Quiz
IT security basics: triad, risks and human factors
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (200)
1What are the elements of the security triad?
- ACooperation, installation, and acquisition
- BConfidentiality, integrity, and availability
- CConfidence, intelligence, and assessment
- DCoordination, implementation, and authorization
2Which of the following is often the weakest link in IT security?
- AUse of computer firewalls
- BUse of passphrases
- CPeople
- DPhysical security
3True or False? Balanced security satisfies everyone.
- ATrue
- BFalse
4True or False? Moving a data center to an earthquake-free area is an example of avoiding risk.
- ATrue
- BFalse
5True or False? The intangible value of an asset is value that can be measured by cost.
- ATrue
- BFalse
6True or False? The four categories of unintentional threats are environmental, human, accidents, and failures.
- ATrue
- BFalse
7True or False? Ransomware is an attack in which criminals restrict access to an infected system and display messages to the user demanding payment to get access to their computer and/or files.
- ATrue
- BFalse
8True or False? The Department of Homeland Security (DHS) and its agencies focus on physical threats to national security, not cyberattacks.
- ATrue
- BFalse
9True or False? The principle of proportionality ensures that no single person controls all the functions of a critical process.
- ATrue
- BFalse
10True or False? Related to security policies, standards describe what should be implemented and how.
- ATrue
- BFalse
11When a fiduciary does not exercise due diligence, it can be considered:
- ANegligence
- BPower of Attorney
- CAttorney-client Privilege
- DReasonable Doubt
12True or False? A power of attorney can be given to any individual to grant certain rights.
- ATrue
- BFalse
13True of False? There is no difference between power of attorney and general power of attorney.
- ATrue
- BFalse
14Which of the following allows one person to act for another for legal issues and sometimes is used if someone becomes mentally incapacitated?
- AFiduciary responsibility
- BPower of attorney
- CAcceptable use policy
- DDue care
15When the Federal Trade Commission (FTC) was created in 1914, what was its primary goal?
- ATo prevent unfair methods of competition
- BTo protect fair trade and ensure ethical treatment of workers
- CTo stop the illegal sale of alcohol
- DTo promote consumer protection
16After risk management recommendations have been presented to management, the managers can _____ , _____ , or _____ the recommendations.
- Aaccept, ignore, or defer
- Baccept, defer, or modify
- Cmodify, reject, or pass
- Dimplement, ignore, question
17Which formula is used to determine the cost-benefit of a control, such as antivirus software?
- ALoss after control implementation - Loss before control implementation - Cost of control
- BLoss before control implementation - Loss after control implementation - Cost of control
- CLoss before control implementation - Loss after control implementation × Cost of control
- DLoss after control implementation - Loss before control implementation × Cost of control
18True or False? The findings in a risk report to management are described as cause, criteria, and effect.
- ATrue
- BFalse
19True or False? The scope identifies the boundaries of a risk management plan.
- ATrue
- BFalse
20True or False? An example of a project stakeholder is a vice president who will "own" the project upon completion.
- ATrue
- BFalse
21True or False? When using the Delphi Method of performing qualitative risk assessments, it is best to collect data in a group setting.
- ATrue
- BFalse
22True or False? Risk assessments should be scheduled on a regular basis after a control has been implemented to determine whether the control is still useful.
- ATrue
- BFalse
23True or False? A risk assessment uncertainty level indicates the lack of available resources.
- ATrue
- BFalse
24Qualitative risk assessments determine the level of risk based on the _____ and _____ of risk.
- Aimpact, dollar value
- Bprobability, impact
- Csafeguard value, probability
- Dthreat, dollar value
25True or False? All IT services and servers are equally critical.
- ATrue
- BFalse
26Threat _____ is a process used to identify possible threats on a system.
- Amodeling
- Bhunting
- Cprofiling
- Danalysis
27Which of the following is NOT something to consider when determining the value of an asset?
- APersonnel assets
- BSystem functions
- CFacilities and supplies
- DDepartmental ownership
28Which of the following is a type of control that is implemented with a written document?
- ATechnical
- BPhysical
- CPrivate
- DProcedural
29_____ value is the cost to purchase a new asset in place of an existing asset.
