Security and Risk

What changes plaintext data to ciphered data?

Encryption

What is NOT a common category of control implementation?

Functional

What is a whitelist?

A list of approved email addresses or domains

Functional descriptions of systems are often used for documenting __________.

critical business functions (CBFs)

What should you do if you discover that a security gap has not been closed?

Address the gap.

Which of the following statements is NOT true of cost-benefit analysis?

A control always eliminates the loss.

All of the following terms have the same meaning, EXCEPT:

Internal network zone

What is NOT an example of an intangible value?

Software application

What is the primary difference between a functional exercise and a full-scale exercise?

A full-scale exercise is more realistic than a functional exercise.

Email addresses or domains ______________ are automatically marked as spam.

on a blacklist

Which term is defined as "elements necessary to perform the mission of an organization"?

CSF

What business continuity plan (BCP) team is responsible for declaring the severity of an incident?

DAT

What are overlapping countermeasures?

Different countermeasures that attempt to mitigate the same risk

Which term describes entities who have a direct interest in, or are affected by, a business impact analysis (BIA)?

Stakeholders

_________ is the process of creating a list of threats.

Threat identification

Kevin is a disgruntled employee who was recently laid off from a major technology company. He wants to launch an attack on the company. Where might Kevin learn about vulnerabilities that he can exploit?

A blog

Which type of alternate location is the hardest to test for disaster readiness?

Cold site

Which of the following is NOT true of data and information assets?

Data classified at different levels, such as public and private, receives the same levels of protection.

Which of the following is NOT true of threats?

No action can reduce the potential for a threat to occur.

Alice is a security professional. While writing a risk assessment report, she is defining what the current email system does. She is using statements such as "Accepting email from external email servers and routing to internal clients" and "Scanning all email attachments and removing malware." Which of the following is she most likely defining?

The mission of the system

What is the function of job rotation?

To prevent or reduce fraudulent activity

What is the purpose of a plan of action and milestones (POAM)?

Tracks risk response actions

Functionality testing is primarily used with ____________.

software development

What are the first two steps in the business impact analysis (BIA) process?

Identify the environment and identify stakeholders

_____________ is the likelihood that a threat will exploit a vulnerability.

Probability

How are business continuity plans (BCPs) and disaster recovery plans (DRPs) related?

A DRP is a part of the larger BCP.

You are a stakeholder who has just designated a business function as critical. What must you do now?

Dedicate resources to protect the function.

Why should an organization regularly review and update its disaster recovery plan (DRP)?

To ensure the plan reflects changes to IT systems

When the Federal Trade Commission (FTC) was created in 1914, what was its primary goal?

To prevent unfair methods of competition

Which of the following can determine that a business function is critical?

Any stakeholder

What is NOT one of the three primary types of business liability insurance?

Cybersecurity

Which of the following is NOT true of big data?

Data in a warehouse is frequently modified.

What is critical data?

Data that supports critical business functions (CBFs)

Lin is writing a risk management report. Of the major categories of reporting requirements, which one becomes the actual risk response plan?

Documenting and tracking implementation of accepted recommendations

ABC Wholesale Pet Supply sells pet supplies to retailers. Every transaction results in a duplicate hardcopy paper shipping document and invoice. The person picking up the order signs the documents and takes one copy. Two other copies stay at the warehouse. How would using multiple hardcopies of each transaction affect ABC's recovery point objective (RPO)?

Duplicate hardcopies of transactions increase complexity and decrease tolerable data loss.

What is NOT one of the three primary objectives of controls?

Eliminate

What is NOT a risk management step?

Eliminating all risks

Which of the following mainly applies to any organization that handles health information?

HIPPA

Wren is defining the scope for his organization's disaster recovery plan (DRP). What items should he consider?

Hardware, software, data, and connectivity

Which of the following best describes the purpose of the Health Insurance Portability and Accountability Act (HIPAA)?

It helps to protect health information.

In a risk assessment, what refers to how responsibilities are assigned?

Management structure

Which of the following is often the weakest link in IT security

People

What are the four major categories of risk management reporting requirements?

