Compliance and Risk Management Final Exam Review
How can you determine the importance of a system? -By when the system was last updated -By why the system functions -By what the organization does -By how the system is used
By how the system is used
HIPPA covers any organization that handles storage, use and transmission of data and applies to? -Medical facilities -Insurance companies -Any company with a health plan if employees handle health data -All the above
All the above
Wen is evaluating Core Business Functions, what of the following should he consider? Assess to the internet Web server availability Database avaiability All the above
All the above
Ideally, when should you perform threat modeling? -After writing an application or deploying a system -Before writing an application, but after deploying a system -After writing an application, but before deploying a system -Before writing an application or deploying a system
Before writing an application or deploying a system
Which of the following is not one of the three primary objectives of controls? -Detect -Eliminate -Recover -Prevent
Eliminate
Exploit assessments are very different from vulnerability, threat and risk assessment by which of the following reasons? -Exploit analysis will provide you a gap analysis that would be useful to develop a remediation plan -Its a point in time assessment -It will check compliance with rules and guidelines -Assessments will identify vulnerabilities across networks, servers, workstations, and people.
Exploit analysis will provide you a gap analysis that would be useful to develop a remediation plan
Based upon a 2019 General Accounting Office audit, all federal government agencies have successfully implemented risk managment policies. -True -False
False
Critical success factors (CSFs) include functions considered critical to an organization. True False
False
Every control must meet all three primary objectives of controls: prevent, detect, and recover. -True -False
False
Telecommuters are not key to a business continuity plan (BCP) because they work from remote locations. Therefore, any disruptions would not affect them. True False
False
The seven steps of a business impact analysis (BIA) are the same as the seven steps of contingency planning. True False
False
which of the following is not a common category of control implementation? -Functional -Physical -Procedural -Technical
Functional
What are the differences between a Threat Assessment and Vulnerability Assessment? -There is no differences between the two -Goal of a vulnerability assessment is to identify potential weaknesses in controls whereas threat assessment is focused on threats -Vulnerability assessment is a point in time assessment whereas threat assessment is a continuous assessment -A vulnerability assessment is focused on assesssing plans whereas a threat assessments is focused on network architecture
Goal of a vulnerability assessment is to identify potential weaknesses in controls whereas threat assessment is focused on threats
A business impact analysis (BIA) identifies: -vulnerability. -Identifies systems critical for business survival. -risk to an IT infrastructure. -threat to the IT infrastructure.
Identifies systems critical for business survival.
Identifying mission-critical business functions can be difficult. Therefore, the best way to identify these Critical Business Functions is to: Identify vital functions and map them to critical success factors Identify a single critical success factor with a successful business and then map it to critical business factors. Map the critical business factors to those vital functions None of the above.
Identify a single critical success factor with a successful business and then map it to critical business factors.
A Business Impact Analysis allows you to identify which of the following (multiple)? Identify outage impacts Identify Critical Business Functions Identify Maximum Acceptable Outage Solutions and strategies to prevent impacts in the future
Identify outage impacts Identify Critical Business Functions Identify Maximum Acceptable Outage Solutions and strategies to prevent impacts in the future
What are the first two steps in the business impact analysis (BIA) process? -Identify the environment and identify critical resources -Identify the environment and identify stakeholders -Identify stakeholders and identify critical resources -Identify recovery priorities and identify stakeholders
Identify the environment and identify stakeholders
User domain refers to which of the following? -Includes PCs so risk includes theft and updates -Includes personal data so significant risk is loss of confidentiality. -Includes connection to internet so risk to provide protection to external threats via firewalls -Include VPN via tunnel protocols with strict access control protocols
Includes personal data so significant risk is loss of confidentiality.