- ARecovery
- BReplacement
- COperational
- DOrganizational
30True or False? Change management ensures that similar systems have the same, or at least similar, configurations.
- ATrue
- BFalse
31True or False? An ISP is a group of updates, patches, and fixes that apply to specific operating systems.
- ATrue
- BFalse
32True or False? A business impact analysis (BIA) can be used to determine the impact of the loss of a specific database.
- ATrue
- BFalse
33True or False? A failover cluster provides fault tolerance for a server.
- ATrue
- BFalse
34True or False? Risk can be shared or transferred by purchasing insurance.
- ATrue
- BFalse
35Carl is a security specialist. He is updating the organization's hardware inventory in the asset management system. Which of the following would be least helpful to record?
- AA competitor's product
- BModel number
- CManufacturer
- DLocation
36You plan to perform a vulnerability assessment on your company's servers. You know that your assessment may simulate the effects of a denial of service (DoS) attack for a brief period of time. What is the most important task to complete before the assessment?
- AObtain permission from network users.
- BObtain verbal permission from the proper authority.
- CObtain written permission from the proper authority.
- DConduct user training on the effects of DoS attacks.
37True or False? A "right" grants the authority to perform an action on a system, such as to restart it.
- ATrue
- BFalse
38True or False? In a MAC flood attack, attackers send hundreds of packets to the same switch port, preventing the switch from working properly.
- ATrue
- BFalse
39Why is system testing performed?
- ATo examine output for vulnerabilities
- BTo test individual systems for vulnerabilities
- CTo check compliance with the organization's security policy
- DTo determine if vulnerabilities exist in implementation procedures
40What characteristics is common to risk assessments and threat assessments?
- AThey are both ongoing processes
- BThey are both manual processes
- CThey are both performed for a specific time
- DThey are both automated processes
41True or False? An organization with weak security practices may have to drastically change operations to meet Payment Card Industry Data Security Standard (PCI DSS) standards.
- ATrue
- BFalse
42True or False? A common problem in the System/Application Domain of a typical IT infrastructure is too many firewall rules allowing too much traffic.
- ATrue
- BFalse
43According to the Sarbanes-Oxley Act (SOX), who is an organization must verify and attest to the accuracy of financial data as a matter of legal compliance?
- AHigh-level officers
- BThe person performing assessments
- CAll accounting department employees
- DAll employees in a company with access to financial data
44Devaki is the office manager for a small medical practice in California. Part of her duties is to ensure the practice is in compliance with an relevant regulations or standards. Self-pay patients pay for services via cash, check, or payment card. Which of the following does Devaki need ot ensure compliance with?
- AHIPAA and SOX
- BCIPA and FERPA
- CHIPAA and PCI DSS
- DPCI DSS and GDPR
45The Remote Access Domain of a typical IT infrastructure allows _____ to access the ____ network.
- Aremote users, private
- Busers, common
- Cworkers, encrypted
- Dcustomers, public
46True or False? Ensuring that controls are effective is a best practice for risk mitigation security controls.
- ATrue
- BFalse
47Which of the following is not one of the three primary objectives of contols?
- AEliminate
- BDetect
- CPrevent
- DRecover
48True or False? An email signed with a digital signature provides integrity.
- ATrue
- BFalse
49True or False? Planned controls have been approved but not installed.
- ATrue
- BFalse
50True or False? Symmetric encryption uses one key.
- ATrue
- BFalse
51Your team is developing a business impact analysis (BIA). You have identified the critical business functions (CBFs) and associated processes. What should you do next?
- APrioritize IT asset recovery options.
- BMap processes to IT systems.
- CIdentify stakeholders.
- DEvaluate the recovery cost of each proposed option.
52True or False? In regards to system recovery, RPO stands for recovery policy objective.
- ATrue
- BFalse
53What are critical resources?
- AThose that are required to support cost-benefit analyses (CBAs)
- BThose that are required to support critical business functions (CBFs)
- CThose that are required to support critical success factors (CSFs)
- DThose that are required to support maximum acceptable outages (MAOs)
54True or False? The seven steps of a business impact anaylsis (BIA) are the same as the seven steps of contingency planning.
