CHAPTER SUMMARY

This chapter covered important elements of risk mitigation throughout an organization. Controls are implemented to mitigate risk by reducing the impact of threats or reducing vulnerabilities, and the effectiveness of the controls can be measured against those two requirements. They should be most effective at preventing risk for any critical business operations in an organization.

Legal compliance issues for IT have grown important in recent years. More laws and regulations apply, and the cost for noncompliance can be expensive. Therefore, taking the time to identify relevant laws and guidelines is important because regulations can have varying impacts on an organization and they should be considered when implementing supporting controls.

KEY CONCEPTS AND TERMS

critical business function (CBF)

critical success factor (CSF)

defense in depth

E-Rate funding

maximum acceptable outage (MAO)

proxy server

return on investment (ROI)

service level agreement (SLA)

technology protection measure (TPM)

CHAPTER 10 ASSESSMENT

  1. A ________ is used to identify the impact on an organization if a risk occurs.
  2. MAO is the minimal acceptable outage that a system or service can experience before its mission is affected.
    1. True
    2. False
  3. An organization wants to have an agreement with a vendor for an expected level of performance for a service that includes ensuring that monetary penalties are assessed if the minimum uptime requirements are not met. What should you use?
    1. MAO
    2. BIA
    3. SLA
    4. IDS
  4. What would be used to identify mission-critical systems?
    1. Critical outage times
    2. Critical business functions
    3. PCI DSS review
    4. Disaster recovery plan
  5. What can an organization use to remind users of an AUP’s contents?
    1. Logon banners
    2. Posters
    3. Emails
    4. All of the above
  6. Organizations that violate GDPR rules may be fined ____________ or _______________ of their annual global turnover, whichever is greater.
  7. Which of the following strategies helps reduce security gaps even if a security control fails?
    1. Access control implementation
    2. Critical business factor analysis
    3. Defense in depth
    4. Business impact analysis
  8. How much can an organization be fined in a year for HIPAA-related mistakes?
    1. $100
    2. $1,000
    3. $25,000
    4. $250,000
  9. What determines whether an organization is governed by FISMA?
    1. Whether it is registered with the Securities and Exchange Commission
    2. Whether its employees handle health-related information
    3. Whether it receives E-Rate funding
    4. Whether it is a federal agency
  10. What determines whether an organization is governed by HIPAA?
    1. Whether it is registered with the Securities and Exchange Commission
    2. Whether its employees handle health-related information
    3. Whether it receives E-Rate funding
    4. Whether it is a federal agency
  11. What determines whether an organization is governed by SOX?
    1. Whether it is registered with the Securities and Exchange Commission
    2. Whether its employees handle health-related information
    3. Whether it receives E-Rate funding
    4. Whether it is a federal agency
  12. What determines whether an organization is governed by CIPA?
    1. Whether it is registered with the Securities and Exchange Commission
    2. Whether its employees handle health-related information
    3. Whether it receives E-Rate funding
    4. Whether it is a federal agency
  13. A CBA has been performed on a prospective control. The CBA indicates the cost of the control is about the same as the control’s projected benefits. What should be done?
    1. Identify the ROI
    2. Purchase the control
    3. Cancel the purchase of the control
    4. Redo the CBA
  14. Which of the following is a valid formula used to identify the projected benefits of a control?
    1. Loss after control − Loss before control
    2. Loss before control − Loss after control
    3. Cost of control + Losses
    4. Cost of control/12
  15. A CBA can be used to justify the purchase of a control.
    1. True
    2. False
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.118.2.240