Which of the 7 IT domains will exploit assessments be focused on lack of configuration control to and to capture internal network traffic seeking encrypted traffic. -Workstation domain -User domain -LAN domain -LAN to WAN domain
LAN domain
According to NIST 800-39, what is not a valid consideration in setting up a risk management construct within an organization Framing Assess Respond Legal Compliance
Legal Compliance
Which key planning principle guides the development of a business continuity plan (BCP)? Budget for recovery operations Length of time expected before returning to normal operations Scope of the business impact analysis (BIA) Level of effort required to interview all stakeholders
Length of time expected before returning to normal operations
After developing a business impact analysis (BIA) for her organization, Maria was asked by her manager to update the BIA recommendations with a higher recovery time objective (RTO). What is the most likely reason management would argue for a higher RTO? Higher RTOs expose critical business functions (CBFs) to higher risk. Lower RTOs are technically infeasible. Lower RTOs are more expensive. Higher RTOs increase customer confidence.
Lower RTOs are more expensive.
Your team is developing a business impact analysis (BIA). You have identified the critical business functions (CBFs) and associated processes. What should you do next? -Prioritize IT asset recovery options. -Map processes to IT systems. -Identify stakeholders. -Evaluate the recovery cost of each proposed option.
Map processes to IT systems.
Some controls are identified based on the function they perform. What are the broad classes of controls based on function? -Preventative, recovery, corrective -Preventative, detective, corrective -In-place, planned, in-progress -Maintenance, continuity, disaster
Preventative, detective, corrective
__________ provide the detailed steps needed to carry out ___________. -Policies, procedures -Access controls, a disaster recovery plan -Procedures, policies -Policies, incident response
Procedures, policies
You are reviewing historical data in an attempt to identify potential threats to your business. What would not be helpful to you in this process? -Reading news articles about thefts that occurred last year in a different part of the U.S. -Understand the limitations of your network and IT architecture -Searching the Internet for stories about incidents that commonly occur in businesses like yours -Identifying past user errors to ensure training is upgraded to address these shortfalls
Reading news articles about thefts that occurred last year in a different part of the U.S.
which of the following is not true: -Once you have assessed risks and proposed countermeasures, then you then implement those solutions using a risk mitigation plan. -Risk assessments map countermeasures to threats, vulnerabilities, and the assets being protected -A risk assessment is used to identify, estimate, and prioritize risk to the operations of an organization -Risk = Threat x Vulnerability
Risk assessments map countermeasures to threats, vulnerabilities, and the assets being protected
Susan works for a U.S. investment firm that is required to be registered with the Securities and Exchange Commission. Susan is responsible for implementing access controls on the organization's database servers. Which one of the following laws must her organization comply with? Health Insurance Portability and Accountability Act (HIPAA) Family Educational Rights and Privacy Act (FERPA) General Data Protection Regulation (GDPR) Sarbanes-Oxley Act (SOX)
Sarbanes-Oxley Act (SOX)
Failover cluster is often used to protect critical system functions and data by eliminating __________. -Single Point of Failure -Nodes -Redundancy -Operational Availability
Single point of Failure
Which factor most directly affects the scope of a business impact analysis (BIA)? -Degree of organizational automation -Reliance of revenue stream on IT resources -Geographical diversity of the organization -Size of the organization
Size of the organization
An access control such as a firewall or intrusion prevention system cannot protect against which of the following? -Malicious network traffic -Social engineering -Denial of service (DoS) attack -Unknown malware attacks
Social engineering
What does the principle of least privilege have in common with the principle of need to know? -They both attempt to prevent threats from external attackers. -They both specify that users be granted access only to what they need to perform their jobs. -They are both terms for the same principle. -They both lack the ability to address threats from internal attackers.
They both specify that users be granted access only to what they need to perform their jobs.