Present recommendations; document management response to recommendations; document and track implementation of accepted recommendations; and create a plan of action and milestones (POAM)

You are reviewing historical data in an attempt to identify potential threats to your business. What would NOT be helpful to you in this process?

Reading news articles about thefts that occurred last year in a different part of the U.S.

What causes a disaster recovery plan (DRP) to be activated?

Realizing criteria specified in the DRP

What is NOT a common classification of data?

Risk

Maria runs a bank. She wants to update the physical security at each bank branch and update the technological security of the bank's private financial data. What is the best way to determine whether physical security or technological security has a higher priority of protection?

Risk assessment

__________ is the biggest problem you can face if you do not identify the scope of your risk management project.

Scope creep

Which factor most directly affects the scope of a business impact analysis (BIA)?

Size of the organization

An access control such as a firewall or intrusion prevention system cannot protect against which of the following?

Social engineer

What is a major type of vulnerability for the User Domain?

Social engineering

The following statements regarding compliance laws are true, EXCEPT:

The Federal Information Security Management Act (FISMA) requires covered organizations to share student records with students or their parents.

What is the relationship between Enron and the Sarbanes-Oxley Act (SOX)?

The bankruptcy and scandal surrounding Enron was one of the major scandals that inspired the creation of SOX.

What is the safeguard value in a quantitative risk assessment?

The cost of a control

What characteristic is common to risk assessments and threat assessments?

They are both performed for a specific time.

What are critical resources?

Those that are required to support critical business functions (CBFs)

Which tool is most commonly used to prioritize mitigation efforts?

Threat likelihood/impact matrix

Why is process analysis performed?

To determine if vulnerabilities exist in the process

What is NOT a best practice when performing a business impact analysis (BIA)?

Using the same data collection methods

A ___________ plan can help ensure that mission-critical systems continue to function after a disaster.

business continuity

A(n) ____________ assessment attempts to identify vulnerabilities that can be exploited

exploit

The term "big data" is most closely associated with _____________.

large databases

Gap analysis reports for security are often used when dealing with ___________.

legal compliance

To _________ risk means to reduce or neutralize threats or vulnerabilities to an acceptable level.

mitigate

Qualitative risk assessments determine the level of risk based on the __________ and _________ of risk.

probability, impact

Background checks, software testing, and awareness training are all categories of ____________.

procedural controls

In a SQL injection attack, an attacker can _________________.

read sections of a database or a whole database without authorization

The Remote Access Domain of a typical IT infrastructure allows __________ to access the ________ network.

remote users, private

Purchasing insurance is the primary way for an organization to ______ or _______ risk.

share, transfer

Piggybacking is also known as _____________.

tailgating

System logs and audit trails are a type of __________ control.

technical

The actual methods used to protect against data loss are __________ controls, but the program that identifies which data to protect is a ___________ control.

technical, procedural

When your bank or credit card company sends you a notification of changes in how it collects or shares data, it is sending that notification in compliance with ________________.

the Financial Privacy Rule of the Gramm-Leach-Bliley Act (GLBA)

Regarding risk assessments, _____________ define(s) what a system does.

the mission of the system

By identifying critical business functions (CBFs) first, you use a ________ approach.

top-down

A business continuity plan (BCP) is an example of a ___________.

security plan

How does a countermeasure's cost most directly impact the decision to implement it?

A countermeasure's cost should not exceed the impact if the risk to be mitigated is realized.

Alice has completed a cost-benefit analysis (CBA) of recommended countermeasures. For a specific risk, four countermeasures have been recommended. How can Alice use the CBA to choose the countermeasure to recommend?

Choose the countermeasure with the highest countermeasure value.

What is the Delphi Method?

A way to complete a qualitative risk assessment

Jiang has been working on a risk management plan for his government agency. What information should he include in the report to management when he presents his risk management recommendations?

Findings, recommendation cost and time frame, and cost-benefit analysis (CBA)

A teenager learning about computers and programming for the first time writes a simple program meant to disrupt the function of his sister's computer. While she's with friends at the mall, the teenager enters his sister's IP address, launches the program, and waits to see what will happen. The teenager is an example of a ___________.

script kiddie

Jonathan is a security professional. He is part of a small group of people launching a startup company that will handle patient medical information. Jonathan is attempting to determine threats the company may face, criteria that will allow each threat to succeed, and the potential result. Which of the following would be most useful to Jonathan?

