CO2521 Revision Part 2

Define and explain any TWO components of the CIA triad.

Match the following quantitative risk assessment terminologies

• It is a monetary value that represents the cost of a single loss event.

• Exposure Factor

• A numerical value that represents the number of times a risk event is expected to occur in a year.

• Single Loss Expectance

• A numerical value that represents the proportion of asset value that would be lost in an attack.

• Annualized Loss Expectancy

• The expected financial loss that an organization would incur in a year from a particular risk.

• Annual Rate of Occurrence

​ (a)   = ​ (b)   x Exposure Factor

• Single Loss Expectancy
• Asset Value
• Occurrence
• Risk
• Annual Rate of Occurrence

Answer explanation

Single Loss Expectancy = AV x EF

​ (a)   is the practice of concealing the existence of a message within another seemingly innocent message or cover medium.

​ (b)   is focused on securing the content of a message by transforming it so that only the intended recipient can understand it,

• Steganography
• Cryptography

Which of these is NOT a characteristic of hash algorithms?

• Unique

• Secure

• Fixed-size

• Fast

Which of these would NOT be part of the architecture description?

• system requirements

• functionality

• behaviour

• risk

Which of these IS a function of Security Controls?

• Risk Management: It is designed to mitigate risks and reduce the impact of security incidents.

• Business Operations: such as supply chain management systems

• Human Resource Management:such as hiring, training, and performance management

• Financial management: the management of an organisation's financial resources, including planning and budgeting,

Label the missing stages of the Electronic Discovery Reference Model.

d

c

b

a

Identification

Preservation

Analysis

Presentation

Answer explanation

An attacker who is able to exploit a buffer overflow vulnerability can gain a number of benefits, including:

Arbitrary code execution

Denial of Service (DoS)

Information disclosure

Privilege escalation