possible key length for encryption would not be a compliance requirement. Shorter key lengths might be easier to manage and quicker to process, but they are more susceptible to brute force attacks and are therefore less secure.

Answer 53

To block unauthorized access to a network Why: A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. The primary function of a firewall is to separate a secure area (internal network) from a non-secure area (Internet) and to control communications between the two, effectively blocking unauthorized access to the network.

Answer 54

Active detective control Why: An active detective control involves manual intervention, such as audits and reviews to identify and react to issues or irregularities. In this case, Anastasia is actively reviewing logs, a proactive measure to detect anomalies, errors, or security threats. This active process of checking and verifying the logs can help to quickly identify and respond to potential problems. The term "active" refers to the proactive nature of this process, while "detective" signifies its purpose of detecting potential issues.

Answer 55

The CEO Why: The CEO (Chief Executive Officer): In a traditional business hierarchy, the CEO is typically the highest-ranking executive in the company. They are responsible for making major corporate decisions, managing a company's overall operations and resources, and acting as the main point of communication between the board of directors (the board) and corporate functions. Therefore, it is usually correct to say that the CEO leads an organization.

Answer 56

Using a tool to encrypt the data on the drive Why: Remanence refers to the residual information that remains on storage media like hard drives after attempts have been made to remove or erase the data. The main goal when dealing with remanence is to ensure that no recoverable data is left on the disk. Encryption doesn't adequately address this goal because it simply makes the data unreadable without the correct decryption key. However, the original data is still there, and it could potentially be recovered if the decryption key was somehow compromised or if advanced decryption methods were applied. Therefore, using a tool to encrypt the data on the drive wouldn't be an acceptable way to deal with remanence in this situation.

Answer 57

Full backup Why: A full backup is a method where all the files and folders selected for the backup will be backed up. After the full backup is taken, the system clears the archive bit to indicate that a backup has been made. This type of backup provides the highest level of protection by completely backing up all data within a system. It requires more storage space and takes more time compared to other methods like incremental or differential backups.

Answer 58

Identifying the need for the update Why: Before any software update can be implemented, the very first step is to identify the need for the update. This could be due to various reasons such as fixing security vulnerabilities, improving performance, adding new features, or addressing software bugs. Identifying the need for an update typically involves monitoring software performance, getting feedback from users, and staying informed about new security threats that could affect the software. It's the basis for all subsequent actions and without this step, one wouldn't know what to update or why it needs to be updated.

Answer 59

Encrypting the file with a symmetric key Why: This is the most effective method for ensuring the confidentiality of data in a file-level encryption system. Symmetric encryption uses a single key for both encryption (converting readable data into unreadable data) and decryption (converting the unreadable data back to its original form).

Answer 60

Botnet Why: A botnet is a collection of compromised computer systems that are controlled by a single entity. This allows the entity to launch distributed denial-of-service (DDoS) attacks, in which multiple compromised systems are used to flood a targeted website or network with traffic, disrupting its services. Botnets can also be used for other malicious purposes, such as stealing sensitive data or spreading malware.

Answer 61

Transference Why: Transference is a risk response strategy where the organization transfers the risk to a third party without eliminating the risk entirely. This is typically accomplished through contractual shifting of the risk to another party or through insurance, as in this case. When you purchase insurance, you're essentially transferring the financial risk to an insurance company.

Answer 62

Alert the authorities and perform a forensic analysis to determine the extent of the breach Why: In this situation, the appropriate response is to alert the authorities and conduct a forensic analysis to determine the size of the violation. Reporting the breach to authorities is necessary for legal and regulatory compliance and can aid investigations. It's also essential for understanding and potentially identifying the attacker(s). Forensic analysis is essential to understand how the breach occurred, what data was accessed or stolen, and what vulnerabilities were exploited. This information is critical to prevent similar violations in the future, fix the identified vulnerabilities, and inform affected customers accurately about the compromised data.

Answer 63

Access control Why: Access control is a security measure that regulates who or what can view or use resources in an information system. It essentially determines who is allowed to access what data, when, and from where. Access control can be based on several factors such as user roles, user attributes, environmental conditions, etc. Access control systems can provide layered security, allowing permissions to be set for entire groups of users or customized to the individual level.

Answer 64

Configuring load balancers Why: Distributed Denial of Service (DDoS) attacks aim to overload a network or system with excessive traffic to make it unavailable to users. One way to mitigate the effects of such attacks is to use load balancers. Load balancers distribute network traffic across multiple servers, preventing any one server from becoming overloaded. They can help absorb the influx of traffic that comes with a DDoS attack and ensure that the system continues to function. It's worth noting that while load balancers can help mitigate DDoS attacks, they are not a comprehensive solution. More sophisticated DDoS mitigation strategies often involve a combination of techniques, including rate limiting, IP reputation lists, anomaly detection, and more.