Affinity diagram

How can you determine the importance of a system?

By how the system is used

A __________ is a computer joined to a botnet.

zombie

Regarding business continuity, what is the first phase of activity if a disruption occurs?

The notification and activation phase

What is the minimum number of nodes required by a failover cluster?

2

Which of the following is most likely to describe how to perform test restores?

A backup plan

Isabella is preparing to write a disaster recovery plan (DRP). What must she have before she proceeds with writing?

A clear idea of her primary concerns

Choose the most accurate statement with respect to creating a risk management plan.

A risk management plan can help ensure your business is in compliance with important regulations.

Alice is a risk management specialist. She wants to communicate a risk and the resulting impact to her superiors. Which of the following should she use?

A risk statement

What is NOT something to consider when determining the value of an asset?

Departmental ownership

When should you establish objectives for a risk management plan?

During the planning phase of a project

What is an important element of following up on a risk mitigation plan?

Ensuring that security gaps are closed

All of the following are reasons why configuration management is an important risk management process, EXCEPT:

It reduces unintended outages.

Kyle works for the IT department. He is working in the asset management system. He is assigning the relevant IT infrastructure domain to each asset. Which is the best domain to assign to elements used to connect systems and servers together, such as hubs, switches, and routers?

LAN domain

Some controls are identified based on the function they perform. What are the broad classes of controls based on function?

Preventative, detective, corrective

What is the primary determination as to whether an incident is included in a business continuity plan (BCP)?

Probability of occurrence and impact

What is the most important consideration of a disaster recovery plan (DRP)?

Protecting personnel

What are the two primary methods used to create a risk assessment?

Quantitative and qualitative

What is one source of risk reduction?

Reducing the impact of the loss

What is the practice of identifying, assessing, controlling, and mitigating risks?

Risk management

You receive an email from someone named Bob in the IT department who needs to access your login information for a scheduled internal vulnerability assessment. You know an assessment is taking place because your manager notified your group last week. Normally, you wouldn't give your password or other login information to anybody, but doing so seems appropriate in this situation. Which of the following could be taking place?

Social engineering attack

Which of the following refer(s) to when users or customers need a system or service?

System access and availability

Which business continuity plan (BCP) test type brings all participants together in a conference room or similar environment to walk through BCP scenarios?

Tabletop exercise

What is the primary reason for testing a disaster recovery plan (DRP)?

To ensure it performs as expected

Lower recovery time objectives (RTOs) are _______ but _______.

achievable, costly

A ___________ plan can help you identify steps needed to restore a failed system.

disaster recovery

A redundant backup site is _______________.

hosted by a third-party vendor

All of the following are steps involved in creating an affinity diagram, EXCEPT ______________.

identifying a project's scope

A ______ to an asset occurs only when an attacker can exploit a vulnerability.

loss

Critical business functions (CBFs) support _________.

mission-critical operations

An exploit assessment is also known as a(n) ___________.

penetration test

POAM stands for_____.

plan of action and milestones

A(n) _____ is the likelihood that something unexpected is going to occur.

risk

A(n) ___________________ is performed to identify and evaluate risks.

risk assessment

Primary considerations for assessing threats based on historical data in your local area are _______ and ________.

weather conditions, natural disasters

What is NOT true of a qualitative risk assessment?

It provides a cost-benefit analysis (CBA).

What is NOT true of a quantitative risk assessment?

It uses relative terms such as high, medium, and low.

Which of the following allows one person to act for another for legal issues and sometimes is used if someone becomes mentally incapacitated.

Power of attorney

Rodrigo is a network security specialist. He wants to perform real-time analysis of security data gathered from networked systems. Which of the following is the best solution for Rodrigo to implement?

Security information and event management (SIEM)

Which of the following is NOT true of state attorneys general (AGs)?

They are appointed by the Department of Homeland Security.