What is the primary benefit of a business continuity plan (BCP)? To reduce the cost of recovery To better prepare the organization to respond to an interruption To reduce the probability of an interruption To inform the organization as to the expected cost of annual interruptions
To better prepare the organization to response to respond to interruption
What is the purpose of a business continuity plan (BCP)? To ensure that mission-critical elements of an organization continue to operate during and after a disruption To ensure that mission-critical elements of an organization are properly restored after a disruption To prevent loss of mission-critical activities of organization employees in case of a disruption To identify mission-critical elements of an organization in case of a disruption
To ensure that mission-critical elements of an organization continue to operate during and after a disruption
What is the purpose of a risk mitigation plan? To bolster a risk assessment To implement countermeasures To eliminate threats To ensure compliance
To implement countermeasures
What is the purpose of nonrepudiation techniques? -To ensure the proper function of controls -To grant permission to perform a vulnerability test -To prevent people from denying they took actions -To mitigate threats to a system
To prevent people from denying they took actions
A DOS attack is meant to shut down a machine or network, making it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with traffic, or sending it information that triggers a crash -True -False
True
A mission-critical system is any system that must continue to run to ensure a business continues to function. True False
True
According to NIST 800-39, risk framing component is to produce a risk management strategy. -True -False
True
According to NIST 800-39, the 3 risk management framework include Tier 1- Organizational, Tier 2 - Mission/Business Process and Tier 3 - Information Systems. -True -False
True
Based upon a 2019 General Accounting Office audit, Federal Agencies noted decentralized or federated organizations create difficulty in implementing standardized IT and effective cybersecurity programs. -True -False
True
Business Impact Analysis can identify the maximum acceptable outage, which is the maximum amount of time a system or service can be down before the mission is affected True False
True
Conduct a threat assessment before a risk assessment to better understand the context in which their cybersecurity risks exist, and to help shape risk assessment efforts on the most relevant and likely threats. -True -False
True
Criticality is usually documented in the business impact analysis (BIA) but is repeated in the business continuity plan (BCP) for the sake of clarity. True False
True
Determining which systems require 99.999 percent access and availability can be done by identifying the value of the service provided. True False
True
Even though the business impact analysis (BIA) identifies priorities, it is common to reaffirm them in a business continuity plan (BCP). True False
True
If you encounter a firewall with 500 rules, you should consider using output analysis versus process analysis -True -False
True
Protecting software assets can be accomplished by minimizing the different types of software to create standardization making it easy to push patches and manage software versions. -True -False
True
Scope creep can occur if the scope of a business continuity plan (BCP) is not defined. True False
True
Service Level Agreement dentifies an expected level of performance and often used often as a binding contract -True -False
True
Social engineering hacks are the primary risk of User Domain. -True -False
True
Starting with clear objectives is a best practice for performing a business impact analysis (BIA). True False
True
The primary shortfall of LAN-to-WAN Domain Risks is firewall shortfalls (rules, config, exploit) True False
True
The two primary terms related to Business Impact Analysis are Maximum acceptable outage (MAO), Critical business functions (CBF) and Critical success factors (CSF) True False
True
What is the primary hazard of attempting to recover without a business impact analysis (BIA)? Duplication of effort due to a lack of communication Excessive recovery time as a result of a linear recovery path Wasted effort due to a lack of direction as to which resources are most critical Budget overruns as a result of no formal spending authorization
Wasted effort due to a lack of direction as to which resources are most critical
When completing a Business Impact Analysis, which of the following is not a valid question to ask? What is the Maximum Acceptable Outage of the service? How will an outage affect employees? What are the Seven domains of the typical IT infrastructure? How does this service affect the organization's survivability?
What are the Seven domains of the typical IT infrastructure?
When an emergency is declared, the ____________ contact(s) appropriate teams or team leads. -business continuity plan (BCP) program manager -stakeholders -business continuity plan (BCP) coordinator -department heads
business continuity plan (BCP) coordinator.
Background checks, software testing, and awareness training are all categories of: -rules of behavior -procedural controls -corrective controls -technical controls.
procedural controls
The actual methods used to protect against data loss are __________ controls, but the program that identifies which data to protect is a ___________ control. -mechanical, procedural -procedural, technical -manual, technical -technical, procedural
technical, procedural
Gap analysis reports for security are often used when dealing with: -legal compliance. -incident response teams. -business process compliance. - data warehousing.
legal compliance.
