WGU C845 FINAL STUDY GUIDE COMPLETE
QUESTIONS AND ANSWERS
◍ The Primary Security Categories. Answer: Prevention
Detection
Recovery
◍ Access Control Steps. Answer: Identification
Authentication
Authorization
Accounting
Auditing
◍ Risk. Answer: A chance of damage or loss based upon the
exposure to a potential hazard or threat.
◍ Threat Vector. Answer: A path that an attacker might take to take
advantage of a vulnerability and do harm
◍ Prudent Man Concept. Answer: Refers to actions that may be
REASONABLY TAKEN (or are obvious) to safeguard corporate
assets and data
,◍ Components of Risk. Answer: Threat
Vulnerability
Controls
◍ Threat. Answer: Any incident or action that, if carried out, could
cause harm or loss of data or an asset.
◍ Vulnerabilities. Answer: Weaknesses that may be penetrated or
exploited by an attacker
◍ Controls. Answer: Used to reduce the possibility that a threat will
exploit a vulnerability
◍ Types of Access Controls. Answer: Physical
Administrative
Logical
◍ Due Diligence. Answer: ENSURING that the CONTROLS put into
place are functioning ADEQUATELY.
May also be referred to as ASSUREDNESS.
◍ Due Care. Answer: The actions that a PRUDENT and
REASONABLE person would make to protect an organization's
assets
◍ Categories of Assets. Answer: Physical Resources
,Data
◍ Data. Answer: Contents placed on the company network and
storage devices
◍ Concept of Least Privilege. Answer: Refers to granting the least
amount of access rights and permissions required to perform a task.
◍ The Three As of Accounting. Answer: Authentication
Authorization
Accounting
◍ Mandatory Vacation. Answer: A security technique that allows for
the review of employee activities.
◍ Separation of Duties. Answer: Ensures that no one person has too
much power or ¬control
◍ M of N Requirement. Answer: Requires a certain number of
individuals to agree prior to action being taken. M represents the
minimum number of individuals that must agree on a course of action.
N represents the total number individuals involved.
◍ Two-Man Rule. Answer: A procedure popular in very high-
security locations and situations. It features two individuals who must
agree upon action yet are physically separated and must therefore take
action independent of the other
, ◍ Types of Security Awareness Education Programs. Answer: New
Hire Orientation
Mandatory Security Training
Corporate-Wide Security Training
Specialty Security Training
◍ Mitigation. Answer: The act of limiting risk
◍ Physical Controls. Answer: Restrict or prohibit access to the
physical components of the infrastructure; usually independent of
computer hardware, software, and communication systems
Usually the first line of defense
Include doors, locks, and fences.
◍ Logical Controls. Answer: Any network device or software that
protects the network hardware and digital information assets of the
company
These include an access control list (ACL), an intrusion detection
system (IDS), firewalls, routers, virus protection software, and
activity logging mechanisms.
◍ Administrative Controls. Answer: Consist of policies, directives,
regulations, and rules set up by a company to govern activities taken
by individuals or to establish operating procedures.
QUESTIONS AND ANSWERS
◍ The Primary Security Categories. Answer: Prevention
Detection
Recovery
◍ Access Control Steps. Answer: Identification
Authentication
Authorization
Accounting
Auditing
◍ Risk. Answer: A chance of damage or loss based upon the
exposure to a potential hazard or threat.
◍ Threat Vector. Answer: A path that an attacker might take to take
advantage of a vulnerability and do harm
◍ Prudent Man Concept. Answer: Refers to actions that may be
REASONABLY TAKEN (or are obvious) to safeguard corporate
assets and data
,◍ Components of Risk. Answer: Threat
Vulnerability
Controls
◍ Threat. Answer: Any incident or action that, if carried out, could
cause harm or loss of data or an asset.
◍ Vulnerabilities. Answer: Weaknesses that may be penetrated or
exploited by an attacker
◍ Controls. Answer: Used to reduce the possibility that a threat will
exploit a vulnerability
◍ Types of Access Controls. Answer: Physical
Administrative
Logical
◍ Due Diligence. Answer: ENSURING that the CONTROLS put into
place are functioning ADEQUATELY.
May also be referred to as ASSUREDNESS.
◍ Due Care. Answer: The actions that a PRUDENT and
REASONABLE person would make to protect an organization's
assets
◍ Categories of Assets. Answer: Physical Resources
,Data
◍ Data. Answer: Contents placed on the company network and
storage devices
◍ Concept of Least Privilege. Answer: Refers to granting the least
amount of access rights and permissions required to perform a task.
◍ The Three As of Accounting. Answer: Authentication
Authorization
Accounting
◍ Mandatory Vacation. Answer: A security technique that allows for
the review of employee activities.
◍ Separation of Duties. Answer: Ensures that no one person has too
much power or ¬control
◍ M of N Requirement. Answer: Requires a certain number of
individuals to agree prior to action being taken. M represents the
minimum number of individuals that must agree on a course of action.
N represents the total number individuals involved.
◍ Two-Man Rule. Answer: A procedure popular in very high-
security locations and situations. It features two individuals who must
agree upon action yet are physically separated and must therefore take
action independent of the other
, ◍ Types of Security Awareness Education Programs. Answer: New
Hire Orientation
Mandatory Security Training
Corporate-Wide Security Training
Specialty Security Training
◍ Mitigation. Answer: The act of limiting risk
◍ Physical Controls. Answer: Restrict or prohibit access to the
physical components of the infrastructure; usually independent of
computer hardware, software, and communication systems
Usually the first line of defense
Include doors, locks, and fences.
◍ Logical Controls. Answer: Any network device or software that
protects the network hardware and digital information assets of the
company
These include an access control list (ACL), an intrusion detection
system (IDS), firewalls, routers, virus protection software, and
activity logging mechanisms.
◍ Administrative Controls. Answer: Consist of policies, directives,
regulations, and rules set up by a company to govern activities taken
by individuals or to establish operating procedures.