Jiang has been working on a risk management plan for his government agency. He collected data on risks and recommendations, included that information in a report, and submitted it to management. What is the purpose of the report?

To help management decide which recommendations to use

Health Insurance Portability and Accountability Act (HIPAA) fines for mistakes can be as high as __________ a year.

25,000

Carl is a security specialist. He is updating the organization's hardware inventory in the asset management system. Which of the following would be least helpful to record?

A competitor's product

The Family Educational Rights and Privacy Act (FERPA) applies to all of the following, EXCEPT:

A medical center that hired recent nursing graduates

What is CIPA?

A law designed to limit offensive content from school and library computers

You are creating objectives for your risk management plan. What do you NOT include at this stage?

A plan of action and milestones (POAM)

Who is responsible for activating the business continuity plan (BCP)?

BCP coordinator

What is NOT one of the three primary bureaus of the Federal Trade Commission (FTC)?

Bureau of the Census

How do you start a risk assessment?

By defining what you will assess

The National Institute of Standards and Technology (NIST) publishes SP 800-53. This document describes a variety of IT security controls, such as access control, incident response, and configuration management. Controls are grouped into families. Which NIST control family helps an organization recover from failures and disasters?

Contingency Planning (CP)

Which of the following is a business continuity plan (BCP) phase that focuses on returning to normal operations?

Reconstitution phase

_____________ value is the cost to purchase a new asset in place of an existing asset.

Replacement

What is the primary reason to avoid risk?

The impact of the risk outweighs the benefit of the asset.

What is the primary benefit of a business continuity plan (BCP)?

To better prepare the organization to respond to an interruption

When does a threat/vulnerability pair occur?

When a threat exploits a vulnerability

The following are true of risk assessment critical area identification, EXCEPT:

When critical areas are identified, areas that are least critical to the business should be the first priority.

At what point in the risk mitigation process should you identify and analyze threats and vulnerabilities to your organization?

After you identify assets

Who is the most common person to authorize business continuity plan (BCP) activation in the order of succession if the chief executive officer (CEO) is unavailable?

Chief information officer (CIO)

Which of the following is a type of control that is implemented with a written document?

Procedural

A business impact analysis (BIA) is an important part of a _____________, and it can also be part of a __________.

business continuity plan, disaster recovery plan

Tonya is performing a quantitative risk assessment for a piece of software. The single loss expectancy (SLE) is $500, and the associated annual rate of occurrence (ARO) is 3. What is the annual loss expectancy (ALE)?

$1,500

What is a publicly traded company?

Any company that has stock that outside investors can buy or sell

What are the six principles of Payment Card Industry Data Security Standard (PCI DSS)?

Build and maintain a secure network; protect cardholder data; maintain a vulnerability management program; implement strong access control measures; regularly monitor and test networks; and maintain an information security policy

You plan to perform a vulnerability assessment on your company's servers. You know that your assessment may simulate the effects of a denial of service (DoS) attack for a brief period of time. What is the most important task to complete before you perform the assessment?

Obtain written permission from the proper authority.

The following are examples of hardware assets, EXCEPT:

Operating system

__________ provide the detailed steps needed to carry out ___________.

Procedures, policies

The formulas used in a quantitative risk assessment typically look at a single year. The calculations can become quite complex if other costs are included. Which of the following is NOT usually included in the calculations?

The cost to maintain a control

What is the overall goal of business continuity plan (BCP) exercises?

To demonstrate how the BCP will work

What is the purpose of nonrepudiation techniques?

To prevent people from denying they took actions

Why is system testing performed?

To test individual systems for vulnerabilities

What process generally causes a plan of action and milestones (POAM) to expand?