Controls are meant to _________ risk, which means to reduce or neutralize threats or vulnerabilities to an acceptable level. -transfer -assess -avoid -mitigate
mitigate
Regarding business continuity, what is the first phase of activity if a disruption occurs? Planning phase The reconstitution phase The recovery phase notification and activation phase
notification and activation phase
Symmetric encryption involves the use of 2 keys to encrypt and decrypt information. -True -False
False
Which of the below would you use to create a threat model (check multiple answers)? -Evaluate MITRE ATT&CK Framework -Construct an Attack Graph -Review NIST Standards -Create a Risk Cube
-Evaluate MITRE ATT&CK Framework -Construct an Attack Graph
How are system logs different from audit trails? -System Logs record events generated by the operating system or applications whereas audit trail records events to track user activity -Audit trail is often used to diagnose issues and maintain system health -System logs are used to ensure users are following policies and regulations. -None of the above
-System Logs record events generated by the operating system or applications whereas audit trail records events to track user activity
What characteristic is common to risk assessments and threat assessments? -They are both ongoing processes -They are both automated processes -They are both performed for a specific time. -They are both manual processes
-They are both performed for a specific time.
NIST 800-53B defines "Baseline Controls" and NIST 800-53A defines Control Assessment Instructions. Which of the following are valid assessment control approaches? -Red Teaming -Audit checks -Penetration Testing -All the above
All of the above
What are benefits to implementing automation? -Value to customer -Value to company -Protecting data -All the above
All of the above
What are the reasons to implement security controls? -Compliance -Protect -Fiduciary -All of the above
All of the above
What would be good sources of data for a vulnerability assessment? -Previous firewall logs -Previous audit logs -Review Intrusion Detection System logs -All of the above
All of the above
Which of the following are considerd Technical Controls? Firewall Encryption Operating System Hardening All of the above
All of the above
How are business continuity plans (BCPs) and disaster recovery plans (DRPs) related? A DRP is a part of the larger BCP. A BCP is part of the larger DRP. The two plans are distinct and are not related. A BCP is only useful when creating a business impact analysis (BIA), while the DRP is an operational plan.
A DRP is a part of the larger BCP.
According to NIST 800-39, which of the following are outcomes of governance related to organization-wide risk management? -Strategic alignment of risk management decisions with missions and business functions consistent with organizational goals and objectives; -Effective and efficient allocation of risk management resources; -Delivered value by optimizing risk management investments in support of organizational objectives. -All the above
All of the Above
What are common questions you should ask to create a threat model ? -What systems need to be protected? -What are the potential adversaries? -How might a potential adversary conduct an attack ? -All of the above
All of the Above
What are the activities in the second step of a control assessment planning? Develop objective for the security assessment Develop the roadmap of the assessment Develop assessment procedures All the above
All of the Above
The National Institute of Standards and Technology (NIST) publishes SP 800-53. This document describes a variety of IT security controls, such as access control, incident response, and configuration management. Controls are grouped into families. Which NIST control family helps an organization recover from failures and disasters? Configuration Management (CM) Contingency Planning (CP) Identification and Authentication (IA) Physical and Environmental Protection (PE)
Contingency Planning (CP)
Which of the following is a valid action in selecting the necessary controls? Criticality Analysis Threat Asseessment Vulnerability Assessment Cost Benefit Analysis
Cost Benefit Analysis
Which of the following is not a correct step to scope the Risk Management Strategy for an Organization? Critical Business Operations Customer Service Delivery Seven Domains of IT Cost Benefit Analysis
Cost Benefit Analysis
When an emergency is declared, the ____________ contact(s) appropriate teams or team leads. business continuity plan (BCP) program manager stakeholders business continuity plan (BCP) coordinator department heads
Critical contractor
What is the difference between data mining and data warehousing? -Data mining extracts useful patterns and insights whereas data warehousing organizes large amounts of data. -Data warehousing extracts useful patterns and insights whereas data mining organizes large amounts of data. -Data warehousing and data mining are synonymous terms. -None of the above
Data mining extracts useful patterns and insights whereas data warehousing organizes large amounts of data.