Recertification Flashcards

Which of the following best describes the principle of "least privilege"?

Answer: Granting users only the permissions they need to perform their job functions.

The principle of 'least privilege' dictates that users, programs, or processes should be granted only the minimum necessary permissions to perform their specific tasks. This minimizes the potential damage from accidental errors, misuse, or malicious attacks, as an attacker gaining access would have limited capabilities. It's a fundamental security concept for reducing an organization's attack surface.

What is the primary purpose of a Business Continuity Plan (BCP)?

Answer: To ensue that critical business functions continue during and after a disaster.

A Business Continuity Plan (BCP) is a comprehensive strategy designed to ensure that an organization's critical business functions can continue operating during and after a disruptive event, such as a natural disaster, cyberattack, or power outage. Its main goal is to minimize downtime and financial losses by outlining procedures for maintaining essential operations. This differs from a Disaster Recovery Plan (DRP), which focuses specifically on IT system recovery.

Which of the following is an example of a physical security control?

Answer: Biometric access controls.

Physical security controls are measures designed to protect physical assets, facilities, and personnel from unauthorized access, damage, or theft. Biometric access controls, such as fingerprint or facial recognition scanners, directly regulate physical entry to restricted areas. In contrast, encryption, firewalls, and user access reviews are logical or administrative security controls.

What is the primary goal of an Incident Response Plan (IRP)

Answer: To ensure that the organization can quickly respond to and recover from security incidents.

An Incident Response Plan (IRP) is a structured approach for handling security incidents, aiming to limit damage and reduce recovery time and costs. Its primary goal is to enable an organization to quickly identify, contain, eradicate, recover from, and learn from security breaches. This ensures a systematic and efficient response to protect assets and maintain business operations.

Which of the following describes a Distributed Denial of Service (DDoS) attack?

Answer: An attack where multiple compromised systems are used to target a single system, causing a denial of service.

A Distributed Denial of Service (DDoS) attack involves overwhelming a target system, server, or network with a flood of internet traffic from multiple compromised computer systems (often called a botnet). This coordinated attack aims to exhaust the target's resources, making it unavailable to legitimate users. Unlike a single-system attack, the distributed nature makes DDoS attacks harder to mitigate.