Week 4 Discussion Questions

Information Assurance and Security FALL 2020 We Week eek 4: Di Dis iscu cus uss ssio ion n Qu Que uest sti tio ion ons ns Multiple-Choice Questions 1. Which formula is typically used to describe the components of information security risks? A. Risk = Likelihood X Vulnerability B. Risk = Threat X Vulnerability C. Risk = Threat X Likelihood D. Risk = Vulnerability X Cost Answer: B Reference: Defining Risk Management Explanation: The risk equation is Risk = Threat X Vulnerability. A threat is the frequency of any event. In most cases, the events in the threat equation are negative or adverse events. Vulnerability is the likelihood that a specific threat will successfully be carried out. Multiplying the probability of a threat and the likelihood of a vulnerability yields the risk of that particular event 2. Earl is preparing a risk register for his organization's risk management program. Which data element is LEAST likely to be included in a risk register? A. Description of the risk B. Expected impact C. Risk survey results D. Mitigation steps Answer: C Reference: Defining Risk Management Explanation: The risk register can contain many different types of information but should contain at a minimum: a description of the risk, the expected impact if the associated event occurs, the probability of the event occurring, steps to mitigate the 1/14 risk, steps to take should the event occur, and the rank of the risk. Risk survey results are not typically included in a risk register. 3. Alan is developing a business impact assessment for his organization. He is working with business units to determine the maximum allowable time to recover a particular function. What value is Alan determining? A. Recovery time objective (RTO) B. Recovery point objective (RPO) C. Business recovery requirements D. Technical recovery requirements Answer: A Reference: Business Impact Analysis Explanation: The RTO expresses the maximum allowable time to recover a function. Time may be a critical factor and specifying the requirements for recovery time helps determine the best recovery options. 4. Which one of the following is an example of a direct cost that might result from a business disruption? A. Damaged reputation B. Lost market share C. Lost customers D. Facility repair Answer: D Reference: Business Continuity Plan Explanation: Direct costs are immediate expenditures that reduce profit, such as the cost to repair a facility. Indirect costs, such as damaged reputation, lost market share, and lost customers, affect revenue but are harder to calculate because there is no record of an expenditure. 5. Tom is the IT manager for an organization that experienced a server failure that affected a single business function. What type of plan should guide the organization's recovery effort? 2/14 A. Disaster recovery plan (DRP) B. Business impact analysis (BIA) C. Business continuity plan (BCP) D. Service level agreement (SLA) Answer: C Reference: BCP Versus DRP: What's the Difference? Explanation: BCPs specify how an organization can recover from an interruption, as opposed to a disaster that would be covered by the DRP. In general, an interruption is a minor event that may disrupt one or more business processes for a short period. In contrast, a disaster is an event that affects multiple business processes for an extended period. Disasters often also cause substantial resource damage that you must address before you can resolve the business process interruption. 6. What is the first step in a disaster recovery effort? A. Respond to the disaster. B. Follow the disaster recovery plan (DRP). C. Communicate with all affected parties. D. Ensure that everyone is safe. Answer: D Reference: Disaster Recovery Explanation: The first critical step in a disaster recovery plan is to ensure that everyone is safe. The second step is responding to the disaster before pursuing recovery, and the final step is following the DRP, which includes communicating with all affected parties. 7. Dawn is selecting an alternative processing facility for her organization's primary data center. She would like to have a facility that balances cost and switchover time. What would be the best option in this situation? A. Hot site B. Warm site C. Cold site D. Primary site 3/14 Answer: B Reference: Disaster Recovery Explanation: A warm site balances cost and switchover time. It is less expensive than a hot site but can activate more quickly than a cold site. 8. Holly would like to run an annual major disaster recovery test that is as thorough and realistic as possible. She also wants to ensure that there is no disruption of activity at the primary site. What option is best in this scenario? A. Checklist test B. Full interruption test C. Parallel test D. Simulation test Answer: C Reference: Disaster Recovery Explanation: The parallel test evaluates the effectiveness of the disaster recovery plan (DRP) by enabling full processing capability at an alternate data center without interrupting activity at the primary data center. 9. As a follow-up to her annual testing, Holly would like to conduct quarterly disaster recovery tests that introduce as much realism as possible but do not require the use of technology resources. What type of test should Holly conduct? A. Checklist test B. Parallel test C. Simulation test D. Structured walk-through Answer: C Reference: Disaster Recovery Explanation: A simulation test is more realistic than a structured walk-through. In a simulation test, the DRP team uses role playing and follows through with as many of the effects of a simulated disaster as possible without affecting live operations. 