- ATrue
- BFalse
55Which of the following is not an indirect cost?
- ALost opportunities during recovery
- BCost to re-create or recover data
- CCost to regain market share
- DLoss of goodwill
56True or False? A best practice for enabling a risk mitigation plan from your risk assessment is staying within scope.
- ATrue
- BFalse
57How does a countermeasure's cost most directly impact the decision to implement it?
- ACountermeasure cost is only used for prioritization and does not impact implementation decisions.
- BCountermeasures should be chosen based on lowest cost to implement the most countermeasures based on the mitigation budget.
- CA countermeasure's cost should not consume most of the mitigation budget.
- DA countermeasure's cost should not exceed the impact if the risk to be mitigated is realized.
58Alice has completed a cost-benefit analysis (CBA) of recommended countermeasures. For a specific risk, four countermeasures have been recommended. How can Alice use the CBA to choose the countermeasure to recommend?
- AChoose the countermeasure with a positive countermeasure value.
- BChoose the countermeasure with the lowest recurring cost.
- CChoose the countermeasure with the highest projected benefits.
- DChoose the countermeasure with the highest countermeasure value.
59Which tool is most commonly used to prioritize mitigation efforts?
- APlan of action and milestones (POAM)
- BCost-benefit analysis (CBA)
- CThreat likelihood/impact matrix
- DGantt chart
60True or False? A best practice for enabling a risk mitigation plan from your risk assessment is prioritizing countermeasures.
- ATrue
- BFalse
61True or False? You can limit the scope of a business continuity plan (BCP) to just certain parts of an organization.
- ATrue
- BFalse
62True or False? All systems should be included in a business continuity plan (BCP).
- ATrue
- BFalse
63Having supplies on hand for continued production:
- Ais a best practice in the creation and implementation of a business continuity plan (BCP).
- Bmay conflict with other organizational planning principles.
- Cmay be preferable to having an organization obtain parts and supplies as needed.
- Dis the definition of a just-in-time philosophy.
64What is the primary benefit of a business continuity plan (BCP)?
- ATo reduce the probability of an interruption
- BTo inform the organization as to the expected cost of annual interruptions
- CTo reduce the cost of recovery
- DTo better prepare the organization to respond to an interruption
65True or False? Regarding business continuity, recovery planning often takes the format of a business impact analysis (BIA).
- ATrue
- BFalse
66True or False? Electronic vaulting is a method that transfers backup data to an off-site location.
- ATrue
- BFalse
67True or False? A disaster recovery plan (DRP) reduces risk by reducing the impact of disasters.
- ATrue
- BFalse
68True or False? In virtualization, each virtual server runs on the network just as if it were a physical server.
- ATrue
- BFalse
69True or False? Ensuring business impact analyses (BIAs) have been completed is a best practice when implementing a DRP.
- ATrue
- BFalse
70What is the primary purpose off a disaster recovery plan (DRP)?
- ATo protect critical business processes from interruption
- BTo specify prioritized processes necessary to maintain business continuity
- CTo restore critical business processes or systems to operation
- DTo define critical business processes to a business's operation
71True or False? The first section of a qualitative Risk Analysis attempts to prioritize risk. The second section of Qualitative Risk Analysis evaluates the effectiveness of controls
- ATrue
- BFalse
72True or False? Exploited vulnerabilities result in losses.
- ATrue
- BFalse
73True or False? Hardening a server makes the server more secure.
- ATrue
- BFalse
74True or False? Hardening the server to the combination of all steps that it takes to protect a vulnerable system and make it more secure than the default installation.
- ATrue
- BFalse
75What is NOT a classification of data?
- Aprivate
- Bproprietary
- Cpublic
- Drisk
76Companies use risk management techniques to differentiate ____ from ____ ?
- Avulnerabilities, threats
- Bvulnerabilities, weaknesses
- Csevere risks, minor risks
- Dcosts, benefits
77True or False? Making a system more secure often makes it easier to use.
- ATrue
- BFalse
78What is NOT a benefit of a qualitative risk analysis?
- Auses the opinions of experts
- Bis easy to complete
- Cuses words that are easy to express and understand
- Dincludes a CBA
79True or False? Performing Risk Assessment separately for each division makes implementing recommendations easier.
