Deck 15: Risk Mitigation

Question 1

What is the name for a framework and corresponding functions required to enable incident response and incident handling within an organization?

A)incident reporting
B)incident management
C)incident handling
D)incident planning

Answer 1

B

Question 2

The classification designation of government documents is typically Top Secret,Secret,Unusual,Confidential,and Unclassified.

Answer 2

False

Question 3

Select the option that best describes an asset:

A)any item that is used by all employees
B)any item that is owned by an enterprise
C)any item that has a positive economic value
D)any item that is used by management

Answer 3

C

Question 4

Risk avoidance involves identifying the risk and making the decision to engage in the activity.

Question 5

A subject's privilege over an object should follow the principle of least privilege.

Question 6

Distributive allocation refers to "eliminating" the risk.

Question 7

A collection of suggestions that should be implemented is referred to as a:

A)security policy
B)baseline
C)guideline
D)security procedure

Question 8

Many cloud providers allow customers to perform penetration tests and vulnerability scans without permission and whenever is necessary.

Question 9

A physical control attempts to discourage security violations before they occur.

Question 10

What term can be described as a function of threats,consequences of those threats,and the resulting vulnerabilities?

A)threat
B)mitigation
C)risk
D)management

Question 11

A security control is any device or process that is used to reduce risk.

Question 12

Vendor-specific guides are useful for configuring web servers,operating systems,applications servers,and network infrastructure devices.

Question 13

What can be defined as the planning,coordination,and communications functions that are needed to resolve an incident in an efficient manner?

A)incident reporting
B)incident management
C)incident handling
D)incident planning

Question 14

What kind of policy defines the actions users may perform while accessing systems and networking equipment?

A)VPN access policy
B)network use policy
C)privacy use policy
D)acceptable use policy

Question 15

The FIT calculation is another way of reporting MTTF.

Question 16

A written document that states how an organization plans to protect the company's information technology assets is a:

A)security policy
B)guideline
C)security procedure
D)standard

Question 17

Due to the potential impact of changes that can affect all users in an organization,and considering that security vulnerabilities can arise from uncoordinated changes,what should an organization create to oversee changes?

A)change management team
B)incident response team
C)security control team
D)compliance team

Question 18

Assessing risk should include testing of technology assets to identify any vulnerabilities.

Question 19

Generally considered to be the most important information security policies,what item below defines the actions a user may perform while accessing systems and networking equipment?

A)acceptable use policies
B)encryption policies
C)data loss policies
D)VPN policies

Question 20

Select the option that best describes a policy:

A)A collection of requirements specific to the system or procedure that must be met by everyone
B)A collection of suggestions that should be implemented
C)A list of all items that have a positive economic value
D)A document that outlines specific requirements or rules that must be met

Question 21

Which of the following is an agreement that is intended to minimize security risks for data transmitted across a network?

A)MOU
B)SLA
C)BPA
D)ISA

Question 22

Which of the following is a basic measure of reliability for systems that cannot be repaired?

A)mean time to recovery
B)mean time to failure
C)mean time to operate
D)failure in time

Question 23

Which threat category impacts the daily business of the organization?

A)operational
B)compliance
C)strategic
D)managerial

Question 24

What type of learner tends to sit in the middle of the class and learns best through lectures and discussions?

A)visual
B)auditory
C)kinesthetic
D)spatial

Question 25

What type of control is designed to provide an alternative to normal controls that for some reason cannot be used.?

A)preventive control
B)compensating control
C)detective control
D)deterrent control

Question 26

What type of risk calculation uses an "educated guess" based on observation?

A)quantitative risk calculation
B)environmental risk calculation
C)qualitative risk calculation
D)observational risk calculation

Question 27

Which of the following refers to the start-up relationship between partners?

A)partner on-boarding
B)partner trust
C)partner beginning
D)starting partner agreement

Question 28

Which term below describes the art of helping an adult learn?

A)andragogical
B)pedagogical
C)deontological
D)metagogical

Question 29

What describes an agreement between two or more parties and demonstrates a "convergence of will" between the parties?so that they can work together?

A)MOU
B)NDA
C)BPA
D)ISA

Question 30

What term best describes the ability to continue to function as the size or volume of the enterprise data center expands to meet the growing demands?

A)adaptability
B)automation
C)flexibility
D)scalability

Question 31

What type of learner learns best through hands-on approaches?

A)visual
B)auditory
C)kinesthetic
D)spatial

Question 32

Websites that group individuals and organizations into clusters or groups based on some sort are considered to be what type of networks?

A)social media network
B)social engineering network
C)social management network
D)social control network

Question 33

What is a service contract between a vendor and a client that specifies what services will be provided,the responsibilities of each party,and any guarantees of service?

A)MOU
B)SLA
C)BPA
D)ISA

Question 34

What control is designed to identify any threat that has reached the system?

A)preventive control
B)compensating control
C)detective control
D)deterrent control

Question 35

Which of the following is considered to be a common security issue? (Choose all that apply. )

A)management issues
B)certificate issues
C)encrypted credentials
D)authentication issues

Question 36

What type of threat is a threat related to the natural surroundings of an enterprise?

A)external threat
B)environmental threat
C)internal threat
D)biological threat

Question 37

Which of the following is a network that moves a product from the supplier to the customer and is comprised of vendors that supply raw material,manufacturers who convert the material into products,warehouses that store products,distribution centers that deliver them to the retailers,and retailers who bring the product to the consumer?

A)supply chain
B)supply chain assessment
C)supply sphere
D)supply network

Question 38

Select the specific type of interview that is usually conducted when an employee leaves the company?

A)last interview
B)initial interview
C)exit interview
D)post interview

Question 39

Which threat category affects the long-term goals of the organization?

A)operational
B)compliance
C)strategic
D)managerial

Question 40

What specific type of mechanism should be utilized by all types of training to provide input from participants on the training's effectiveness so that any needed modifications can be made for future training?

A)participant feedback mechanism
B)survey feedback mechanism
C)training mechanism
D)feedback mechanism

Question 41

What are the two risk calculation formulas commonly used to calculate expected losses?

Question 42

Explain the concept of change management.

Question 43

Why should authorization be obtained for penetration testing and vulnerability testing?

Question 44

What is a security control?

Question 45

Contrast the difference between a pedagogical approach versus an andragogical approach to subject matter.

Question 46

What is a risk register?

Question 47

List and describe three of the six risk categories.

Question 48

What is mean time to recovery (MTTR)?

Question 49

What is privilege management?

Question 50

Explain how continuous monitoring can benefit an IT enterprise's operations.