Combined: Business Concerns and Risk Management + Identity and Access Management

Question 1

What is the acceptable level of false negatives that will be allowed in the system?

Accepted Answer

FRR

Question 2

, _____ deals with knowing who did what and when then did it.

Accepted Answer

Accounting

Question 3

With regard to _____, authentication, authorization, and accounting are separated.

Accepted Answer

Tacacs+

Question 4

•An agreement between parties to achieve one or more common objectives/ less formal than an SLA

Accepted Answer

MOU

Question 5

Protocol allows secure, token-based authorization on the Internet from web/mobile/desktop apps

Accepted Answer

OAuth

Question 6

What is the acceptable level of false positives that will be allowed in the system?

Accepted Answer

FAR

Question 7

_____ is a connectionless protocol that uses UDP.

Accepted Answer

Radius

Question 8

How much an event will cost a company on an annual basis

Accepted Answer

ALE

Question 9

Only the minimal amount of access that is needed to meet business needs should be granted

Accepted Answer

PoLP

Question 10

•Risk: The chances of something going wrong

Accepted Answer

True

Question 11

•Agreements between organizations that have interconnected IT systems

Accepted Answer

ISA

Question 12

Ensures that an employee is not solely responsible for all aspects of a job process

Accepted Answer

Separation of Duties

Question 13

_____ is who you claim to be.

Accepted Answer

Identity

Question 14

Creating of accounts that help reduce confusion in the workplace

Accepted Answer

Standard Naming Convention

Question 15

A subjective Measure

Accepted Answer

Qualitative

Question 16

With regard to multifactor authentication, _____ are an example of something you have

Accepted Answer

Smart Cards

Question 17

With regard to multifactor authentication, _____ are an example of something you are.

Accepted Answer

Biometrics

Question 18

mandatory, step-by-step instructions set by the organization

Accepted Answer

SOP

Question 19

_____ is a process by which you prove you are who you say you are.

Accepted Answer

Authentication

Question 20

Each user is assigned a set of roles that he/she can perform

Accepted Answer

RBAC

Question 21

Intended to make authentication easier in web-based sessions.

Accepted Answer

OpenID

Question 22

An object owner can decide who gets access to an object

Accepted Answer

DAC

Question 23

In the case of _____ _____, credentials are transferred across multiple systems.

Accepted Answer

SSO

Question 24

the trust relationship extended to one domain will be extended to any other [trusted] domain

Accepted Answer

Transitive Trust

Question 25

Impact: Costs associated with unrealized risk

Accepted Answer

False

Question 26

SAML stands for

Accepted Answer

Security Assertion Markup Language

Question 27

Typically only used in environments where different levels of security classifications exist

Accepted Answer

MAC

Question 28

•Clean desk policies: Sensitive information must not be left unsecured in work areas

Accepted Answer

True

Question 29

is more formal than an MOU,It is legally binding and enforceable

Accepted Answer

MOA

Question 30

Employees should be removed from appropriate groups and their accounts disabled ASAP

Accepted Answer

Off Boarding

Question 31

Uses ACLs to determine access of objects and is commonly used in Firewalls

Accepted Answer

RBAC - Role-Based Access Control

Question 32

The rate at which accept and reject error rates are equal•This is most efficient operation

Accepted Answer

CER

Question 33

is a part of a system that, if it fails, will stop the entire system from working.

Accepted Answer

SPOF

Question 34

The target time for the resumption of normal operations after an incident has occurred

Accepted Answer

MTTF

Question 35

•Provides employees with a better understanding of other parts of the business

Accepted Answer

Job Rotation

Question 36

The target time for the resumption of normal operations after an incident has occurred

Accepted Answer

RTO

Question 37

•An estimate of how often an event will occur in a year

Accepted Answer

ARO

Question 38

An Objective Measure

Accepted Answer

Quantitative

Question 39

employee/contractor/other third party agrees not to disclose confidential information

Accepted Answer

NDA

Question 40

With regard to multifactor authentication, _____ are an example of somewhere you are.

Accepted Answer

Location-Based

Question 41

•The maximum period of acceptable data loss

Accepted Answer

RPO

Question 42

A measure of how long it is expected to take before a problem/outage is resolved/repaired

Accepted Answer

MTTR

Question 43

With regard to multifactor authentication, _____ are an example of something you do

Accepted Answer

Signatures

Question 44

Establishes terms, conditions, and expectations of the business partner relationship

Accepted Answer

BPA

Question 45

•The value of a loss that can be expected from a single event

Accepted Answer

SLE

Question 46

Network authentication protocol built around a key distribution and a ticket-granting server.

Accepted Answer

Kerberos

Question 47

This outdated protocol was replaced by Kerberos but is still used as a fallback.

Accepted Answer

NTLM

Question 48

, _____ is determining what someone has access to or is allowed to do after authentication.

Accepted Answer

Authorization

Question 49

Access control based on Attributes

Accepted Answer

ABAC

Question 50

policies, protocols, and practices to manage identities across systems and organizations.

Accepted Answer

Federation

Question 51

KNOW THIS FORMULA - ALE is calculated as

Accepted Answer

SLE x ARO, SLE x ARO, SLE x ARO, SLE x ARO

Question 52

•A contractual agreement between a provider and a consumer

Accepted Answer

SLA

Combined: Business Concerns and Risk Management + Identity and Access Management

Questions 52

Combined: Business Concerns and Risk Management + Identity and Access Management

Questions 52