12-1-7 SEC-TO

A manufacturing organization identifies its server maintenance and repair process as a mission-essential function. The company experienced three server failures in the last year, each failure taking approximately six hours to repair and restore operations.

Given the company's performance metrics and assuming all failures occurred during operational hours, what are the MTBF and MTTR for the organization's server maintenance and repair process?

• MTBF: 1,000 hours/failure, MTTR: 2 hours

• MTBF: 2,000 hours/failure, MTTR: 6 hours

• MTBF: 2,920 hours/failure, MTTR: 6 hours

• MTBF: 1,460 hours/failure, MTTR: 18 hours

The security team at a company is adopting a cybersecurity framework to standardize its security measures across different departments. The team lead wants to ensure that the selected framework encompasses all the critical aspects of cybersecurity.

What should the security team lead ensure the cybersecurity framework covers to provide a comprehensive security posture?

• Procedures for incident response

• Risk assessment, incident response, access control, awareness, and training

• Threat intelligence and event correlation

• The technical controls and access management

A technology company implements a backup strategy to mitigate data loss in case of a system crash. The strategy focuses on defining the maximum duration of data to retrieve from the backup storage to ensure business continuity after a system crash.

Which principle should the company applying to meet their needs?

• Recovery time objective (RTO)

• Recovery point objective (RPO)

• Annualized loss expectancy (ALE)

• 
  

  Single loss expectancy (SLE)

You have conducted a risk analysis to protect a key company asset. You identify the following values:

• Asset value = 400

• Exposure factor = 75

• Annualized rate of occurrence = .25

What is the annualized loss expectancy (ALE)?

• 25

• 
  

  75

• 100

• 175

Tags

CCSS.HSS.MD.B.5

CCSS.HSS.MD.A.2

What is the term for the average number of times that a specific risk is likely to be realized in a single year?

• Exposure factor

• Annualized loss expectancy

• 
  

  Estimated maximum downtime

• Annualized rate of occurrence

Tags

CCSS.HSS.MD.B.5

CCSS.HSS.MD.A.2

CCSS.HSS.MD.A.3

When analyzing assets, which analysis method assigns financial values to assets?

• Quantitative

• Transfer

• Acceptance

• Qualitative

Tags

CCSS.HSS.MD.B.5

Which of the following BEST defines single loss expectancy (SLE)?

• The monetary value of a single employee's loss of productivity due to a successful attack.

• The total cost of all countermeasures associated with protecting against a given vulnerability.

• The total monetary loss associated with a single occurrence of a threat.

• The statistical probability of a malicious event.

Tags

CCSS.HSS.MD.B.5

CCSS.HSS.MD.A.2

CCSS.HSS.MD.A.3

What is the primary goal of business continuity planning (BCP)?

• Minimize decision-making during the development process.

• Maintain business operations with reduced or restricted infrastructure capabilities or resources.

• Minimize the organization's risk of service delays and interruptions.

• Protect an organization from major computer services failure.

A company wants to guarantee business continuity even if a catastrophic event occurs at its primary data center.

What are the MOST appropriate strategies for the company to adopt? (Select two.)

• Disperse locations geographically

• Deploy a hot site

• Deploy a warm site

• Implement capacity planning

• Utilize multicloud systems

During an annual review, a health services company's leadership aims to scrutinize its disaster response and data recovery protocols. They focus on effectiveness, hidden weaknesses, and clarity of employee roles during a disaster.

Which course of action would BEST serve these objectives?

• Installing larger uninterruptible power supply (UPS) systems

• Expanding the IT department

• Increasing the frequency of data backups

• Organizing tabletop exercises