- ATrue
- BFalse
80A(n) _____ is performed to identify the most serious risks, help you manage risks, and identify the best methods to control risks.
- ARA
- BPOAM
- CCBA
- DSOX
81Risk likelihood calculation = which of the following?
- AThreat x Vulnerability
- BVulnerability x Exploit
- CExploit x Threat
- DThreat/Vulnerability
82_____ is the negative result if the risk occurs.
- Avalue
- Brisk
- Cimpact
- Dprobability
83True or False? The internal LAN is always considered a trusted zone.
- ATrue
- BFalse
84When a threat exploits a vulnerability, it results in a(n) _____ .
- Acrime
- Bbreach
- Cliability
- Dcountermeasure
85Identify the true statement.
- AExploited vulnerabilities result in losses.
- BThe method used to take advantage of a vulnerability is known as a threat.
- CVulnerability is a synonym for loss.
- DAll vulnerabilities result in losses.
86Which of these is NOT true?
- AEvery threat must map to at least one vulnerability
- BA threat can match to multiple vulnerabilities
- CSome threats will not map to vulnerabilities
- DMultiple threats can map to a single vulnerability
87True or False? RAs are simpler to complete than risk management plans, because risk management plans are continuous processes while RAs are simple point-in-time documents that can easily be completed in a single sitting.
- ATrue
- BFalse
88True or False? A Risk Assessment team should focus both on critical areas and on what management might consider important.
- ATrue
- BFalse
89True or False? Safeguards are also known as controls.
- ATrue
- BFalse
90Once the Risk Assessment is complete, the next step is what?
- AConduct a postmortem to look for opportunities to improve the process.
- BFollow up on detailed recommendations to ensure they are implemented.
- CEnsure buy-in from all key stakeholders.
- DProperly file the work product before moving on to the next project.
91True or False? The more data you store, the more valuable that collection of data becomes.
- ATrue
- BFalse
92All of the following are reasons to perform risk assessments except?
- AIt enables us to determine a proper security budget
- BIt enables us to determine what controls or safeguards should be in place
- CIt enables us to determine what assets need protection
- DIt enables us to determine which risk assessment framework we should be using
- EIt enables us to determine what assets are high-risk assets
93When risk is reduced to an acceptable level, the remaining risk is referred to as _____ .
- Alow-impact risk
- Bacceptable risk
- Cremaining risk
- Dresidual risk
94Data is often an organization's most valuable information asset, sensitive data needs to be protected in which states?
- AData in Transit
- BData in Process
- CData in Binary
- DData at Rest
95You run a bank and wish to update your physical security at each branch of your bank and to update the technological security of the bank's private financial data. What is the best way to determine whether physical security or technological security has a higher priority of protection?
- APOAMs
- BCBAs
- CRAs
- DCVEs
96What is a major type of vulnerability for users?
- Afirmware
- Bdatabase relations
- Csocial engineering
- Dnatural disasters
97Which of the following is a Risk Severity calculation?
- Avulnerability / threat
- Bthreat x impact
- Cthreat x vulnerability x impact
- Dthreat / vulnerability x uncertainty
98A(n) _____ is a common type of attack to deny service don internet-facing servers.
- ASQL injection
- BDDOS
- CDMZ
- Ddatabase server
99True or False? Asset valuation is NOT a major priority of risk management.
- ATrue
- BFalse
100True or False? The ultimate goal in risk management is to protect the organization.
- ATrue
- BFalse
101True or False? It is essential that risk management be driven by the potential for worst-case scenarios.
- ATrue
- BFalse
102True or False? Every threat must map to at least one vulnerability.
- ATrue
- BFalse
103True or False? More data always improves the risk analysis.
- ATrue
- BFalse
104True or False? Because the United States Computer Emergency Readiness Team (US-CERT) is run within the Department of Homeland Security (DHS), US-CERT information is classified and unavailable to the public.
- ATrue
- BFalse
105True or False? The purpose of the Payment Card Industry Data Security Standard (PCI DSS) is to regulate creditors.
- ATrue
- BFalse
106True or False? A database server is an example of a critical area for a risk assessment.
