stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Unit 12 & 13 SYS8 Flashcards | StudBud
Explore
/
Unit 12 & 13 SYS8
Unit 12 & 13 SYS8
38 terms
·
StudBud Administration
·
6 plays
Imported from external platform
Flashcards
38 cards
F
Practice quiz
P
Host live
L
Questions
38
Answers
1
What should a cybersecurity framework cover to provide comprehensive security?
Technical controls and access management
Threat intelligence and event correlation
Procedures for incident response
Risk assessment, incident response, access control
2
What can an organization use to monitor and restrict the copying of tagged data in corporate email accounts?
security content automation protocol
SNMP trap
antivirus
data loss prevention
3
Which type of assessment provides a broad evaluation of an organization's overall performance and specific focus areas?
internal audit committee
internal compliance assessment
self-assessment
external assessment
4
What are the MOST appropriate strategies to guarantee business continuity in case of a catastrophic event?
Implement capacity planning
Deploy a warm site
Utilize multicloud systems
Disperse locations geographically
5
What is the MOST appropriate measure to maintain and oversee data privacy and security controls?
Outsourcing security operations
Establishing an audit committee
Conducting a self-assessment
Implementing a security awareness program
6
What is the type of data that can easily be understood without additional processing?
Non-human-readable data
Human-readable data
Regulated data
Trade secrets
7
Which analysis method assigns financial values to assets when analyzing them?
Transfer
Acceptance
Quantitative
Qualitative
8
What type of agreement limits asset-loss liability?
Disaster Support Agreement
Bandwidth Contract
Legal Contract
Liability Contract
9
What term describes the process of reviewing log files for suspicious activity and threshold compliance?
compsec
phishing
scanning
auditing
10
What should the chief procurement officer do when considering a new vendor?
Negotiate lower prices
Conduct supply chain analysis
Proceed with the vendor
Reject the vendor
11
Which assessment approach is best for evaluating internal controls and identifying noncompliance or risk areas?
regulatory assessment
self-assessment
audit committee
compliance assessment
12
Is human-readable data easily understood without additional processing?
False
True
13
What is the most important concern when removable media is no longer needed in a high-security environment?
Purging
Destruction
Reuse
Labeling
14
What type of agreement meets the needs of two technology firms working together?
MOU
MOA
NDA
BPA
15
How can data on hard disks be made unrecoverable when disposing of a computer or selling used hardware?
Reformat all hard disks
Encrypt all data
Damage hard disks
Delete all files
16
Which policy outlines procedures for identifying, investigating, controlling, and mitigating incidents?
Incident response policy
Change management policy
Acceptable use policy (AUP)
Disaster recovery policy
17
What is the lowest level of classified military information?
Secret
Sensitive But Unclassified
Confidential
Unclassified
18
Which policy can prevent data theft due to social engineering?
standard operating procedure
non-disclosure agreement
fair use
clean desk
19
What level of influence does the GDPR have regarding legal implications?
Global
Regional
Local
National
20
Which policy is most suitable for preventing malware infections caused by downloading unverified software?
disaster recovery policy
change management policy
acceptable use policy
business continuity and COOP
21
What course of action would BEST serve the objectives of scrutinizing disaster response and data recovery protocols?
Installing larger UPS systems
Expanding the IT department
Increasing data backups
Organizing tabletop exercises
22
What is the annualized loss expectancy (ALE) for a key company asset with given values?
25
75
100
175
23
What should be done if a rules of engagement (RoE) document does not specify timeframes for a penetration test?
Reject the RoE and refuse
Decide timeframes yourself
Engage in discussion to clarify
Proceed at your convenience
24
What strategy should a financial institution employ to ensure data on old servers stays irretrievable?
Leave data on servers
Physically destroy servers
Use basic method of overwriting
Carry out sanitization process
25
What type of consequence does an organization suffer when a counterfeit version of its product is being sold?
IP theft
Reputation damage
Escalation
Fines
26
What is the least reliable means of cleaning or purging media?
OS low-level formatting
Drive controller hardware-level formatting
Overwriting every sector with alternating 1s and 0s
Degaussing
27
What IT security areas should an offboarding process focus on?
Asset allocation, Account management, Acceptable use
Personal assets, Company assets, Acceptable use
Asset allocation, Account management, Clean desk
Physical security
28
Is a non-disclosure agreement (NDA) included in the contract with the cloud service provider?
False
True
29
What is the definition of single loss expectancy (SLE)?
Total cost of countermeasures
Statistical probability of a malicious event
Total monetary loss
Monetary value of employee's loss of productivity
30
Is server maintenance and repair a mission-essential function?
True
False
31
What is the term for the average amount of times a specific risk occurs in a year?
annualized risk
annualized rate
annual loss
occurrence rate
32
What are the MTBF and MTTR for the server maintenance and repair process?
1,000 hours, 2 hours
2,000 hours, 6 hours
1,460 hours, 18 hours
2,920 hours, 6 hours
33
What classification suits a healthcare provider's database containing personal health information?
Critical
Regulated
Nonsensitive
Public
34
What is true concerning internal audits?
The process is very formal.
The auditor works independently.
They are always highly rigorous.
They are generally nonobjective.
35
What approach would be the most effective in ensuring the effectiveness and compliance of a new security control system?
Both internal and external
Self-assessment by the team
External assessment only
Internal assessment only
36
Is the annualized rate of occurrence the term for the average number of times a risk is realized in a year?
False
True
37
Does the cybersecurity framework cover all critical aspects of cybersecurity?
True
False
38
What document gives the investigator the authority to audit files on the network?
Forensic reports
Supply chain analysis
Checksums
Right-to-audit clause