Transforming the risk assessment into a risk mitigation plan

When performing threat assessments, it's important to ensure you understand the system or application you are evaluating. To understand a given system or application, you need to understand all of the following EXCEPT:

Where a system is manufactured

Disaster recovery procedures begin after ___________ and ___________.

activating the disaster recovery plan (DRP), assessing the damage

You book a hotel online, and the registration process is clear and streamlined. This is an example of a(n) ______________ process that has _______________.

automated, high value to customers

When an emergency is declared, the ____________ contact(s) appropriate teams or team leads.

business continuity plan (BCP) coordinator

Bob is the project manager for his company's security countermeasure implementation project. Michael informs Bob that task #12 (implementing a failover cluster) will not finish on time. Because task #12 is on the project's _______________, Bob knows that the project will not complete on time and sets up a meeting to inform the stakeholders.

critical path

When compliance is mandated by law, companies often participate in _______, which provide third-party verification that requirements are being met.

external audits

According to the World Intellectual Property Organization (WIPO), the two categories of intellectual property (IP) are _______________ and _______________.

industrial property, copyright

The primary risks associated with the User Domain of a typical IT infrastructure are related to _____________.

social engineering

A business continuity plan (BCP) program manager within a large organization _________.

usually manages multiple BCP projects

A(n) _________ provides secure access to a private network over a public network such as the Internet.

virtual private network (VPN)

A __________ consists of multiple servers using ______________.

web farm, network load balancing

What is NOT an example of unintentional threat?

A script kiddie writes and runs malware to "see what it can do."

Which of the following is best described as attackers who focus on a specific target, have high levels of expertise, have almost unlimited resources, and are often sponsored by nation-states or terrorist groups?

Advanced persistent threats (APTs)

In a quantitative risk assessment, what describes the loss that will happen to the asset as a result of a threat?

Exposure factor (EF)

Which formula is used to determine the cost-benefit of a control, such as antivirus software?

Loss before control implementation − Loss after control implementation − Cost of control

Which of the following is NOT a vulnerability that might affect the website of an online company?

Loss of internet connectivity

Which of the following is a division of the U.S. Department of Commerce and publishes the Risk Management Framework (RMF) 800 special publications series?

National Institute of Standards and Technology (NIST)

____________ assessments are objective, while ___________ assessments are subjective.

Quantitative, qualitative

A new company does not have a lot of revenue for the first year. Installing antivirus software for all the company's computers would be very costly, so the owners decide to forgo purchasing antivirus software for the first year of the business. In what domain of a typical IT infrastructure is a vulnerability created

Workstation Domain

Which of the following is NOT a direct cost?

Costs to regain market share

You have created a risk assessment and management has approved it. What do you do next?

Create a risk mitigation plan.

You are a top-level executive at your own company. You are worried that your employees may steal confidential data by downloading data onto thumb drives. What is the best way to prevent this from happening?

Create and enforce a written company policy against the use of thumb drives and install a technical control on the computers to prevent the use of thumb drives.

What is NOT one of the three commonly used business continuity plan (BCP) teams?

Critical contractor

Hajar is a security professional for a government contractor. Her company recently hired three new employees for a special project, all of whom have a security clearance for Secret data. Rather than granting the employees access to all files and folders in the data repository, she is granting them access only to the data they need for the project. What principle is Hajar following?

Principle of need to know

What are the seven components of Control Objectives for Information and Related Technology (COBIT)?

Principles, policies, and frameworks; processes; organizational structures; culture, ethics, and behavior; information; services, infrastructure, and applications; and people, skills, and competencies

Bill is a security professional. He is in a meeting with co-workers and describes a system that will make web sessions more secure. He says when a user connects to the web server and starts a secure session, the server sends a certificate to the user. The certificate includes a public key. The user can encrypt data with the public key and send it to the server. Because the server holds the private key, it can decrypt the data. Because no other entity has the private key, no one else can decrypt the data. What is Bill describing?

Public key infrastructure (PKI)

What is NOT a valuable area of consideration when defining the scope of a risk management project?

The maximum acceptable outage (MAO) for servers

In a business continuity plan (BCP), if a system houses data, the data must be protected according to _______.

its level of classification

Total risk = _______________

threat × vulnerability × asset value

A disaster recovery plan (DRP) simulation ___________.

goes through the steps and procedures in a controlled manner

Another term for data range and reasonableness checks is ______________.

input validation

Bonding is a type of ________ that covers against losses by theft, fraud, or dishonesty.

insurance

Having supplies on hand for continued production _______________.

may conflict with other organizational planning principles

When a fiduciary does not exercise due diligence, it can be considered __________.

negligence

All of the following would be specified in a password policy, EXCEPT _____________.

password management

Which term is best defined as a weakness?