- ATrue
- BFalse
107Carl is a security professional preparing to perform a risk assessment on database servers. He is reviewing the findings of a previous risk assessment. He is trying to determine which controls should be in place but were not implemented. Which of the following is typically found in a risk assessment report and would address Carl's needs?
- AUnapproved recommendations
- BCurrent status of accepted recommendations
- CTimeline of the previous risk assessment
- DRecommendations
108Which of the following refer(s) to when users or customers need a system or service?
- AFailover
- BThe C-I-A triad
- CFive Nines
- DSystem access and availability
109When performing threat assessments, it's important to ensure you understand the system or application you are evaluating. To understand a given system or application, you need to understand all of the following, except:
- Awhere a system is manufactured.
- Bwhat systems are involved.
- Chow data flows out of systems.
- Dhow data flows into systems.
110True or False? The National Institute of Standards and Technology (NIST) publishes publications that document security best practices.
- ATrue
- BFalse
111True or False? A service level agreement (SLA) often includes the minimum uptime or the maximum downtime of a service or system.
- ATrue
- BFalse
112True or False? The maximum age of a password policy identifies when the password must be changed.
- ATrue
- BFalse
113True or False? A business impact analysis (BIA) is intended to include all IT functions.
- ATrue
- BFalse
114What is the primary goal of an informational security program?
- ATo eliminate losses related to employee actions
- BTo eliminate losses related to risk
- CTo reduce losses related to residual risk
- DTo reduce losses related to loss of confidentiality, integrity, and availability
115Which of the following is a goal of risk management?
- ATo identify the correct cost balance between risk and controls
- BTo eliminate risk by implementing controls
- CTo eliminate the loss associated with risk
- DTo calculate value associated with residual risk
116What can be done to manage risk? (select three)
- AAccept it
- BTransfer it
- CAvoid it
- DMigrate it
117After controls to minimize risks in the environment have been applied, what is the remaining risk called?
- ARemaining risk
- BMitigated risk
- CManaged risk
- DResidual risk
118Who is ultimately responsible for losses resulting from residual risk?
- AEnd users
- BTechnical staff
- CSenior managers
- DSecurity personnel
119In which of the following domains does the IT infrastructure link to a wide area network (WAN) and the Internet?
- ASystems/Applications Domain
- BWAN Domain
- CLAN-to-WAN Domain
- DLAN Domain
120True or False? Regarding the security triad, integrity is ensuring data or an IT system is not modified or destroyed.
- ATrue
- BFalse
121Isabella works as a risk specialist for her company. She wants to determine which risks should be managed and which should not by applying a test to each risk. Risks that don't meet the test are accepted. What type of test does she apply?
- ACost assessment
- BControl test
- CVulnerability test
- DReasonableness test
122_____ are acts that are hostile to an organization.
- AIntentional threats
- BHuman threats
- CUnintentional threats
- DAll threats
123True or False? Related to security policies, standards describe what should be implemented and how.
- ATrue
- BFalse
124Which of the following is best described as attackers who focus on a specific target, have high levels of expertise, have almost unlimited resources, and are often sponsored by nation-states or terrorist groups?
- AVandals
- BAdvanced Persistent Threats (APTs)
- CSaboteurs
- DDisgruntled employees
125A _____ policy governs how patches are understood, tested and rolled out to systems and clients.
- Apatch management
- Bpatch mitigation
- Cversion control
- Dconfiguration management
126What is the function of job rotation?
- Ato ensure no person control an entire process
- Bto prevent or reduce fraudulent activity
- Cto define acceptable use for IT systems and data
- Dto determine who should get a promotion
127Which of the following is a law that ensures that federal agencies protect their systems and data, comply with all elements of the law, and integrate security in all processes?
- AFederal Information Security Modernization Act (FISMA)
- BHealth Insurance Portability and Accountability Act (HIPAA)
- CChildren's Internet Protection Act (CIPA)
- DFamily Educational Rights and Privacy Act (FERPA)
128True or False? Information Technology Infrastructure Library (ITIL) publishes proven, generally accepted practices for IT.
