WGU C726 - Information Systems Security - Study Guide
Domain 1: Security Governance and Risk Management
1. What is the primary goal of Information Security?
ANSWER ✓ To protect the Confidentiality, Integrity, and Availability (CIA Triad) of
an organization's information assets.
2. Define Confidentiality.
ANSWER ✓ Ensuring that information is accessible only to those authorized to have
access. Example: Encrypting a sensitive email so only the intended recipient can read it.
3. Define Integrity.
ANSWER ✓ Safeguarding the accuracy and completeness of information and processing
methods. Example: Using hash functions or digital signatures to detect if a file has
been altered in transit.
4. Define Availability.
ANSWER ✓ Ensuring that authorized users have access to information and associated
assets when required. Example: Implementing redundant servers and load
balancers to prevent downtime from a Denial-of-Service (DoS) attack.
5. What is Governance in the context of cybersecurity?
ANSWER ✓ The overall framework of policies, procedures, and standards that provides
direction and control for an organization's security program. It is driven by senior
management and the board.
6. What is the purpose of a Security Policy?
ANSWER ✓ A high-level document that defines an organization's security goals, vision,
and overall stance. It is mandatory and sets the tone for the entire security program.
7. Differentiate between a Standard, a Guideline, and a Procedure.
ANSWER ✓
,o Standard: A mandatory, specific rule or requirement (e.g., "All passwords must be at
least 12 characters").
o Guideline: A recommended, non-mandatory action (e.g., "It is recommended to use a
passphrase").
o Procedure: A detailed step-by-step instruction to accomplish a task (e.g., "Steps to reset
a user's password").
8. What is Risk Management?
ANSWER ✓ The process of identifying, assessing, and prioritizing risks, followed by
applying resources to minimize, monitor, and control the impact of unfortunate events.
9. What are the key steps in the Risk Management process?
ANSWER ✓
1. Identify assets and threats.
2. Assess and analyze risks (Likelihood x Impact).
3. Treat the risk (Mitigate, Transfer, Accept, Avoid).
4. Monitor and review risks continuously.
10. What are the four common ways to treat risk?
ANSWER ✓
o Mitigate: Implement a security control to reduce the risk (e.g., install a firewall).
o Transfer: Shift the risk to a third party (e.g., purchase cybersecurity insurance).
o Accept: Acknowledge the risk and take no action, typically because the cost of
mitigation is higher than the potential loss.
o Avoid: Discontinue the activity that introduces the risk.
11. What is the difference between Inherent Risk and Residual Risk?
ANSWER ✓
o Inherent Risk: The risk level before any controls are applied.
o Residual Risk: The risk level that remains after controls are applied.
12. What is a Risk Assessment?
ANSWER ✓ The process of identifying, estimating, and prioritizing risks to organizational
operations and assets.
13. What is the purpose of a Business Impact Analysis (BIA)?
, ANSWER ✓ To identify and evaluate the potential effects of an interruption to critical
business operations. It is a core component of disaster recovery planning.
14. Define Maximum Tolerable Downtime (MTD).
ANSWER ✓ The maximum time a business process can be offline before it causes
irreparable harm to the organization.
15. What are Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?
ANSWER ✓
o RTO: The target time within which a business process must be restored after a disaster.
(How long can we be down?)
o RPO: The maximum acceptable amount of data loss measured in time. (How much data
can we afford to lose?)
16. What is the role of Compliance in security governance?
ANSWER ✓ Ensuring that the organization adheres to laws, regulations, and contractual
obligations (e.g., GDPR, HIPAA, PCI-DSS).
17. What is Due Care and Due Diligence?
ANSWER ✓
o Due Care: Taking the necessary steps to implement reasonable security measures
(doing what a "prudent person" would do).
o Due Diligence: The ongoing process of staying informed about new threats and
ensuring controls remain effective.
18. What are the three main types of security controls?
ANSWER ✓
o Administrative: Policies, procedures, training (people-focused).
o Technical: Firewalls, encryption, access controls (technology-focused).
o Physical: Locks, guards, mantraps (facility-focused).
19. Differentiate between Preventive, Detective, and Corrective controls.
ANSWER ✓
o Preventive: Attempt to prevent an incident (e.g., firewall, access control list).
o Detective: Attempt to discover incidents during or after they occur (e.g., IDS, log
monitoring, CCTV).
