Risk Management & Security Architecture Flashcards
6 cards from real CMA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Management & Security Architecture flashcards as text
In security architecture, which framework published by NIST provides a risk-based approach to managing cybersecurity risk through five core functions: Identify, Protect, Detect, Respond, and Recover?
Answer: NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five concurrent and continuous functions to help organizations manage and reduce risk.
Which risk treatment option involves shifting the financial impact of a risk to a third party, such as through cyber insurance?
Answer: Risk Transfer
Risk Transfer moves the financial consequence of a risk to another party—such as an insurer or outsourcing vendor—without eliminating the underlying threat.
A CMA architect is designing a system with the requirement that no single failure should cause complete service unavailability. Which security and resilience principle addresses this?
Answer: Single Point of Failure Elimination
Eliminating Single Points of Failure ensures that no individual component can bring down an entire system, supporting both availability and resilience goals.
Which formula correctly represents the basic calculation of risk in a risk management context?
Answer: Risk = Threat × Vulnerability × Impact
Risk is commonly calculated as the product of Threat likelihood, Vulnerability exposure, and the potential Impact of exploitation.
In the SABSA security architecture framework, which layer defines the business context and security policies at the executive stakeholder level?
Answer: Contextual Layer
The Contextual Layer in SABSA captures the business context—why security is needed—from the perspective of executive stakeholders and business drivers.
Which US federal regulation requires organizations handling protected health information (PHI) to implement technical, physical, and administrative security safeguards?
Answer: HIPAA Security Rule
The HIPAA Security Rule mandates that covered entities and business associates implement safeguards to protect the confidentiality, integrity, and availability of electronic PHI.