Vulnerability

Complete the equation for the relationship between risk, vulnerabilities, and threats: Risk = _________.

Vulnerability × Threat

What is the primary hazard of attempting to recover without a business impact analysis (BIA)?

Wasted effort due to a lack of direction as to which resources are most critical

What does the scope section of a disaster recovery plan (DRP) define?

What is and is not covered in the plan

A warm site is _________________.

a compromise between a hot site and a cold site

A business impact analysis (BIA) identifies an impact that can result from a ____________.

disruption in a business

A __________ grants the authority to perform an action on a system. A __________ grants access to a resource.

right, permission

Which of the following is most likely to be warez?

A file on your computer of a new TV episode you downloaded for free

What is NOT a true statement about AES?

AES is the primary asymmetric encryption protocol used today.

____________ is the process of determining fair market value of an asset.

Asset valuation

According to the Sarbanes-Oxley Act (SOX), who in an organization must verify and attest to the accuracy of financial data as a matter of legal compliance?

High-level officers

What is the primary purpose of identifying critical resources in the business impact analysis (BIA) process?

Identify all IT assets that support critical business functions (CBFs).

What are the steps of a business continuity plan (BCP)?

Identify scope, identify key business areas, identify critical functions, identify dependencies between key business areas and critical functions, determine acceptable downtime, and create a plan to maintain operations

The following are major components of risk assessments, EXCEPT:

Identifying insurance options

Which approach to firewall rules starts off by blocking all traffic and then adding rules to allow approved traffic?

Implicit deny

After developing a business impact analysis (BIA) for her organization, Maria was asked by her manager to update the BIA recommendations with a higher recovery time objective (RTO). What is the most likely reason management would argue for a higher RTO?

Lower RTOs are more expensive.

Which term is sometimes referred to as the maximum tolerable period of disruption (MTPD)?

Maximum acceptable outage (MAO)

Threat ___________ is a process used to identify possible threats on a system.

Modeling

___________ prevents individuals from denying they took an action.

Nonrepudiation

What is the primary tool used to ensure countermeasures are implemented?

Plan of action and milestones (POAM)

Isabella is a risk management specialist for her organization. She is training Arturo, a new hire, on aspects of risk management. Arturo asks her what factors he should consider when assigning a value to an asset. Which of the following does Isabella tell him is the least useful?

Qualitative risk assessment

________ help(s) prevent a hard drive from being a single point of failure. __________ help(s) prevent a server from being a single point of failure. _________ help(s) prevent a person from being a single point of failure.

RAID, Failover clusters, Cross-training

What communication elements are important to the success of a disaster recovery plan (DRP)?

Recall, users, customers, and a communication plan

Susan works for a U.S. investment firm that is required to be registered with the Securities and Exchange Commission. Susan is responsible for implementing access controls on the organization's database servers. Which one of the following laws must her organization comply with?

Sarbanes-Oxley Act (SOX)

What is the purpose of a business continuity plan (BCP)?

To ensure that mission-critical elements of an organization continue to operate during and after a disruption

Scaling _______ means that you increase resources to a server, and scaling _______ means that you add additional servers.

up, out

Which of the following is a law that ensures that federal agencies protect their systems and data, comply with all elements of the law, and integrate security in all processes?

Federal Information Security Modernization Act (FISMA)

What is a security policy?

I high-level overview of security goals

The following are true of risk assessment scope identification, EXCEPT:

The system or network administrator ultimately decides what is included in the scope of a risk assessment.

What can you control about threat/vulnerability pairs?

The vulnerability only

What is the purpose of a mandatory vacation?

embezzlement

It is common to focus the scope of a risk assessment on system ownership, because doing so ____________.

makes it easier to implement recommendations

A _____________ policy governs how patches are understood, tested, and rolled out to systems and clients.

patch management

Another term for risk mitigation is _______.

risk reduction

Hardening a server refers to ____________.

the combination of all the steps that it takes to protect a vulnerable system and make it more secure than the default installation

The Health Insurance Portability and Accountability Act (HIPAA) requires that organizations that handle health information follow standards for the ________________ of that data.

storage, use, and transmission

_________ are acts that are hostile to an organization.

Intentional threats

When should you perform a risk assessment? When should you perform a risk assessment?

