CompTIA Security+ Security Program Management and Oversight Summary

Transferring risk moves the financial impact to another party, such as an insurer. The four common responses are accept, avoid, transfer, and mitigate.

Wrong choices

• Accept: Accepting means taking the risk without further action.
• Avoid: Avoiding means stopping the risky activity altogether.
• Mitigate: Mitigating means adding controls to reduce the risk.

Avoiding risk means not doing the activity that creates it.

Wrong choices

• Transfer: Transfer shifts the impact to another party, such as an insurer.
• Accept: Accepting keeps the activity and the risk.
• Mitigate: Mitigating keeps the activity but adds controls.

An acceptable use policy tells users what they may and may not do with company systems and data.

Wrong choices

• Service-level agreement: An SLA sets service performance between a provider and customer.
• Non-disclosure agreement: An NDA protects confidential information.
• Memorandum of understanding: An MOU describes a general agreement between parties.

The rules of engagement describe the scope, timing, allowed methods, and contacts for a penetration test, and give written permission.

Wrong choices

• Acceptable use policy: An AUP sets rules for employees' use of systems.
• Chain of custody: Chain of custody tracks evidence handling.
• Data retention policy: Retention policies set how long data is kept.

Phishing simulations test whether employees recognize phishing and help target training to those who need it. They are part of a security awareness program.

Wrong choices

• A real attack by organized crime: The company runs it on its own staff for training.
• A denial-of-service test: No traffic flood is involved.
• A penetration test of the firewall: This tests people, not the firewall.

Work it out step by step:

1. SLE = asset value × exposure factor = $20,000 × 0.5 = $10,000
2. ARO = once every 10 years = 0.1 per year
3. ALE = SLE × ARO = $10,000 × 0.1 = $1,000

Check: $1,000 a year × 10 years = $10,000, which is one flood's loss.

Wrong choices

• $10,000: That is the single loss expectancy, before multiplying by how often it happens each year.
• $2,000: This uses the full asset value instead of the 50% exposure factor.
• $100,000: This multiplies instead of using a yearly rate of 0.1.

An SLA sets measurable service levels, such as 99.9% uptime or a 4-hour response time, and what happens if they are not met.

Wrong choices

• Non-disclosure agreement (NDA): An NDA covers keeping information confidential.
• Memorandum of understanding (MOU): An MOU is usually less formal and often not binding.
• Master service agreement (MSA): An MSA sets general terms for future work; specific service levels are usually in an SLA.

The Payment Card Industry Data Security Standard applies to organizations that store, process, or transmit payment card data.

Wrong choices

• HIPAA: HIPAA covers health information in the United States.
• GDPR: GDPR covers personal data of people in the EU.
• SOX: SOX covers financial reporting by public companies.

A risk register tracks each risk, its likelihood and impact, the owner, and the chosen response.

Wrong choices

• Asset tag: An asset tag labels a piece of equipment.
• Acceptable use policy: An AUP sets rules for using company systems.
• Network diagram: A network diagram shows how systems connect.

ARO is how often a loss is expected per year. Once every 4 years means ARO = 0.25. ALE = SLE × ARO.

Wrong choices

• Asset recovery objective: how fast an asset must be restored: That describes a recovery time target, not ARO.
• Average risk owner: the person who owns most risks: This is not a risk analysis term.
• Accepted risk outcome: the risk left after controls: Risk left after controls is residual risk.