WGU C836 OA STUDY GUIDE (OVERLY
INFORMATIVE)
OPSEC - ANSWERS-A formal methodology of operations security
Operations Security Process - ANSWERS-1. Identification of critical information
2. Analysis of threats
3. Analysis of vulnerabilities
4. Assessment of risks - match threats and vulnerabilities
5. Application of countermeasures
Haas's Laws of Operation Security - ANSWERS-First - "If you don't know the
threat, how do you know what to protect?" -- develop an awareness of both the
actual and potential threats
Second - "If you don't know what to protect, how do you know you are protecting
it?" -- evaluate our information assets and determine what exactly we might
consider to be our critical information. Same as identification of critical
information in SecOpt Process #1
Third - "If you are not protecting it (the information), ... THE DRAGON WINS!" --
necessity of the operations security process
,Competitive Intelligence - ANSWERS-The process of intelligence gathering and
analysis to support business decisions.
Physical Threats - ANSWERS-Extreme temperature
Gases
Liquids
Living organism
Projectiles
Movement
Energy anomalies
People
Toxins
Smoke and fire
Business Continuity Planning (BCP) - ANSWERS-The plans we put in place to
ensure that critical business functions can continue operations through the state
of emergency.
Disaster Recovery Planning (DRP) - ANSWERS-The plans we put in place in
preparation for a potential disaster, and what exactly we will do during and after
a particular disaster strikes to replace infrastructure
, Deterrent - ANSWERS-Discourage those who might seek to violate our security
controls from doing so, whether the threat is external or internal.
Violation of a policy could result in the employing being disciplined or fired.
Violation of a regulation or law could result in criminal or civil prosecution
Detective - ANSWERS-Detect and report undesirable events that are taking place.
Preventive - ANSWERS-Physically prevent unauthorized entities from breaching
our physical security
Defense in depth - ANSWERS-Using a variety of security measures that will still
achieve a successful defense should one or more of the defensive measures fail
RAID - ANSWERS-Data storage virtualization technology that combines multiple
physical disk drive components into a single logical unit for the purposes of data
redundancy, performance improvement, or both
Packet Filtering - ANSWERS-Looks at the contents of each packet in the traffic
individually and makes a gross determination based on the IP, port, and protocol
being used.
Stateful Packet Inspection - ANSWERS-Uses a state table to keep track of the
connection state and will only allow traffic through that is part of a new or already
established connection
INFORMATIVE)
OPSEC - ANSWERS-A formal methodology of operations security
Operations Security Process - ANSWERS-1. Identification of critical information
2. Analysis of threats
3. Analysis of vulnerabilities
4. Assessment of risks - match threats and vulnerabilities
5. Application of countermeasures
Haas's Laws of Operation Security - ANSWERS-First - "If you don't know the
threat, how do you know what to protect?" -- develop an awareness of both the
actual and potential threats
Second - "If you don't know what to protect, how do you know you are protecting
it?" -- evaluate our information assets and determine what exactly we might
consider to be our critical information. Same as identification of critical
information in SecOpt Process #1
Third - "If you are not protecting it (the information), ... THE DRAGON WINS!" --
necessity of the operations security process
,Competitive Intelligence - ANSWERS-The process of intelligence gathering and
analysis to support business decisions.
Physical Threats - ANSWERS-Extreme temperature
Gases
Liquids
Living organism
Projectiles
Movement
Energy anomalies
People
Toxins
Smoke and fire
Business Continuity Planning (BCP) - ANSWERS-The plans we put in place to
ensure that critical business functions can continue operations through the state
of emergency.
Disaster Recovery Planning (DRP) - ANSWERS-The plans we put in place in
preparation for a potential disaster, and what exactly we will do during and after
a particular disaster strikes to replace infrastructure
, Deterrent - ANSWERS-Discourage those who might seek to violate our security
controls from doing so, whether the threat is external or internal.
Violation of a policy could result in the employing being disciplined or fired.
Violation of a regulation or law could result in criminal or civil prosecution
Detective - ANSWERS-Detect and report undesirable events that are taking place.
Preventive - ANSWERS-Physically prevent unauthorized entities from breaching
our physical security
Defense in depth - ANSWERS-Using a variety of security measures that will still
achieve a successful defense should one or more of the defensive measures fail
RAID - ANSWERS-Data storage virtualization technology that combines multiple
physical disk drive components into a single logical unit for the purposes of data
redundancy, performance improvement, or both
Packet Filtering - ANSWERS-Looks at the contents of each packet in the traffic
individually and makes a gross determination based on the IP, port, and protocol
being used.
Stateful Packet Inspection - ANSWERS-Uses a state table to keep track of the
connection state and will only allow traffic through that is part of a new or already
established connection