10. Which one of the following is an example of a reactive disaster recovery control? 4/14 A. Moving to a warm site B. Disk mirroring C. Surge suppression D. Antivirus software Answer: A Reference: Disaster Recovery Explanation: The use of alternate processing facilities, such as warm sites, is a reactive control. Some parts of a disaster recovery plan (DRP) are preventive and intended to avoid the negative effects of a disaster in the first place. Preventive components of a DRP may include disk mirroring, surge suppression, and antivirus software. 11. George is the risk manager for a U.S. federal government agency. He is conducting a risk assessment for that agency's IT risk. What methodology is best suited for George's use? A. Risk Management Guide for Information Technology Systems (NIST SP800-30) B. CCTA Risk Analysis and Management Method (CRAMM) C. Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) D. ISO/IEC 27005, “Information Security Risk Management” Answer: A Reference: Assessing Risks, Threats, and Vulnerabilities Explanation: NIST SP800-30, "Risk Management Guide for Information Technology Systems," is a widely used guide for IT security assessments. It contains specific guidance for U.S. government agencies and would be the most appropriate methodology for use in a federal government setting. 12. Betsy recently assumed an information security role for a hospital located in the United States. What compliance regulation applies specifically to health care providers? A. FFIEC B. FISMA C. HIPAA D. PCI DSS 5/14 Answer: C Reference: Adhering to Compliance Laws Explanation: Health Insurance Portability and Accountability Act (HIPAA) governs the way doctors, hospitals, and other health care providers handle personal medical information. HIPAA requires that all medical records, billing, and patient information be handled in ways that maintain the patient's privacy. 13. A hospital is planning to introduce a new point-of-sale system in the cafeteria that will handle credit card transactions. Which one of the following governs the privacy of information handled by those point-of-sale terminals? A. Health Insurance Portability and Accountability Act (HIPAA) B. Payment Card Industry Data Security Standard (PCI DSS) C. Federal Information Security Management Act (FISMA) D. Federal Financial Institutions Examination Council (FFIEC) Answer: B Reference: Adhering to Compliance Laws Explanation: PCI DSS applies to all merchants and service providers who handle credit card information. 14. The Children's Online Privacy Protection Act (COPPA) restricts the collection of information online from children. What is the cutoff age for COPPA regulation? A. 11 B. 13 C. 15 D. 18 Answer: B Reference: Adhering to Compliance Laws Explanation: The COPPA Rule restricts how online information is collected from children under 13 years of age. COPPA was made effective in 2000 and gained additional consent requirements in 2013. It dictates what a website operator must include in a privacy policy, when and how to seek verifiable consent from a parent, and what responsibilities an operator has to protect children's privacy and safety online. 6/14 15. Which one of the following is the best example of an authorization control? A. Biometric device B. Digital certificate C. Access control lists D. One-time password Answer: C Reference: Keeping Private Data Confidential Explanation: Once you have authenticated a user, access controls help ensure that only authorized users can access the protected resources. Authorization controls include access control lists, intrusion prevention systems, and network traffic filters. 16. Which item in a Bring Your Own Device (BYOD) policy helps resolve intellectual property issues that may arise as the result of business use of personal devices? A. Support ownership B. Onboarding/offboarding C. Forensics D. Data ownership Answer: D Reference: BYOD Concerns Explanation: Personal data, such as contacts, pictures, or emails, is the intellectual property of the employee. Emails and all attachments are the intellectual property of the organization. This distinction must be clearly defined in a BYOD policy. 17. What is NOT a commonly used endpoint security technique? A. Full device encryption B. Network firewall C. Remote wiping D. Application control Answer: B Reference: Endpoint and Device Security 7/14 Explanation: A network firewall is not an endpoint control because it is deployed on a network connection. Full device encryption, remote wiping, and application control are all examples of endpoint device security controls. 18. What is NOT one of the three tenets of information security? A. Confidentiality B. Integrity C. Safety D. Availability Answer: C Reference: Keeping Private Data Confidential Explanation: While safety is a critical concern, it is not one of the three tenets of information security, which are confidentiality, integrity and availability. 19. What compliance regulation applies specifically to the educational records maintained by schools about students? A. Family Education Rights and Privacy Act (FERPA) B. Health Insurance Portability and Accountability Act (HIPAA) C. Federal Information Security Management Act (FISMA) D. Gramm-Leach-Bliley Act (GLBA) Answer: A Reference: Adhering to Compliance Laws Explanation: FERPA protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Under FERPA, schools must receive written permission from a parent or eligible student before releasing any information contained in a student's education record. 