Answer 65

A zero-day exploit is a new and previously unknown vulnerability, while a known vulnerability is one that has potentially already been patched. Why: A zero-day exploit is a new and previously unknown vulnerability, while a known vulnerability is one that has already potentially been patched: A zero-day exploit refers to a flaw in software that is unknown to the people or organization who created the software. Because it is not yet known by the software maker, it has not been fixed or patched, and can be exploited by attackers. The term 'zero-day' is used because there's effectively zero days between the discovery of the vulnerability and the first attack that uses it. On the other hand, a known vulnerability is one that has been identified and typically patched by the software developer. This type of vulnerability is already known to the software maker, security professionals, and potentially malicious actors, but the risk is reduced if the patch is applied.

Answer 66

Implementing strict access controls Why: Implementing strict access controls, such as role-based access and authentication, is the most effective way to prevent unauthorized access to sensitive data. Access controls ensure that only authorized individuals can access specific data, systems, or resources. This can be achieved through measures such as user identification, authentication, and authorization. With strong access controls, the likelihood of unauthorized access (which could lead to data breaches) is significantly reduced.

Answer 67

Knowledge-based authentication Why: Knowledge-based authentication, also known as challenge-response authentication, relies on the user being able to provide answers to specific questions or challenges. This method can be easily bypassed if an attacker is able to obtain this information through social engineering or other means.

Answer 68

To evaluate the effectiveness of security controls in protecting an organization's assets Why: To evaluate the effectiveness of security controls in protecting an organization's assets, A security control assessment is primarily designed to determine how well the organization's security controls perform. This involves testing, examining, and interviewing to assess whether the rules are implemented correctly, operating as intended, and producing the desired outcome to meet the security requirements for the system or organization.

Answer 69

Identify and document the incident Why: The first step in the cyber security incident response process is to identify and document the incident. This involves gathering information about the nature and scope of the incident, as well as any potential impacts on the organization's systems and data.

Answer 70

Implementing strict access control policies Why: Access control policies are fundamental to physical security. They help prevent unauthorized access to facilities, resources, and information. These policies define who has the right to access certain areas, when they can access these areas, and what they can do once they have access. This may include implementing key cards, biometric systems, or other authentication methods to control access to certain areas. With stringent access control policies, even if other measures fail, unauthorized individuals should still be unable to gain access to secure areas.

Answer 71

Using a combination of a password, security token, and biometric authentication Why: This method is the most secure because it combines three distinct factors: something you know (password), something you have (security token), and something you are (biometric authentication, such as a fingerprint or facial recognition). By combining all three, even if one factor is compromised, the other factors still provide protection, making it extremely challenging for attackers to gain unauthorized access.

Answer 72

Using a trusted third party to verify the signature Why: A trusted third party, such as a certificate authority (CA), can verify the authenticity of a digital signature by confirming that the sender's digital certificate is valid and has not been revoked. This is the MOST effective way to ensure the authenticity of a digital signature because it provides a level of assurance that cannot be achieved through encryption algorithms or email address verification alone.

Answer 73

Single-factor authentication Why: Single-factor authentication: In the context of the question, presenting an ID is an example of single-factor authentication. Single-factor authentication (SFA) refers to the security process where users provide one form of identification to gain access to a system. This could be a username and password, a security token, a smart card, or in this case, an ID. It's termed "single-factor" because it only involves one category or factor of authentication — something you know, something you have, or something you are. In this case, the ID is something you have.

Answer 74

To ensure that critical business processes can continue during a disaster Why: Business continuity and disaster recovery planning focuses on identifying potential disasters and developing strategies to minimize their impact on the organization, including maintaining critical business processes. BCP aims to maintain or quickly resume mission-critical functions following a disaster, while DR focuses on restoring an organization's IT infrastructure and operations after a disaster.

Answer 75

To reduce cost and increase efficiency Why: Virtualized networks are primarily implemented to reduce cost and increase efficiency. Through network virtualization, one physical network can be partitioned into multiple virtual networks, each of which can run different applications and services. This allows for the optimal use of network resources and reduces the need for redundant infrastructure, leading to cost savings. It also allows for more flexible and dynamic configuration, which can improve efficiency by making it easier to adapt to changing needs. For instance, bandwidth can be allocated and reallocated based on demand, thereby reducing wastage and improving overall network utilization.

Answer 76

The impact of the outage on the organization's operations Why: The impact of the outage on the organization's operations is the most critical aspect to consider when determining an RTO because it directly affects the business continuity and profitability. If the downtime severely disrupts operations or results in significant revenue loss, the organization would need a shorter RTO, which means they'll need to recover more quickly.

Thor's 100 Questions Set 1 Flashcards

(100 cards)