Cissp - Information Security And Risk Management

Front 1

What is the purpose of functional requirements evaluation?

Back 1

Functional requirements evaluation determines if the solution carries out the required tasks.

Front 2

What is the purpose of assurance requirements evaluation?

Back 2

Assurance requirements evaluation determines the level of protection provided by this solution.

Front 3

In what order should the security concepts be evaluated?

Back 3

1. Threat
2. Exposure
3. Vulnerability
4. Countermeasures (safeguards)
5. Risk

Front 4

What are the three types (areas) of security planning

Back 4

Strategic
Tactical
Operational

Front 5

What primary activities comprise risk management?

Back 5

Risk assessment
Risk mitigation

Front 6

What underlying activity, along with risk assessment and risk mitigation, comprises risk management?

Back 6

Uncertainty analysis

Front 7

What are the goals of risk analysis?

Back 7

1. Identify assets and their values

2. Identify vulnerabilities and threats

3. Quantify the probability and business impact of these potential threats

4.Provide an economic balance between the impact of the threat and the cost of the countermeasure.

Front 8

The major objective of system configuration management is which of the following?
System maintenance
System stability
System operations
System tracking

Back 8

System stability

Front 9

The preliminary steps to security planning

Back 9

Establish objectives
List planning assumptions
Determine alternate courses of action

Front 10

The necessary steps to help protect the company and its resources from possible risks have been taken

Back 10

Due Care
(Do Correct)

Front 11

Computer security should be first and foremost ...

Back 11

cost-effective

Front 12

Activities that make sure that the protection mechanisms are continually maintained and operational

Back 12

Due Diligence
(Do Detect)

Front 13

Category of the following controls:
• Policy and procedures
• Personnel controls
• Supervisory structure
• Security-awareness training
• Testing

Back 13

Administrative

Front 14

Category of the following controls:
• Network segregation
• Perimeter security
• Computer controls
• Work area separation
• Data backups
• Cabling

Back 14

Physical

Front 15

Category of the following controls:
• System access
• Network architecture
• Network access
• Encryption and protocols
• Control zone
• Auditing

Back 15

Technical

Front 16

Examination of threat sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment

Back 16

Threat analysis

Front 17

Process of identifying the risks to system security and determining the probability of occurrence, the resulting impact, and the additional safeguards that mitigate this impact.

Back 17

Risk analysis
(risk assessment)

Front 18

Ongoing process of assessing the risk to mission/business as part of a risk-based approach used to determine adequate security for a system by analyzing the threats and vulnerabilities and selecting appropriate, cost-effective controls to achieve and maintain an acceptable level or risk.

Back 18

Risk management

Front 19

Three key things that must be considered for the planning and implementation of access control mechanisms

Back 19

Threats to the system
System's vulnerability to these threats
Risk that the threats may materialize

Front 20

Which of the following tasks may be performed by the same person:
1. System development and change management
2. System development and systems maintenance
3. Security administration and change management
4. Computer operations and system development

Back 20

System development and systems maintenance

Front 21

preventive, detective, or corrective

Back 21

Risk mitigation and risk reduction controls

Front 22

Responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of IT systems and data

Back 22

System and information owners