20. What level of technology infrastructure should you expect to find in a cold site alternative data center facility? A. Hardware and data that mirror the primary site 8/14 B. Hardware that mirrors the primary site, but no data C. Basic computer hardware D. No technology infrastructure Answer: D Reference: Disaster Recovery Explanation: A cold site provides a facility with basic environmental utilities but no technology infrastructure components. True/False Questions 1. The term risk management describes the process of identifying, assessing, prioritizing, and addressing risks. A. True B. False Answer: A Reference: Defining Risk Management Explanation: 2. The term risk methodology refers to a list of identified risks that results from the riskidentification process. A. True B. False Answer: B Reference: Defining Risk Management Explanation: Risk methodology is a description of how you will manage risk. The risk register is a list of identified risks that results from the risk-identification process. 3. The tools for conducting a risk analysis can include the documents that define, categorize, and rank risks. 9/14 A. True B. False Answer: A Reference: Defining Risk Management Explanation: 4. The recovery point objective (RPO) is the maximum amount of data loss that is acceptable. A. True B. False Answer: A Reference: Business Impact Analysis 5. The business impact analysis (BIA) identifies the resources for which a business continuity plan (BCP) is necessary. A. True B. False Answer: A Reference: Business Continuity Plan 6. Continuity of critical business functions and operations is the first priority in a wellbalanced business continuity plan (BCP). A. True B. False Answer: B Reference: Business Continuity Plan Explanation: Safety and well-being of people is the first priority in a well-balanced BCP. 10/14 7. A disaster recovery plan (DRP) directs the actions necessary to recover resources after a disaster. A. True B. False Answer: A Reference: Disaster Recovery Plan Explanation: 8. The first step in creating a comprehensive disaster recovery plan (DRP) is to document likely impact scenarios. A. True B. False Answer: B Reference: Disaster Recovery Plan Explanation: The steps involved in creating a comprehensive DRP should be completed in this order: define potential threats, document likely impact scenarios, and document the business and technical requirements to initiate the implementation phase. 9. Regarding data center alternatives for disaster recovery, a mobile site is the least expensive option but at the cost of the longest switchover time. A. True B. False Answer: B Reference: Disaster Recovery Explanation: A mobile site is very flexible, has a fairly short switchover time, and has widely varying costs based on size and capacity. A cold site is the least expensive option but at the cost of the longest switchover time, since all hardware, software, and data must be loaded at the new site. 11/14 10. Most enterprises are well prepared for a disaster should one occur. A. True B. False Answer: B Reference: Disaster Recovery Explanation: Most enterprises remain unprepared or underprepared for disaster. Despite recurrent reminders, many companies do not have a disaster recovery plan (DRP) at all. 11. A surge protector is an example of a preventative component of a disaster recovery plan (DRP). A. True B. False Answer: A Reference: Disaster Recovery Explanation: 12. A security policy is a comparison of the security controls you have in place and the controls you need in order to address all identified threats. A. True B. False Answer: B Reference: Closing the Information Security Gap Explanation: A gap analysis is a comparison of the security controls you have in place and the controls you need in order to address all identified threats. A security policy defines a risk-mitigating definition or solution for your organization 12/14 13. The Gramm-Leach-Bliley Act (GLBA) addresses information security concerns in the financial industry. A. True B. False Answer: A Reference: Adhering to Compliance Laws 14. The Government Information Security Reform Act (Security Reform Act) of 2000 focuses on management and evaluation of the security of unclassified and national security systems. A. True B. False Answer: A Reference: Adhering to Compliance Laws 15. Authentication controls include passwords and personal identification numbers (PINs). A. True B. False Answer: A Reference: Keeping Private Data Confidential 16. Authorization controls include biometric devices. A. True B. False Answer: B Reference: Keeping Private Data Confidential Explanation: Authorization controls include access control lists, physical access control, and network traffic filters. A biometric device is an authentication control. 17. In a Bring Your Own Device (BYOD) policy, the user acceptance component may 13/14 include separation of private data from business data. A. True B. False Answer: A Reference: Mobile Workers and Use of Personally Owned Devices 18. Remote wiping is a device security control that allows an organization to remotely erase data or email in the event of loss or theft of the device. A. True B. False Answer: A Reference: Endpoint and Device Security 19. Screen locks are a form of endpoint device security control. A. True B. False Answer: A Reference: Endpoint and Device Security 20. Removable storage is a software application that allows an organization to monitor and control business data on a personally owned device. A. True B. False Explanation: Mobile device management (MDM) includes a software application that allows organizations to monitor, control, data wipe, or data delete business data from a personally owned device. 14/14