Domain 1: Security Governance and Risk Management
1. What is the primary goal of Information Security?
ANSWER ✓ To protect the Confidentiality, Integrity, and Availability (CIA Triad) of
an organization's information assets.
2. Define Confidentiality.
ANSWER ✓ Ensuring that information is accessible only to those authorized to have
access. Example: Encrypting a sensitive email so only the intended recipient can read it.
3. Define Integrity.
ANSWER ✓ Safeguarding the accuracy and completeness of information and processing
methods. Example: Using hash functions or digital signatures to detect if a file has
been altered in transit.
4. Define Availability.
ANSWER ✓ Ensuring that authorized users have access to information and associated
assets when required. Example: Implementing redundant servers and load
balancers to prevent downtime from a Denial-of-Service (DoS) attack.
5. What is Governance in the context of cybersecurity?
ANSWER ✓ The overall framework of policies, procedures, and standards that provides
direction and control for an organization's security program. It is driven by senior
management and the board.
6. What is the purpose of a Security Policy?
ANSWER ✓ A high-level document that defines an organization's security goals, vision,
and overall stance. It is mandatory and sets the tone for the entire security program.
7. Differentiate between a Standard, a Guideline, and a Procedure.
ANSWER ✓
,o Standard: A mandatory, specific rule or requirement (e.g., "All passwords must be at
least 12 characters").
o Guideline: A recommended, non-mandatory action (e.g., "It is recommended to use a
passphrase").
o Procedure: A detailed step-by-step instruction to accomplish a task (e.g., "Steps to reset
a user's password").
8. What is Risk Management?
ANSWER ✓ The process of identifying, assessing, and prioritizing risks, followed by
applying resources to minimize, monitor, and control the impact of unfortunate events.
9. What are the key steps in the Risk Management process?
ANSWER ✓
1. Identify assets and threats.
2. Assess and analyze risks (Likelihood x Impact).
3. Treat the risk (Mitigate, Transfer, Accept, Avoid).
4. Monitor and review risks continuously.
10. What are the four common ways to treat risk?
ANSWER ✓
o Mitigate: Implement a security control to reduce the risk (e.g., install a firewall).
o Transfer: Shift the risk to a third party (e.g., purchase cybersecurity insurance).
o Accept: Acknowledge the risk and take no action, typically because the cost of
mitigation is higher than the potential loss.
o Avoid: Discontinue the activity that introduces the risk.
11. What is the difference between Inherent Risk and Residual Risk?
ANSWER ✓
o Inherent Risk: The risk level before any controls are applied.
o Residual Risk: The risk level that remains after controls are applied.
12. What is a Risk Assessment?
ANSWER ✓ The process of identifying, estimating, and prioritizing risks to organizational
operations and assets.
13. What is the purpose of a Business Impact Analysis (BIA)?
, ANSWER ✓ To identify and evaluate the potential effects of an interruption to critical
business operations. It is a core component of disaster recovery planning.
14. Define Maximum Tolerable Downtime (MTD).
ANSWER ✓ The maximum time a business process can be offline before it causes
irreparable harm to the organization.
15. What are Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?
ANSWER ✓
o RTO: The target time within which a business process must be restored after a disaster.
(How long can we be down?)
o RPO: The maximum acceptable amount of data loss measured in time. (How much data
can we afford to lose?)
16. What is the role of Compliance in security governance?
ANSWER ✓ Ensuring that the organization adheres to laws, regulations, and contractual
obligations (e.g., GDPR, HIPAA, PCI-DSS).
17. What is Due Care and Due Diligence?
ANSWER ✓
o Due Care: Taking the necessary steps to implement reasonable security measures
(doing what a "prudent person" would do).
o Due Diligence: The ongoing process of staying informed about new threats and
ensuring controls remain effective.
18. What are the three main types of security controls?
ANSWER ✓
o Administrative: Policies, procedures, training (people-focused).
o Technical: Firewalls, encryption, access controls (technology-focused).
o Physical: Locks, guards, mantraps (facility-focused).
19. Differentiate between Preventive, Detective, and Corrective controls.
ANSWER ✓
o Preventive: Attempt to prevent an incident (e.g., firewall, access control list).
o Detective: Attempt to discover incidents during or after they occur (e.g., IDS, log
monitoring, CCTV).