- ATrue
- BFalse
129True or False? Regarding vulnerability analysis, process analysis and out analysis are essentially the same activity.
- ATrue
- BFalse
130True or False? One way to identify controls is to identify critical business functions and critical business operations.
- ATrue
- BFalse
131Another term for data range and reasonableness checks is:
- ABuffer overflow validation
- BInput validation
- CDatabase validation
- DOutput validation
132What is the purpose of nonrepudiation techniques?
- ATo mitigate threats to a system
- BTo grant permission to perform a vulnerability
- CTo ensure the proper function of controls
- DTo prevent people from denying they took actions
133Background checks, software testing, and awareness training are all categories of:
- AProcedural controls
- BRules of behavior
- CTechnical controls
- DCorrective controls
134What should be used to ensure that users are granted only the rights to perform actions required for their jobs?
- Aprinciple of least privilege
- Bprinciple of need to know
- Cprinciple of limited rights
- Dseparation of duties
135Which of the following security principles divides job responsibilities to reduce fraud?
- Aneed to know
- Bleast privilege
- Cseparation of duties
- Dmandatory vacations
136What can be used to ensure that unauthorized changes are not made to systems?
- Ainput validation
- Bpatch management
- Cversion control
- Dconfiguration management
137What are two types of intrusion detection systems?
- Aintentional and unintentional
- Bnatural and man-made
- Chost based and network based
- Dtechnical and physical
138What allows an attacker to gain additional privileges on a system by sending unexpected code to the system?
- ABuffer overflow
- BMAC flood
- Cinput validation
- Dspiders
139What is hardening a server?
- Asecuring it from the default configuration
- Bensuring it cannot be powered down
- Clocking it in a room that is hard to access
- Denabling necessary protocols and services
140Which of the following steps could be taken to hard a server?
- Aremoving unnecessary services and protocols
- Bkeeping the server up to date
- Cchanging defaults
- Denabling local firewalls
- Eall of the above
141Which U.S. government agency regularly publishes alerts and bulletins related to security threats?
- ANIST
- BFBI
- CUS-CERT
- DMITRE Corporation
142FISMA requires federal agencies to protect IT systems and data. How often can compliance be audited by an external organization?
- Anever
- Bquarterly
- Cannually
- Devery three years
143What are the valid contents of a risk management plan?
- Aobjectives
- Bscope
- Crecommendations
- DPOAM
- Eall of the above
144What should be included in the objectives of a risk management plan?
- Aa list of threats
- Ba list of vulnerabilities
- Ccosts associated with risks
- Dcost-benefit analysis
- Eall of the above
145A risk management plan includes steps to mitigate risks. Who is responsible for choosing what steps to implement?
- Athe project manager
- Bmanagement
- Cthe risk management team
- Dthe POAM manager
146A risk management plan includes a list of findings in a report. The findings identify threats and vulnerabilities. What type of diagram can document some of the findings?
- AGantt chart
- Bcritical path chart
- CPOAM diagram
- Dcause and effect diagram
147What three elements should be included in the findings of the risk management report?
- Acauses, criteria, and effects
- Bthreats, causes, and effects
- Ccriteria, vulnerabilities, and effects
- Dcauses, criteria, and milestones
148What is a primary tool used to identify the financial significance of a mitigation tool?
- AIshikawa diagram
- Bfishbone diagram
- CCBA
- DPOAM
149A fishbone diagram is also known as a(n):
- Arisk management framework
- Bprogram management tool
- CIshikawa diagram
- DNIST core plan
150What is the NIST Risk Management Framework?
- Athe planning phase of the systems life cycle
- Ba process that combines security and risk management as part of a systems development life cycle
- Ca record of project milestones
- DPOAM
151A POAM is used to track the progress of a project. What type of chart is commonly used to assist with tracking?
- Afishbones chart
- Bcause and effect chart
- CGantt chart
- DPOAM chart
152One of the challenges facing risk assessments is getting accurate data. What can be included in the risk assessment report to give an indication of the reliability of the data?
- Aprobability statement
- Baccuracy scale
- Cvalidity level
- Duncertainty level
153A company is beginning a risk assessment for a system. Both the _____ characteristics and the mission of the system should be defined in the early stages of the risk assessment.
