Module 1 Unit 3 Part 2

Front 1

Risk assessment is a common first step in a risk management process. Risk assessment is the determination of quantitative or qualitative value of risk related to a concrete situation and a recognized threat (also called hazard). As a best practice, risk assessments should be based upon which of the following?

Back 1

A quantitative measurement of risk, impact and asset value

Front 2

A company’s new employees are asked to sign a document that describes the methods of and purposes for accessing the company’s IT systems. Which of the following BEST describes this document?

Back 2

Acceptable Use Policy

Front 3

A representative from the human resources department informs a security specialist that an employee has been terminated. Which of the following would be the BEST action to take?

Back 3

Disable the employee’s user accounts and keep the data for a specified period of time.

Front 4

According to the contractual obligation, corporation A has to provide a certain amount of system uptime to a client. This contract is an example of:

Back 4

SLA

Front 5

Documentation describing a group of expected minimum behaviors is known as:

Back 5

A code of ethics

Front 6

So as to facilitate communications in the office of a small call center business, an email system is going to be installed. As part of the upgrade, the vendor offered to supply anti-malware software of $5,000 per year. However, if it is not adequately protected, there was a 90% chance each year that workstations would be compromised. Under that circumstance, it will take 30 staff three hours to restore services and the staff members in the call center are paid $90 per hour. What is the Annual Loss Expectancy (an IT risk assessment methodology)?

Back 6

$7290

Front 7

Which description is correct about the form used while transferring evidence?

Back 7

Chain of Custody

Front 8

What should be established immediately upon evidence seizure?

Back 8

chain of Custody

Front 9

Risk assessment is the determination of quantitative or qualitative value of risk related to a concrete situation and a recognized threat. During a risk assessment of a computing system, what is the most important step to conduct?

Back 9

The identification of missing patches

Front 10

A programmer plans to change the server variable in the coding of an authentication function for a proprietary sales application. Which process should be followed before implementing the new routine on the production application server?

Back 10

change management

Front 11

Who is finally in charge of the amount of residual risk?

Back 11

The senior management

Front 12

The main objective of risk management in an organization is to reduce risk to a level:

Back 12

the organization will accept

Front 13

To preserve evidence for later use in court, which of the following needs to be documented?

Back 13

chain of custody

Front 14

Which description is correct about a tool used by organizations to verify whether or not a staff member has been involved in malicious activity?

Back 14

Mandatory vacations

Front 15

Human resource department personnel should be trained about security policy:

Back 15

guidelines and enforcement

Front 16

Sending a patch through a testing and approval process is an example of which option?

Back 16

change management

Front 17

Which of the following is not a step in the incident response process?

Back 17

repudiation

Front 18

An audit has just been performed on a company’s network. However, the IT departmental staff was not allowed to see the results. Which of the following is most probably the reason?

Back 18

Seperations of duties

Front 19

A technician is conducting a forensics analysis on a computer system. Which step should be taken FIRST?

Back 19

Get a binary copy of the system

Front 20

Which of the following is not an example of organizational policy that reduces the impact of fraud?

Back 20

password complexity rules