AI Bot
Governance, Risk, Compliance, and Security Awareness Flashcards
CompTIA Security+ SY0-801 (V8) Flashcards
Study our Governance, Risk, Compliance, and Security Awareness flashcards for the CompTIA Security+ SY0-801 (V8) exam with 51+ flashcards. View as flashcards, a searchable table, or as a fun matching game.
| Front | Back |
| An asset is worth $200000 with a 25% exposure factor and an ARO of 0.2. What are SLE and ALE? | SLE = $200000 × 0.25 = $50000; ALE = $50000 × 0.2 = $10000 per year. |
| An employee repeatedly submits credentials during phishing simulations. Which training approach best addresses the individual issue? | Corrective training tailored to the demonstrated behavior followed by reassessment. |
| An incident is expected once every five years. What is its ARO? | ARO = 1 / 5 = 0.2 occurrences per year. |
| An organization adds controls to reduce an attack's likelihood or impact. Which risk treatment is this? | Risk mitigation. |
| An organization buys cyber insurance. Which risk treatment does this illustrate? | Risk transfer of covered financial losses; insurance does not eliminate the underlying risk or all organizational responsibilities. |
| An organization cancels a risky service rather than operating it. Which risk treatment is this? | Risk avoidance because the organization stops the activity creating that exposure. |
| How does a business continuity plan differ from a disaster recovery plan? | Business continuity sustains essential business operations; disaster recovery focuses on restoring disrupted information systems and services. |
| How does a data controller differ from a data processor? | The controller determines processing purposes and essential means; the processor handles personal data on the controller's behalf. |
| How does an internal audit differ from an external audit? | An internal audit serves the organization's own assurance needs; an external audit is performed by an outside auditing party. |
| How does an MSA differ from an SOW? | A master services agreement establishes overarching terms; a statement of work defines engagement-specific work and deliverables. |
| How does an SLA differ from an SLO? | An SLA establishes agreed service commitments and consequences; an SLO is a measurable service performance target. |
| How does onboarding security training differ from ongoing training? | Onboarding introduces initial security responsibilities; ongoing training reinforces knowledge and addresses changing risks. |
| How does opt-in differ from opt-out? | Opt-in requires an affirmative choice to participate; opt-out allows an individual to decline or stop participation. |
| How does passive reconnaissance differ from active reconnaissance? | Passive reconnaissance gathers information without directly probing target systems; active reconnaissance sends queries or probes to those systems. |
| How does qualitative risk analysis differ from quantitative risk analysis? | Qualitative analysis uses descriptive categories; quantitative analysis uses numerical estimates such as financial losses and event frequencies. |
| How does supplied information distinguish penetration testing environments? | Known environment provides extensive internal information; unknown environment provides little or none; partially known environment provides limited information. |
| How does vulnerability scanning differ from penetration testing? | Scanning identifies potential weaknesses; penetration testing attempts authorized exploitation to validate weaknesses and demonstrate impact. |
| How should phishing simulation results be used to improve training? | Identify learning needs and adjust training without publicly shaming employees or treating simulations as punishment. |
| Is the GDPR right to be forgotten absolute? | No. Erasure applies under specified conditions and exceptions can require retention for legal obligations or legal claims. |
| Management documents an informed decision to retain a risk without additional treatment. Which treatment is this? | Risk acceptance. |
| The accounts payable team repeatedly mishandles suspicious payment requests. Which training approach best addresses the team-level issue? | Targeted training focused on business email compromise and payment verification for that role. |
| What consequences can result from security non-compliance? | Financial penalties; legal or contractual consequences; reputational damage; sanctions; and loss of a required license. |
| What distinguishes a guideline from a standard? | A guideline provides recommended practices while an organizational standard establishes mandatory requirements. |
| What distinguishes an organizational security standard from a policy? | A standard defines specific mandatory requirements that implement the broader policy. |
| What does a legal hold require when relevant records reach their normal deletion date? | Suspend normal deletion and preserve the relevant records until the hold is properly released. |
