CND Risk Management & Compliance 4

Question 1

Which step of the NIST RMF involves categorizing information systems based on the potential impact of a security breach?

Accepted Answer

Categorize

Answer

The Categorize step uses FIPS 199 and NIST SP 800-60 to classify systems based on the potential impact (low, moderate, high) of a confidentiality, integrity, or availability breach.

Question 2

An organization wants to comply with ISO/IEC 27001. Which document serves as the foundation by defining the scope, objectives, and boundaries of the Information Security Management System (ISMS)?

Accepted Answer

Statement of Applicability (SoA)

Answer

The Statement of Applicability (SoA) documents which ISO/IEC 27001 Annex A controls are applicable and justified for the organization's ISMS scope.

Question 3

During a risk assessment, an analyst finds that a web server is exposed to SQL injection. The vulnerability is the weakness, and the threat is malicious input. What is the 'risk' in this scenario?

Accepted Answer

The probability that the SQL injection succeeds combined with the resulting impact

Answer

Risk is the combination of the likelihood that a threat exploits a vulnerability and the potential impact of that exploitation.

Question 4

Which compliance regulation applies to US financial institutions and requires them to protect the security and confidentiality of customer financial information?

Accepted Answer

GLBA

Answer

The Gramm-Leach-Bliley Act (GLBA) requires US financial institutions to implement safeguards to protect nonpublic personal financial information.

Question 5

In risk management, the 'residual risk' is best described as:

Accepted Answer

Risk that remains after security controls have been applied

Answer

Residual risk is the level of risk that remains after risk mitigation controls have been implemented; it must be accepted by management.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Risk Management & Compliance 4