LF11bV2 Deck 5

Question 1

IT-Risikomanagement

Answer 1

Kontinuierlicher Prozess Identifikation Analyse Behandlung Überwachung von IT-Risiken

Question 2

Risikobasierte Ansatz

Answer 2

Entscheidungen basierend auf Risikobewertung nicht nur Compliance

Question 3

Residual Risk

Answer 3

Verbleibendes Risiko nach Gegenmaßnahmen Akzeptanz notwendig

Question 4

Risk Appetite

Answer 4

Maximal akzeptierbares Risiko Unternehmen definiert vom Management

Question 5

Risk Tolerance

Answer 5

Tatsächliche Risikobereitschaft Abweichung von Appetite

Question 6

Qualitative Risikobewertung

Answer 6

Hoch Mittel Niedrig Verbal Traffic Light System

Question 7

Quantitative Risikobewertung

Answer 7

Geldwerte ALE Annualized Loss Expectancy

Question 8

ALE Annualized Loss Expectancy

Answer 8

ARO x SLE Annualized Rate of Occurrence x Single Loss Expectancy

Question 9

ROE Return on Security Investment

Answer 9

Kosten-Nutzen-Verhältnis Sicherheitsmaßnahmen

Question 10

BCP Business Continuity Plan

Answer 10

Geschäftskontinuität bei Ausfall RTO RPO definieren

Question 11

DRP Disaster Recovery Plan

Answer 11

Daten System-Wiederherstellung Backup Strategy

Question 12

RTO Recovery Time Objective

Answer 12

Maximal akzeptierte Ausfallzeit kritische Systeme

Question 13

RPO Recovery Point Objective

Answer 13

Maximaler Datenverlust Minuten Stunden

Question 14

Hot Site

Answer 14

Vollständig ausgestatteter Replikationsstandort sofort einsatzbereit

Question 15

Warm Site

Answer 15

Teilausstattung Konfiguration vorhanden Update erforderlich

Question 16

Cold Site

Answer 16

Raum Strom Netzwerk vorhanden komplette Ausstattung nötig

Question 17

Chaos Engineering

Answer 17

Kontrollierte Ausfälle Test Resilienz Netflix Chaos Monkey

Question 18

Digital Forensics

Answer 18

Wissenschaftliche Untersuchung digitaler Spuren Gerichtsverwertbarkeit

Question 19

Chain of Custody

Answer 19

Dokumentation Beweismittel Integrität Gerichtsverfahren

Question 20

Memory Forensics

Answer 20

Volatile RAM-Analyse laufender Malware Prozesse

Question 21

Timeline Analysis

Answer 21

Chronologische Rekonstruktion Incident Verlauf Super-Timeline

Question 22

IOC Hunting

Answer 22

Suche nach Indicators of Compromise Hash IP Domain YARA Rules

Question 23

YARA Rules

Answer 23

Pattern-Matching Regeln Malware IOC Erkennung

Question 24

Threat Intelligence

Answer 24

Strukturierte Bedrohungsinformationen STIX TAXII

Question 25

MITRE ATT&CK Navigator

Answer 25

Taktik-Technik Mapping Incident Coverage

Question 26

Purple Teaming

Answer 26

Red Blue Kollaboration kontinuierliches Lernen

Question 27

Gamification SecOps

Answer 27

CTF Capture The Flag Security Challenges

Question 28

DevSecOps

Answer 28

Security in DevOps-Pipeline Shift Left IaC Security

Question 29

SBOM Software Bill of Materials

Answer 29

Komponentenliste Software Lieferkette

Question 30

SBOM Tools

Answer 30

Syft Grype CycloneDX SPDX Generation Analyse

Question 31

Zero Trust Architecture

Answer 31

Verify Explicitly Never Trust Always Assume Breach

Question 32

ZTNA Zero Trust Network Access

Answer 32

Per-App Zugriff Identity-basierend

Question 33

SASE Secure Access Service Edge

Answer 33

Cloud-native Security Networking Convergence

Question 34

CASB Cloud Access Security Broker

Answer 34

SaaS Shadow IT DLP CASB

Question 35

CSPM Cloud Security Posture Management

Answer 35

Cloud-Konfigurationsfehler Erkennung

Question 36

CNAPP Cloud Native Application Protection Platform

Answer 36

CSPM CWPP Convergence

Question 37

CWPP Cloud Workload Protection Platform

Answer 37

Container Kubernetes Runtime Security

Question 38

FAISS Federated AI Security Information Sharing

Answer 38

Bedrohungsinfos anonymisiert teilen

Question 39

XDR Extended Detection Response

Answer 39

Multi-Source Korrelation EDR NDR SIEM

Question 40

NDR Network Detection Response

Answer 40

Netzwerk-basierte Threat Detection ML

Question 41

UEBA User Behavior Analytics

Answer 41

Insider Threat Erkennung ML-basierend

Question 42

SOAR Playbooks

Answer 42

Automatisierte Incident Response Workflows

Question 43

Attack Surface Management

Answer 43

Externe Assets Scannen ASM Continuous

Question 44

Dark Web Monitoring

Answer 44

Forum Leak Monitoring Credential Stuffing

Question 45

Brand Protection

Answer 45

Domain Phishing Site Take-down Monitoring

Question 46

Supply Chain Risk Management

Answer 46

Vendor Assessment Third-Party Risk

Question 47

GRC Governance Risk Compliance

Answer 47

Policy Management Audit Trail

Question 48

GXP GMP GAMP5

Answer 48

Pharma Life Sciences Compliance Validierung

Question 49

FedRAMP

Answer 49

US Federal Cloud Authorization Standards

Question 50

CISA Known Exploited Vulnerabilities

Answer 50

US Agency CISA aktiv ausgenutzte Schwachstellen

Question 51

Supply Chain Levels for Software

Answer 51

SLSA Integrity Guarantees Build Pipeline

Question 52

SBOM Attestation

Answer 52

Signierte Komponentenliste Integrität Supply Chain

Question 53

Critical Design Review

Answer 53

Architektur Security Review vor Entwicklung

Question 54

Threat Modeling

Answer 54

STRIDE DREAD Attack Trees Design Phase

Question 55

Privacy by Design

Answer 55

Datenschutz Entwicklungsintegration GDPR Art.25

Question 56

Secure SDLC

Answer 56

Security in gesamtem Software Development Lifecycle

Question 57

Container Image Scanning

Answer 57

Docker Registry Scans Vulnerabilities Malware

Question 58

Kubernetes RBAC

Answer 58

Role-Based Access Control Namespaces ServiceAccounts

Question 59

Istio Service Mesh

Answer 59

Zero Trust Networking mTLS Observability

Question 60

eBPF Extended Berkeley Packet Filter

Answer 60

Kernel Tracing Security Observability

Question 61

Falco Runtime Security

Answer 61

Container Cloud-Native Intrusion Detection

Question 62

Tetragon eBPF-based Security

Answer 62

Kubernetes Observability Enforcement

Question 63

Wazuh Open Source SIEM

Answer 63

Endpoint Log Management Compliance

Question 64

OSSEC Host-based IDS

Answer 64

File Integrity Rootkit Detection

Question 65

Suricata Network IDS IPS

Answer 65

Multi-Threaded Signature Anomaly Detection

Question 66

Zeek Bro IDS

Answer 66

Network Analysis Protocol Parsing

Question 67

Elastic Security

Answer 67

ELK Stack SIEM Endpoint ML