Sec+ 701 Domain 5 Quiz

Match the policies/documents with the correct definition.

• DRP

• Document that an employee signs before touching any IT asset at our company.

• IRP

• A step-by-step guide that shows us how to respond to specific incidents.

• Playbook

• Plan we use to respond to someone attacking us.

• AUP

• Plan we use to respond to natural disasters.

• BCP

• Plan we use to ensure we maintain operational availability.

Match the following terms.

• Least Privilege

• A policy that detects and prevents fraud by splitting up duties in sensitive processes.

• Change Management

• A policy that ensures all employees only get the accesses and permissions they need to do their job.

• Job Rotation

• A policy that ensures we train employees across multiple positions - helping us detect fraud.

• Separation of Duties

• An organization that provides standards for basic security hygiene.

• NIST

• A process that we use in our organization to implement modifications to processes and procedures.

Match the development terms.

• Static

• Analysis performed on code at a stand-still.

• Dynamic

• Analysis performed on code while a program is running.

• SDLC

• Software model that can only go forward.

• Agile

• Software model that can go forward and backward.

• Waterfall

• Process we use to properly create software.

Match the following

• Version Control System

• A process that allows us to integrate and deploy code faster.

• Fuzzing

• A software tool that will track changes and revisions in a software version.

• Dead Code

• A tool we use to inject random input into a program for testing.

• CI/CD

• A place where we can store different versions of our code.

• Code Repository

• Code in a program that does not execute when the program runs.

Match the following laws.

• ISO 27001

• Standard that requires a company to handle PII data in a private manner.

• ISO 27002

• Law that requires a company to handle credit card/debit card data in secure way.

• ISO 27701

• The "Right to be forgotten" law that observes the privacy of a persons right to be removed from the internet.

• PCI DSS

• Requires a company to set up an ISMS if they deal with infosec.

• GDPR

• Supporting document that provides security controls to help set up an ISMS.

Match the following compliance terms.

• Data Retention

• A term that defines a length of time in which a government entity has directed we must keep data for.

• Fines

• Term that tells a company they must adhere to laws int he geographical area in which it operates.

• Reputation Damage

• The biggest concern of noncompliance.

• Data Sovereignty

• The most common result of noncompliance.

• Due Diligence

• The requirement for a company to conduct their own research on applicable laws and regulations.

Match the following data governance terms.

• Data Custodian

• Person in company responsible for making sure our data policies meet regulatory law.

• Data Protection Officer

• Person in a company responsible for creating policies about how we handle data.

• Data Processor

• Person in company who keeps a complete inventory of all data.

• Data Owner

• Department in company that maintains the infrastructure that houses any data.

• Data Controller

• Person in company who directly handles the data and enforces data policy.

Match the following risk terms.

• Quantitative Risk Assessment

• The total amount of risk a company is able to take on.

• Risk Tolerance

• A type of risk assessment that assigns a monetary value to risks.

• Risk Register

• The process of going through and finding all known risks in an organization.

• Risk Appetite

• The amount of risk a company decides to take on,

• Risk Identification

• A record that identifies and tracks all known risks in a company.

Match the risk mitigation terms.

• Risk Avoidance

• Risk mitigation strategy that requires a company to take on the remaining risk.

• Risk Reduction

• Risk mitigation strategy that attempts to remove risk by not taking an action.

• Risk Acceptance

• Risk mitigation strategy that attempts to remove risk by giving part of it to a third party.

• Risk Transference

• The process of taking inherent risk and mitigating it to residual risk.

• Risk Mitigation

• Risk mitigation strategy that attempts to remove risk by implementing a security control.

Match the following risk events.

• SLE

• The cost of one event occurring.

• SLE X ARO = ALE

• The estimation of occurrences per year for a risk event.

• ALE

• The % of the asset value that will decrease when an event occurs.

• EF

• The accumulated costs of all events that occurred in one year.

• ARO

• A formula we use to assign a monetary value to a risk event occurring.