- Welcome to Lesson 1 Deep Dive Quiz.
Now, this is the first of many, many,
Deep Dive Quizzes we're gonna do together.
Matter of fact, you're gonna find one of these
at the end of every lesson.
Now, some of the quizzes will have five questions,
and some will have ten depending on
how much material there was in the lesson.
So, we're focusing on Lesson 1,
which was Compare and Contrast
Various Types of Security Controls,
and there were two sub lessons in Lesson 1.
1.1 Control Objectives and
1.2 Control Categories and Classifications.
So, are you ready? Alright, we're gonna start this quiz.
Feel free to put me on pause anytime
that you wanna think about an answer, right?
And then take me off pause,
and we'll go through the answer together.
So, let's start our quiz. Question one.
Which statement does not describe
how controls minimize risk?
Remember, we said that controls had to
meet one of three criteria.
Controls reduce or eliminate the impact of an exploit.
Controls reduce or eliminate vulnerabilities.
Controls reduce or eliminate expenses.
Or controls reduce or eliminate the likelihood of exploit.
Now, this question is a really good example of why
it's so important to read the question
carefully, slowly, and for comprehension
because the key word in this question is the word not.
Which statement does not describe
how controls minimize risk?
Three of these statements do describe
how controls minimize risk.
One does not. So, go ahead and make your choice.
I am gonna choose the third one.
Controls reduce or eliminate expense.
Let's see if we're right. And that is correct.
Now, could a control reduce or eliminate expense?
Absolutely.
It may well do that,
but that's not one of our criteria for controls.
Our criteria was to reduce or eliminate
the impact of an exploit,
reduce or eliminate vulnerabilities,
or reduce or eliminate the likelihood of exploit.
Alright, let's continue on.
Which statement best describes control effectiveness?
Effectiveness is how well a control works.
Effectiveness is how much value a control adds.
Effectiveness is how often a control is used.
Effectiveness is what a control does.
Which statement best describes control effectiveness?
And don't ever hesitate to put me on pause
while you're thinking this through.
Well, I'm going to say effectiveness,
going up to the top, is how well a control works.
Okay. It's not really how much value a control adds.
Doesn't really reflect how often it's used.
And what a control does, that would be functionality.
So, I like our first choice.
Effectiveness is how well a control works.
Do you agree? Let's check it out. And that is correct.
Alright, let's move on to our third question.
A new exploit is in the wild.
After conducting a threat assessment,
it has been determined that your organization is at risk.
Fortunately, threat intelligence has detailed information on
deterrent and detective mechanisms
that should be implemented.
Which term best describes the mechanisms?
Defense-in-depth. Controls. Control baseline.
Or countermeasure. This is a tough one.
So, really what we've learned is there's this new exploit,
so a new threat,
and there's something that we can specifically do.
There's some deterrent and detective mechanism that
we can specifically implement for that particular threat.
Defense-in-depth. Control. Control baseline.
Or countermeasure. What do you like?
Well, I like the last one. Countermeasure.
Alright, defense-in-depth means that
we have multiple layers of controls,
which we do have here.
Perhaps we have deterrent and detective,
but that doesn't really describe what we're accomplishing.
We know that we're putting a control in place,
so we're not gonna use control.
And it's not a control baseline.
Remember, a countermeasure is a reactive process.
One that we're doing in reaction, right, to a threat.
So, we're reacting to this particular threat, right?
This new exploit in the wild,
and so our controls that we're implementing,
those deterrent and detective,
will be very, very, effective.
Specifically, effective for that threat
but not broadly efficient like our
normal set of controls are.
So countermeasure's what we'd be looking for here.
Do you agree? Let's check it out. And that is correct.
Alright, question four.
Here's where we're gonna match
the control classifications and descriptions.
We have directive controls, detective controls,
preventative controls, deterrent controls.
Down the right hand side,
stop a threat agent from being successful.
Identify and report a threat agent.
Discourage a threat agent from acting.
Or used to increase effectiveness of other controls.
For example, training.
So, looking down those.
Starting with directive at the top,
which one of these best describes a directive control?
Stops a threat agent from being successful,
identifies and reports a threat agent,
discourages a threat agent,
or used to increase the effectiveness of other controls?
Again, you can put me on pause anytime
while you're doing this.
I'm gonna choose
"used to increase the effectiveness of other controls."
Next is detective.
Well, we know that a detective is
identifying and reports on a threat agent.
So look, it's right there. I put it together.
Now, I've got preventative and deterrent
as my last two options,
and my descriptions were
"discourage a threat agent from acting"
or "stop a threat agent from being successful."
We know that preventative is to
stop a threat agent from being successful,
and deterrent is designed to
discourage a threat agent from acting.
So our recap, directive used to
increase the effectiveness of other controls.
Detective identifies and reports a threat agent.
Preventative stops a threat agent from being successful.
And deterrent discourages a threat agent from acting.
Do you agree? Let's check it out. And those are correct.
Alight, our last question.
This one is gonna be drag and drop.
We're gonna drag and drop the words
to complete the sentences,
so let's read the sentences together first.
Blank refers to eliminating unnecessary controls.
Blank refers to customizing controls.
Blank refers to substituting controls,
and blank refers to adding controls.
And the options we have are tailoring, organizing,
compensating, baselining, supplementing, and scoping.
Now, we're not gonna use all of them,
but we're gonna drag and drop the words
to complete the sentence correctly.
If you want, put me on pause while you think about it.
Alright, so blank refers to
eliminating unnecessary controls.
That is going to be scoping.
Blank refers to customizing controls.
Hm, that's gonna be when we just fine tune them beautifully.
I like tailoring right there.
Blank refers to substituting. Ah, that must be compensating.
And blank refers to adding. I like supplementing.
So, let's recap.
Scoping refers to eliminating unnecessary controls.
Tailoring refers to customizing controls.
Compensating refers to substituting controls,
and supplementing refers to adding controls.
We didn't use the terms organizing or baselining.
Do you agree? Let's check it out. And those are correct.
Alright, good work. I hope that you enjoyed doing these.
We're going to do these for every lesson,
and really get in the habit of putting me on pause
between each question and writing down the questions
or at least thinking through them in your head.
So you're not just listening to me, alright?
You're really engaged in the quiz.
Congratulations, we did a great job. What's coming up next?
We're gonna go right into Lesson 2
Summarize Fundamental Security Concepts.
I'll see you there.