| What does a right-to-audit clause provide in a vendor agreement? | Contractual permission to examine the vendor's relevant records and controls under agreed conditions. |
| What does annualized rate of occurrence measure? | ARO estimates the number of occurrences per year and can exceed 1 when multiple events are expected annually. |
| What information belongs in a risk register? | Risk descriptions; likelihood and impact estimates; risk owners; planned responses; and monitoring status. |
| What is a gap analysis? | A comparison of the current state against required or desired conditions to identify missing capabilities or unmet requirements. |
| What is a security policy? | A mandatory high-level statement of management intent and organizational security requirements. |
| What is a security procedure? | A documented sequence of steps for performing a security-related task consistently. |
| What is annualized loss expectancy and how is it calculated? | ALE estimates annual monetary loss for a risk; ALE = SLE × ARO. |
| What is residual risk? | The risk remaining after security controls and other risk responses have been applied. |
| What is risk appetite? | The broad amount and types of risk an organization is willing to pursue or retain while achieving its objectives. |
| What is single loss expectancy and how is it calculated? | SLE estimates the monetary loss from one event; SLE = asset value × exposure factor expressed as a decimal. |
| What is the purpose of a nondisclosure agreement? | An NDA establishes obligations restricting the use and disclosure of specified confidential information. |
| What is the purpose of a security baseline? | To establish an approved starting set of security controls or configuration requirements. |
| What is the purpose of an internal audit charter? | To formally establish the audit function's purpose and authority along with its responsibilities and scope. |
| What is vendor due diligence? | Investigating relevant supplier information to make informed decisions about acquisition and ongoing supplier risk. |
| What is vendor lock-in? | Dependence on a supplier that makes switching difficult or costly because of technical or contractual barriers. |
| What should awareness training teach employees to do when an email changes vendor payment instructions? | Verify the change through a trusted independent channel using previously established contact information. |
| What should penetration testing rules of engagement establish? | Authorized targets; permitted techniques; testing windows; operational limits; contacts; and conditions for stopping the test. |
| Which phishing simulation metrics help evaluate awareness training effectiveness? | Click rate; credential submission rate; reporting rate; and changes in those behaviors across comparable exercises. |
| Which platform can deliver security courses and track assignments and completion? | A learning management system or LMS. |
| Which policy defines permitted and prohibited uses of organizational technology? | An acceptable use policy or AUP. |
| Which privacy right allows an individual to request correction of inaccurate personal data? | The right to rectification or data correction. |
| Which vendor selection document gathers information about supplier capabilities before detailed requirements are finalized? | A request for information or RFI. |
| Which vendor selection document primarily requests pricing for clearly specified products or services? | A request for quote or RFQ. |
| Which vendor selection document requests proposed solutions to defined business requirements? | A request for proposal or RFP. |
| Why do auditors use sampling? | To examine selected items rather than the entire population while obtaining evidence relevant to the audit objective. |
| Why does a high training completion rate not prove that awareness training is effective? | Completion measures participation rather than whether employees apply safer security behaviors. |
Related Study Materials
About the Flashcards
Flashcards for the CompTIA Security+ exam provide a focused review of core governance and operational security concepts, including policies, standards, procedures, baselines, and acceptable use. They cover risk management fundamentals such as risk registers, appetite, residual risk, qualitative and quantitative assessment methods, and practical loss-estimation calculations like SLE, ARO, and ALE.
The deck also reinforces vendor and contract topics (RFI/RFP/RFQ, SLAs, MSAs, NDAs), privacy and compliance essentials (controller vs processor, GDPR rights, legal holds), distinctions between continuity and disaster recovery, testing and audit practices, and training and awareness metrics to help you master terminology and scenario-based exam questions.
Topics covered in this flashcard deck:
- Policies, standards, procedures
- Risk analysis and calculations
- Vendor and contract management
- Privacy and data protection
- Testing and auditing practices
- Training and awareness