- Atactical
- Bstrategic
- Coperational
- Dvisionary
154Which of the following should be identified during a risk assessment?
- Aassets
- Bthreats
- Cvulnerabilities
- Dcontrols
- Eall of the above
155Which type of assessment can be performed to identify weaknesses in a system without exploiting the weaknesses?
- Avulnerability assessment
- Brisk assessment
- Cexploit assessment
- Dpenetration test
156Which of the following should be matched with a control to mitigate a relevant risk?
- Athreats
- Bvulnerabilities
- Cthreats / vulnerability pair
- Dresidual risk
157Who should perform vulnerability assessments?
- Ainternal security professionals working as employees
- Bexternal security professionals hired as consultants
- Ceither internal or external security professionals or both
- Donly the IT personnel who own the systems
158An organization is governed by HIPAA and wants to know whether it is in compliance. What would document the differences between what is required and what is currently implemented?
- Agap analysis
- Bvulnerability assessment
- Cthreat assessment
- Dpenetration test
159True or False? Controls can be identified based on their function. The functions are preventive, detective, and corrective.
- ATrue
- BFalse
160What are the primary objectives of a control?
- Aprevent, control, and attack
- Bprevent, respond, and log
- Cprevent, recover, and detect
- Ddetect, recover, and attack
161What types of control is an Intrusion Detection System (IDS)?
- Apreventive
- Bdetective
- Ccorrective
- Drecovery
162What should be used to ensure that users understand what they can and cannot do on systems within the network?
- Aacceptable use banner
- Bdata range checks
- Crules of behavior
- Daudit trails
163What can be used to to ensure confidentiality of sensitive data?
- Aencryption
- Bhashing
- Cdigital signature
- Dnonrepudiation
164What would be used to identify mission-critical systems?
- Acritical outage times
- Bcritical business functions
- CPCI DSS review
- Ddisaster recovery plan
165Which of the following strategies helps reduce security gaps even if a security control fails?
- Aaccess control implementation
- Bcritical business factor analysis
- Cdefense in depth
- Dbusiness impact analysis
166What could a password policy include?
- Alength of password
- Blist of required passwords
- Cuser profiles
- Dall of the above
167A countermeasure is being reviewed to be added to the mitigation plan. What costs should be considered?
- Ainitial purchase costs
- Bfacility costs
- Cinstallation costs
- Dtraining costs
- Eall of the above
168Which of the following items are considered facility costs for the implementation of a countermeasure?
- Ainstallation and air-conditioning
- Binstallation and training
- Cpower and air-conditioning
- Dpower and training
169What's a reasonable amount of time for an account management policy to be completed and approved?
- Atwenty minutes
- Bone day
- Cone month
- Done year
170A risk assessment was completed three months ago and has recently been approved. What should be done first to implement a mitigation plan?
- Averify risk elements
- Bpurchase countermeasures
- Credo risk assessments
- Dredo the CBA
171Which of the following can determine what functions are considered critical business functions?
- Aclients
- Bstakeholders
- Cproject team
- Dchief technology officer
172In a BIA (Business Impact Analysis), maximum amount of data loss an organization can accept is called what?
- ABIA time
- Bmaximum acceptable outage
- Crecovery time objectives
- Drecovery point objectives
173What is the time required for a system to be recovered called?
- ABIA time
- Bmaximum acceptable outage
- Crecovery time objectives
- Drecovery point objectives
174In a BIA, which of the following is a direct cost of the impact of an outage for a specific system?
- Aloss of customers
- Bloss of public goodwill
- Closs of sales
- Dlost opportunities
175What type of approach does a BIA use?
- Abottom-up approach in which servers or services are examined first
- Btop-down approach in which CBFs are examined first
- Cmiddle-tier approach
- Dbest-guess approach
176Mission-critical business functions are considered vital to an organization. What are they derived from?
- Acritical success factors
- Bcritical IT resources
- Cexecutive leadership
- Demployees
177In developing a BIA (Business Impact Analysis), what should the critical business functions be mapped to?
- Apersonnel
- Brevenue
- Creplacement costs
- DIT systems
178What is the purpose of a BCP (Business Continuity Plan)?
