CompTIA SecurityX (CASP+) CAS-005 | Complete Exam Questions & Verified Answers | Cybersecurity Certification Prep
De-Perimeterization The removal of a boundary between an organization and the outside world.
Constant change in the boundary of a network.
Downstream Liability Occurs when a partner or outsource provider fails to fulfill
the organizational requirement.
Due Care Defined as having taken all reasonable actions to prevent security issues or to
mitigate a possible security breach. (Taking Action)
Due Diligence Defined as having investigated all reasonable measures to address a given risk.
(Gathering Information)
Export Control Regulations A federal law that prohibits the unlicensed export of certain commodities or
information for reasons of national security or protections of trade.
Jurisdiction The area or region covered by an official power.
Policies Used to state the role of security in an organization and establishes the desired
end-state of the security program.
They are very broad and provide the basic foundation upon which the
standards, baselines, guidelines, and procedures are built.
Third-Party Connection Agreement (TCA) Dictates the security controls that should be
taken to protect the data being exchanged
between two partners.
Business Impact Analysis (BIA) A functional analysis that is conducted as part of the development of the
business continuity and disaster recovery plan.
Business Partnership Agreement (BPA) Conducted between two business partners and establishes the conditions of
their relationship.
Interconnection Security Agreement (ISA) An agreement for the owners and operators of the IT systems to document
what technical requirements each organization must meet.
Interoperability Agreements Binding agreements and are used during normal operations.
Job Rotation Different users are trained to perform the tasks of the same position to help
prevent an identity fraud that could occur if only one employee had
that job.
Least Privilege The concept of providing users or services with the lowest level of access
required to perform their job functions.
,CompTIA SecurityX (CASP+) CAS-005 | Complete Exam Questions & Verified Answers | Cybersecurity Certification Prep
Mandatory Vacation An employee is required to take a vacation at some point during the year.
(Audit and Job Rotation)
Master Service Agreement (MSA) This is an agreement for future agreements, allowing the organizations involved
to negotiate future contracts much more quickly.
Memorandum of Understanding (MOU) A non-binding agreement between two or more organizations to detail an
intended common line of action. (Akin to a handshake)
Need to Know A security principle that defines the minimums for each job or business
function.
Non-Disclosure Agreement (NDA) Signed between two parties and define what data is considered confidential
and cannot be shared outside of the relationship.
Operational Level Agreement (OLA) An internal agreement that provides the details of the relationships involved
between different departments of an organization as they support the business
functions.
Personally Identifiable Information (PII) Any data that could potentially identify a specific individual.
Request for Information (RFI) A bidding-process document that collects written information about the
capabilities of various suppliers. It may be used prior to an RFP or RFQ, if
needed, but can also be used after these if the RFP or RFQ does not obtain
enough specification information.
Request for Proposal (RFP) A bidding-process document that is issued by an organization that gives details
of a commodity, a service, or an asset that the organization wants to purchase.
Request for Quote (RFQ) A bidding-process document that invites suppliers to bid on specific products
or services. It generally means the same thing as invitation for bid (IFB). They
often include item or service specifications.
Risk Assessment A tool used during risk management to identify vulnerabilities and threats, to
assess their impact, and to determine what controls to utilize.
Separation of Duties A preventative administrative control that should be considered whenever
we're drafting authentication and authorization policies for the organization.
High risk functions in our organization should be broken up into smaller
functions. (Prevents fraud)
Service-Level Agreement (SLA) This agreement is concerned with the ability to support and respond to
problems within a given timeframe while providing the agreed upon level of
service to the user.
,CompTIA SecurityX (CASP+) CAS-005 | Complete Exam Questions & Verified Answers | Cybersecurity Certification Prep
Statement of Applicability (SOA) Identifies the controls selected and explains why those controls are
considered appropriate based on the output of the risk assessment.
Access Control List (ACL) Controls the flow of traffic into or out of a certain part of the network. Most
specific rules should be placed at the top of the list, with more generic rules
towards the bottom. It is a best practice to include a deny all rule at the end.
Can be configured on the router interfaces to control the flow of traffic into or
out of a certain part of the network.
Administrative Control Manages personnel and assets through security policies, standards,
procedures, guidelines, and baselines.
Advisory Policies Provide guidance for acceptable activities.
Annual Loss Expectancy (ALE) The expected cost of a realized threat over a given year.
● SLE x ARO
Annualized Rate of Occurrence (ARO) Provides us with an estimate of how many times per year a given threat might
be realized.
Asset Any object that is of value to an organization, including personnel, facilities,
devices, and so on.
Asset Value (AV) An element of a risk assessment. It identifies the value of an asset and can
include any product, system, resource, or process. The value can be a specific
monetary value or a subjective value.
