Deck 14: Risk Mitigation

Question 1

What may be defined as the components required to identify, analyze, and contain an incident?

A)Vulnerability response
B)Incident response
C)Risk response
D)Threat response

Answer 1

B

Question 2

A written document that states how an organization plans to protect the company's information technology assets is a:

A)security policy
B)guideline
C)security procedure
D)standard

Answer 2

A

Question 3

What kind of policy outlines how organizations use personal information it collects?

A)VPN
B)network
C)encryption
D)privacy

Answer 3

D

Question 4

What is the name for a framework and corresponding functions required to enable incident response and incident handling within an organization?

A)Incident reporting
B)Incident management
C)Incident handling
D)Incident planning

Question 5

Due to the potential impact of changes that can affect all users in an organization, and considering that security vulnerabilities can arise from uncoordinated changes, what should an organization create to oversee changes?

A)change management team
B)incident response team
C)security control team
D)compliance team

Question 6

Generally considered to be the most important information security policies, what item below defines the actions a user may perform while accessing systems and networking equipment?

A)Acceptable use policies
B)Encryption policies
C)Data loss policies
D)VPN policies

Question 7

What are values that are attributed to a system of beliefs that help the individual distinguish right from wrong called?

A)Morals
B)Ethics
C)Standards
D)Morays

Question 8

Most organizations follow a three-phase cycle in the development and maintenance of a security policy.

Question 9

What kind of learners learn from taking notes, being at the front of the class, and watching presentations?

A)Kinesthetic
B)Auditory
C)Spatial
D)Visual

Question 10

The objective of incident management is to restore normal operations as quickly as possible with the least possible impact on either the business or the users.

Question 11

What type of learner learns best through hands-on approaches?

A)Visual
B)Auditory
C)Kinesthetic
D)Spatial

Question 12

Audits serve to verify that the security protections enacted by an organization are being followed and that corrective actions can be swiftly implemented before an attacker exploits a vulnerability.

Question 13

A person's fundamental beliefs and principals, which are used to define what is good, and how to distinguish right from wrong, are collectively called a person's:

A)Morals
B)Values
C)Ethics
D)Standards

Question 14

What can be defined as the study of what a group of people understand to be good and right behavior and how people make those judgments?

A)Values
B)Morals
C)Ethics
D)Standards

Question 15

Which term below describes the art of helping an adult learn?

A)andragogical
B)pedagogical
C)deontological
D)metagogical

Question 16

Websites that group individuals and organizations into clusters or groups based on some sort of affiliation are considered to be what type of websites?

A)social networking
B)social engineering
C)social management
D)social control

Question 17

A collection of suggestions that should be implemented are referred to as a:

A)security policy
B)baseline
C)guideline
D)security procedure

Question 18

A due process policy is a policy that defines the actions users may perform while accessing systems and networking equipment.

Question 19

Policies that include statements regarding how an employee's information technology resources will be addressed are part of a:

A)VPN policy
B)acceptable use policy
C)security-related human resource policy
D)technical policy

Question 20

The first phase of the security policy cycle involves a vulnerability assessment.

Question 21

What type of learner tends to sit in the middle of the class and learns best through lectures and discussions?

A)Visual
B)Auditory
C)Kinesthetic
D)Spatial

Question 22

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
​The expected monetary loss every time a risk occurs.

Question 23

____________________ seeks to approach changes systematically and provide the necessary documentation of the changes.

Question 24

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
Risk control type that covers the operational procedures to limit risk​

Question 25

Most people are taught using a(n) ____________________ approach.
​Matching

Question 26

A(n) ____________________ is a collection of requirements specific to the system or procedure that must be met by everyone.

Question 27

​What is the most common type of P2P network?

A)​Kazaa
B)​Bittorrent
C)​eDonkey
D)​Sneakernet

Question 28

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
A security policy that outlines how the organization uses personal information it collects.​

Question 29

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
A methodology for making modifications to a system and keeping track of those changes.​

Question 30

A(n) ____________________ is a methodical examination and review that produces a detailed report of its findings.

Question 31

Which type of network below uses a direct connection between users, and involves each device simultaneously acting as a client and a server?

A)Peer
B)Client-server
C)P2P
D)Share

Question 32

When designing a security policy, many organizations follow a standard set of ____________________.

Question 33

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
​An event that in the beginning is considered to be a risk yet turns out to not be one.

Question 34

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
The "framework" and functions required to enable incident response and incident handling within an organization.​

Question 35

What concept below is at the very heart of information security?

A)threat
B)mitigation
C)risk
D)management

Question 36

Select below the option that best describes a policy:

A)A collection of requirements specific to the system or procedure that must be met by everyone
B)A collection of suggestions that should be implemented
C)A list of all items that have a positive economic value
D)A document that outlines specific requirements or rules that must be met

Question 37

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
​A policy that defines the actions users may perform while access systems and networking equipment

Question 38

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
​A risk control type that involves using technology to control risk

Question 39

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
​A network that does not have servers, so each device simultaneously functions as both a client and a server to all other devices connected to the network.

Question 40

Matching
a. Acceptable use policy (AUP)
b. Change management
c. False negative
d. False positive
e. Operational risk control type
f. Privacy policy
g. Technical risk control type
h. Peer-to peer network
i. Single Loss Expectancy (SLE)
j. Incident management
​An event that does not appear to be a risk but actually turns out to be one.

Question 41

List two characteristics of a policy.

Question 42

What are the duties of the CMT?

Question 43

Contrast the difference between a pedagogical approach versus an andragogical approach to subject matter.

Question 44

List four attributes that should be compiled for new equipment in the change management documentation.

Question 45

What is a general security tip for using a social networking site?

Question 46

Identify two opportunities for security education and training.

Question 47

What are the typical classification designations of government documents?

Question 48

Which roles should be represented on the security policy development team?

Question 49

List one reason why social networking sites are popular with attackers.

Question 50

List and describe two of the seven risk categories.