- Ato identify CBFs
- Bto reduce or eliminate threats
- Cto ensure mission-critical elements of an organization continue to operate after a disruption
- Dall of the above
179What are the three phases of a BCP?
- Anotification and activation, transfer, and recovery
- Bnotification and activation, recovery, and reconstitution
- Crecovery, renewal, and reconstitution
- Dtransfer, recovery, and notification
180A business impact analysis (BIA) includes a maximum acceptable outage (MAO), the MAO is used to determine the amount of time in which a system must be recovered. What term is used in the DRP instead of the MAO?
- Acritical business function (CBF)
- BDRP action item (DRPAI)
- CRecovery Action Item (RAI)
- DRecovery Time Objectives (RTO)
181A certain DRP covers a system that hosts a large database. To ensure that the data is copied to an off-site location, what could be used?
- Adata replication
- Belectronic vaulting
- Cremote journaling
- Dall of the above
182An alternate location is being considered for a DRP, and the costs need to be minimized. What type of site would be chosen?
- Acold site
- Bwarm site
- Chot site
- Dmobile site
183An alternate location is being considered for DRP, and it must be brought online as quickly as possible. What type of site would be chosen?
- Acold site
- Bwarm site
- Chot site
- DDRP site
184An alternative location is being considered for a DRP, and it needs to be a business location that is already running noncritical business functions. This location has most of the equipment needed. What type of site is this?
- Acold site
- Bwarm site
- Chot site
- DDRP site
185A hot site is being considered as an alternate location. Various technologies are also being considered to keep the data updated and decrease the time that will be necessary for the hot site to become operational. What are some technologies that may help?
- Adata replication
- Bcloud computing
- Cvirtualization
- Dall of the above
- EA and B only
186Of the following, what is critical for any DRP?
- Athird-party backup software
- Bbudget
- Calternate locations
- Dfuel for generators
187An organization has created a DRP, but it hasn't been tested. Which of the following methods can be used to test it?
- Adesktop testing
- Bsimulation testing
- Cfull-blown DRP testing
- Dall of the above
188True or False? Once a DRP has been created, it doesn't need to be updated.
- ATrue
- BFalse
189True or False? Recovery time objectives (RTOs) identify when a system must be recovered to avoid unacceptable business consequences.
- ATrue
- BFalse
190True or False? One of the benefits of testing a disaster recovery plan (DRP) is that it will give accurate time frame for recovery.
- ATrue
- BFalse
191Which of the following is the most important consideration of a disaster recovery plan (DRP)?
- Aprotecting personnel
- Brestoring operations
- Cminimizing IT infrastructure damage
- Densuring continuity of business operations
192Which of the following is not a way that you can measure the value of a system when determining if the system requires five nines?
- Adirect revenue
- Bproductivity
- Cconfidentiality
- Dindirect revenue
193Another term for data range and reasonableness checks is:
- Ainput validation
- Bbuffer overflow validation
- Coutput validation
- Ddatabase validation
194True or False? How an organization starts its risk mitigation process depends entirely on upper management preference.
- ATrue
- BFalse
195True or False? A Cost-Benefit Analysis (CBA) helps determine if a countermeasure should be used.
- ATrue
- BFalse
196True or False? The scope of a business impact analysis (BIA) for any size organization must include the entire organization.
- ATrue
- BFalse
197True or False? Remote journaling is a method that transfers backup data to an off-site location.
- ATrue
- BFalse
198Regarding business continuity, what is the first phase of activity if a disruption occurs?
- APlanning phase
- BThe reconstitution phase
- CThe recovery phase
- DThe notification and activation phase
199True or False? Regarding business continuity, recover planning often takes the format of a business impact analysis (BIA).
- ATrue
- BFalse
200True or False? The Business Continuity Plan (BCP) technical recovery team needs to be very familiar with existing disaster recovery plans (DRPs) and may have even authored them.
- ATrue
- BFalse
Information
- Description
- Quiz on Untitled, created by Jamey Cendana on 16/06/2024.
- Author
- Jamey Cendana
- Language
- English
- Views
- 3
- Tags
- Rating
- No ratings yet Rate this quiz