Availability Deals with ensuring that the data is accessible when and where it is needed.
Business Continuity Plan (BCP) Refers to the plans and processes used during your response to a disruptive
event.
Checksum A value computed on data to detect error or manipulation.
Federal Information Processing Standard Publication Defines standards for security categorization of federal information systems.
199 (FIPS 199) Requires federal agencies to assess their information systems in each of the
categories: Confidentiality, Integrity, and Availability (CIA), rating each system
as low, moderate, or high impact in each category.
, CompTIA SecurityX (CASP+) CAS-005 | Complete Exam Questions & Verified Answers | Cybersecurity Certification Prep
Frameworks Are best practices that are generally employed. (General)
Methodologies Are a system of best practices, techniques, procedures, and rules used by
those who work in a discipline.
International Organization for Standardization (ISO) A group of standards created as a series of best practices
across multiple industries
Covert Hidden; Undercover
Clandestine Secret, Concealed; Underhanded
Qualitative Risk Analysis Uses intuition, experience, and other best practices to assign nonnumeric
values to a given risk value.
● Brainstorming sessions
● Focus groups
● Surveys
● Interviews
Quantitative Risk Analysis Uses numeric values and monetary values for all parts of the risk analysis.
Delphi Technique A decision-making technique in which group members do not meet face-to-
face but respond in writing to questions posed by the group leader. It is used
to estimate the likelihood and outcome of future events.
Magnitude of Impact (Risk Impact) An estimation of the amount of damage that a negative risk can
achieve or the amount of opportunity cost if a risk is realized.
Single Loss Expectancy (SLE) The cost associated with the realization of each individual threat that occurs.
Exposure Factor (EF) The percent value or functionality of an asset that will be lost when a threat
event occurs.
Likelihood of Threat A measure of the probability that a particular risk will be realized and impact
the organization.
Motivation What causes someone to act.
Return on Investment (ROI) A ratio that considers how long it would take to make up for the expense, or
investment, by preventing the risk from occurring. It determines the expected
fiscal gains for improvements and balances that against the cost of
implementing the changes.
Payback A calculation that simply compares the Annual Loss Expectancy against the
expected savings from implementing a given control.
Net Present Value (NPV) It considers the cost of the money spent today against the savings that we
might see tomorrow.
Total Cost of Ownership (TCO) A financial estimate intended to help buyers and owners determine the direct
and indirect costs of a product or service.
Consider not just the sticker price but also the other parts of the cost of
ownership to support the countermeasure.
De-Perimeterization The removal of a boundary between an organization and the outside world.
Constant change in the boundary of a network.
Downstream Liability Occurs when a partner or outsource provider fails to fulfill
the organizational requirement.
Due Care Defined as having taken all reasonable actions to prevent security issues or to
mitigate a possible security breach. (Taking Action)
Due Diligence Defined as having investigated all reasonable measures to address a given risk.
(Gathering Information)
Export Control Regulations A federal law that prohibits the unlicensed export of certain commodities or
information for reasons of national security or protections of trade.
Jurisdiction The area or region covered by an official power.
Policies Used to state the role of security in an organization and establishes the desired
end-state of the security program.
They are very broad and provide the basic foundation upon which the
standards, baselines, guidelines, and procedures are built.
Third-Party Connection Agreement (TCA) Dictates the security controls that should be
taken to protect the data being exchanged
between two partners.
Business Impact Analysis (BIA) A functional analysis that is conducted as part of the development of the
business continuity and disaster recovery plan.
Business Partnership Agreement (BPA) Conducted between two business partners and establishes the conditions of
their relationship.
Interconnection Security Agreement (ISA) An agreement for the owners and operators of the IT systems to document
what technical requirements each organization must meet.
Interoperability Agreements Binding agreements and are used during normal operations.
Job Rotation Different users are trained to perform the tasks of the same position to help
prevent an identity fraud that could occur if only one employee had
that job.
Least Privilege The concept of providing users or services with the lowest level of access
required to perform their job functions.
,CompTIA SecurityX (CASP+) CAS-005 | Complete Exam Questions & Verified Answers | Cybersecurity Certification Prep
Mandatory Vacation An employee is required to take a vacation at some point during the year.
(Audit and Job Rotation)
Master Service Agreement (MSA) This is an agreement for future agreements, allowing the organizations involved
to negotiate future contracts much more quickly.
Memorandum of Understanding (MOU) A non-binding agreement between two or more organizations to detail an
intended common line of action. (Akin to a handshake)
Need to Know A security principle that defines the minimums for each job or business
function.
Non-Disclosure Agreement (NDA) Signed between two parties and define what data is considered confidential
and cannot be shared outside of the relationship.
Operational Level Agreement (OLA) An internal agreement that provides the details of the relationships involved
between different departments of an organization as they support the business
functions.