Periodically after a control has been implemented

Oscar works for a health insurance company. He is creating a Health Insurance Portability and Accountability Act (HIPAA) compliance plan. In the section on monitoring, what should Oscar specify to be continuously monitored for changes?

Regulations and risks

What is the primary reason security professionals automate some processes?

To reduce human error

Identify the true statement.

Exploited vulnerabilities result in losses.

After risk management recommendations have been presented to management, the managers can ___________, ___________, or _____________ the recommendations.

accept, defer, modify

Stakeholders should have ownership of a project, which is also referred to as project ________.

buy-in

A(n) _____________ is a process used to determine how to manage risk.

cost-benefit analysis (CBA)

___________ is the negative result if the risk occurs.

impact

Companies use risk assessment strategies to differentiate ___________ from _________.

severe risks, minor risks

In a cost-benefit analysis (CBA), if the benefits of a control outweigh the costs of implementing that control, then the control can be implemented to reduce risk. However, if the cost outweighs the benefit, then ______________.

the risk can be accepted

What are the elements of the security triad?

Confidentiality, integrity, and availability

Which of the following is NOT an indirect cost?

Cost to re-create or recover data

What key element is necessary for a disaster recovery plan (DRP) to succeed in a time of crisis?

Management support

Your team is developing a business impact analysis (BIA). You have identified the critical business functions (CBFs) and associated processes. What should you do next?

Map processes to IT systems.

The recovery time objective (RTO) is derived from what value from the business impact analysis (BIA)?

Maximum acceptable outage (MAO)

Which term is defined as the minimum level of services that are acceptable to an organization to meet its operational business needs?

Minimum business continuity objective (MBCO)

MAO is sometimes referred to as ____________.

MTPOD

Tonya has been asked research compliance and then provide a report to upper management. Management wants to know what the organization must do to comply with a regulation that protects the privacy of citizens in the European Union. Which of the following will Tonya research?

General Data Protection Regulation (GDPR)

Devaki is the office manager for a small medical practice in California. Part of her duties is to ensure the practice is in compliance with any relevant regulations or standards. Self-pay patients pay for services via cash, check, or payment card. Which of the following does Devaki need to ensure compliance with?

HIPAA and PCI DSS

Wen is performing a cost-benefit analysis (CBA). He needs to determine whether the organization should move workloads from the in-house data center to the cloud. The projected benefit is $50,000. The cost of the control is $1,500. What is the control value?

48,500

What is NOT commonly included in a cost-benefit analysis (CBA)?

A business continuity plan

What is a service level agreement (SLA)?

A document that identifies an expected level of performance

What is a transaction in a database?

A group of statements that either succeed or fail as a whole

Which of the following is a physical control that is most likely to be used with a proximity card?

A locked door

What is the primary purpose of a disaster recovery plan (DRP)?

To restore critical business processes or systems to operation

Ideally, when should you perform threat modeling?

Before writing an application or deploying a system

Alice is an aspiring hacker. She wants to get information on computer and network vulnerabilities and ways to exploit applications. Which of the following is the best source?

Dark web

Carl is a risk specialist. He has determined the laws and regulations with which his organization must comply. What must he do next?

Determine the impact of these laws and regulations on the organization.

Aditya is assessing the value of IT systems. His company sells sporting goods online. One factor of his evaluation is the required availability of each system. Some systems must be available 24/7, while others must be available during regular business hours Monday through Friday. Which of the following would have the highest availability requirements?

E-commerce website server

What step of a business continuity plan (BCP) comes after providing training?

Testing and exercising plans

__________ damage for the sake of doing damage, and they often choose targets of opportunity.

Vandals

In which of the following domains does the IT infrastructure link to a wide area network (WAN) and the Internet?