Personally Identifiable Information (PII) Any data that could potentially identify a specific individual.
Request for Information (RFI) A bidding-process document that collects written information about the
capabilities of various suppliers. It may be used prior to an RFP or RFQ, if
needed, but can also be used after these if the RFP or RFQ does not obtain
enough specification information.
Request for Proposal (RFP) A bidding-process document that is issued by an organization that gives details
of a commodity, a service, or an asset that the organization wants to purchase.
Request for Quote (RFQ) A bidding-process document that invites suppliers to bid on specific products
or services. It generally means the same thing as invitation for bid (IFB). They
often include item or service specifications.
Risk Assessment A tool used during risk management to identify vulnerabilities and threats, to
assess their impact, and to determine what controls to utilize.
Separation of Duties A preventative administrative control that should be considered whenever
we're drafting authentication and authorization policies for the organization.
High risk functions in our organization should be broken up into smaller
functions. (Prevents fraud)
Service-Level Agreement (SLA) This agreement is concerned with the ability to support and respond to
problems within a given timeframe while providing the agreed upon level of
service to the user.
,CompTIA SecurityX (CASP+) CAS-005 | Complete Exam Questions & Verified Answers | Cybersecurity Certification Prep
Statement of Applicability (SOA) Identifies the controls selected and explains why those controls are
considered appropriate based on the output of the risk assessment.
Access Control List (ACL) Controls the flow of traffic into or out of a certain part of the network. Most
specific rules should be placed at the top of the list, with more generic rules
towards the bottom. It is a best practice to include a deny all rule at the end.
Can be configured on the router interfaces to control the flow of traffic into or
out of a certain part of the network.
Administrative Control Manages personnel and assets through security policies, standards,
procedures, guidelines, and baselines.
Advisory Policies Provide guidance for acceptable activities.
Annual Loss Expectancy (ALE) The expected cost of a realized threat over a given year.
● SLE x ARO
Annualized Rate of Occurrence (ARO) Provides us with an estimate of how many times per year a given threat might
be realized.
Asset Any object that is of value to an organization, including personnel, facilities,
devices, and so on.
Asset Value (AV) An element of a risk assessment. It identifies the value of an asset and can
include any product, system, resource, or process. The value can be a specific
monetary value or a subjective value.
Availability Deals with ensuring that the data is accessible when and where it is needed.
Business Continuity Plan (BCP) Refers to the plans and processes used during your response to a disruptive
event.
Checksum A value computed on data to detect error or manipulation.
Federal Information Processing Standard Publication Defines standards for security categorization of federal information systems.
199 (FIPS 199) Requires federal agencies to assess their information systems in each of the
categories: Confidentiality, Integrity, and Availability (CIA), rating each system
as low, moderate, or high impact in each category.
, CompTIA SecurityX (CASP+) CAS-005 | Complete Exam Questions & Verified Answers | Cybersecurity Certification Prep
Frameworks Are best practices that are generally employed. (General)
Methodologies Are a system of best practices, techniques, procedures, and rules used by
those who work in a discipline.
International Organization for Standardization (ISO) A group of standards created as a series of best practices
across multiple industries
Covert Hidden; Undercover
Clandestine Secret, Concealed; Underhanded
Qualitative Risk Analysis Uses intuition, experience, and other best practices to assign nonnumeric
values to a given risk value.
● Brainstorming sessions
● Focus groups
● Surveys
● Interviews
Quantitative Risk Analysis Uses numeric values and monetary values for all parts of the risk analysis.
Delphi Technique A decision-making technique in which group members do not meet face-to-
face but respond in writing to questions posed by the group leader. It is used
to estimate the likelihood and outcome of future events.
Magnitude of Impact (Risk Impact) An estimation of the amount of damage that a negative risk can
achieve or the amount of opportunity cost if a risk is realized.
Single Loss Expectancy (SLE) The cost associated with the realization of each individual threat that occurs.
Exposure Factor (EF) The percent value or functionality of an asset that will be lost when a threat
event occurs.
Likelihood of Threat A measure of the probability that a particular risk will be realized and impact
the organization.
Motivation What causes someone to act.
Return on Investment (ROI) A ratio that considers how long it would take to make up for the expense, or
investment, by preventing the risk from occurring. It determines the expected
fiscal gains for improvements and balances that against the cost of
implementing the changes.
Payback A calculation that simply compares the Annual Loss Expectancy against the
expected savings from implementing a given control.
Net Present Value (NPV) It considers the cost of the money spent today against the savings that we
might see tomorrow.
Total Cost of Ownership (TCO) A financial estimate intended to help buyers and owners determine the direct
and indirect costs of a product or service.
Consider not just the sticker price but also the other parts of the cost of
ownership to support the countermeasure.