LAN-to-WAN Domain

Tonya is part of central IT at a public university. Her group has been tasked with creating a service catalog that will list and describe which services central IT provides to the campus community. The group has been asked to follow Information Technology Infrastructure Library (ITIL) practices. Because the group has only begun, which phase are they most likely at in the ITIL life cycle?

Service Strategy phase

What is the difference between fault tolerance and disaster recovery?

Fault tolerance mitigates component failures, and disaster recovery restores operations after a major loss.

___________ increases the availability of systems even when an isolated outage occurs, while ___________ provides the procedures to recover systems after a major failure.

Fault tolerance, disaster recovery

In a risk management plan, how should you complete the step of describing the procedures and schedules for accomplishment?

For any threat or vulnerability, recommend a solution that attempts to mitigate associated risks; justify your recommendation; list the tasks necessary for addressing the vulnerability; and provide management with an estimate of how long it will take to complete the recommendation.

Which of the following is NOT true of the WAN Domain of a typical IT infrastructure?

Internal-facing servers are configured in the demilitarized zone between two firewalls.

Which key planning principle guides the development of a business continuity plan (BCP)?

Length of time expected before returning to normal operations

What might occur if you do NOT include the scope when defining the risk assessment?

Missed deadlines

Why might you need to verify risk elements if a substantial amount of time has passed since you performed a risk assessment?

To make sure that the threats or vulnerabilities you want to mitigate still exist

What is the primary purpose of personnel policies, such as separation of duties?

To prevent fraud

A technician in a large corporation fixes a printer that was not receiving an IP address automatically by manually assigning it an address. The address was assigned to a server that was offline and being upgraded. When the server was brought online, it was no longer accessible. How could this problem have been avoided?

Through change management

Why should the people on the risk assessment team be different from the people responsible for correcting deficiencies?

To avoid conflicts of interest

Why are audits performed?

To check compliance with rules and guidelines

What is the purpose of a risk mitigation plan?

To implement countermeasures

What is an indirect objective of a business impact analysis (BIA)?

To justify funding

Which of the following is a significant part of control evaluation to determine which controls to implement?

Cost-benefit analysis (CBA)

A hacker wants to launch an attack on an organization. The hacker uses a tool to capture data sent over the network in cleartext, hoping to gather information that will help make the attack successful. What tool is the hacker using?

A packet analyzer

Carl is a security professional preparing to perform a risk assessment on database servers. He is reviewing the findings of a previous risk assessment. He is trying to determine which controls should be in place but were not implemented. Which of the following is typically found in a risk assessment report and would address Carl's needs?

Current status of accepted recommendations

A threat is any activity that represents a possible danger, which includes any circumstances or events with the potential to cause an adverse impact on the following, EXCEPT:

Assessments

What is NOT a way that you can measure the value of a system when determining if the system requires five nines?

Confidentiality

After being fired, an employee becomes disgruntled. The managers never disabled his login information, and his best friend still works at the company. The disgruntled employee gives his friend his login information for the company's private network and convinces the friend to delete important files from the company's database. You are confused when you review the audit logs and see that the disgruntled employee has been logging in from within the office every day for the past week. What has been lost in this scenario?

Nonrepudiation

Isabelle is a project manager. Her company is regulated and subject to regular audits for compliance. One regulation the company needs to comply with is Health Insurance Portability and Accountability Act (HIPAA). Isabelle needs a tool for tracking the company's progress in meeting HIPAA compliance. The tool should also enable her to assign responsibility for tasks, and it should provide management an easy way to check the status of the project. Which of the following would be most useful in this situation?

Plan of action and milestones (POAM)

Isabella works as a risk specialist for her company. She wants to determine which risks should be managed and which should not by applying a test to each risk. Risks that don't meet the test are accepted. What type of test does she apply?

Reasonableness test

Hajar is a security specialist. Her organization has about 500 systems that must be tracked for inventory purposes. She is preparing an email to her manager that describes the benefits of including specific details about software in the inventory, as well as the use of an automated asset management system. Which of the following is NOT one of those benefits?

The frequency of operating system upgrades will be reduced.

What does the principle of least privilege have in common with the principle of need to know?

They both specify that users be granted access only to what they need to perform their jobs.