1
00:00:06,600 --> 00:00:09,810
- Welcome to Lesson 1 Deep Dive Quiz.

2
00:00:09,810 --> 00:00:12,360
Now, this is the first of many, many,

3
00:00:12,360 --> 00:00:14,190
Deep Dive Quizzes we're gonna do together.

4
00:00:14,190 --> 00:00:15,570
Matter of fact, you're
gonna find one of these

5
00:00:15,570 --> 00:00:17,115
at the end of every lesson.

6
00:00:17,115 --> 00:00:18,915
Now, some of the quizzes
will have five questions,

7
00:00:18,915 --> 00:00:20,766
and some will have ten depending on

8
00:00:20,766 --> 00:00:22,935
how much material there was in the lesson.

9
00:00:22,935 --> 00:00:24,973
So, we're focusing on Lesson 1,

10
00:00:24,973 --> 00:00:26,820
which was Compare and Contrast

11
00:00:26,820 --> 00:00:28,190
Various Types of Security Controls,

12
00:00:28,190 --> 00:00:30,930
and there were two sub
lessons in Lesson 1.

13
00:00:30,930 --> 00:00:32,619
1.1 Control Objectives and

14
00:00:32,619 --> 00:00:36,840
1.2 Control Categories
and Classifications.

15
00:00:36,840 --> 00:00:39,570
So, are you ready? Alright,
we're gonna start this quiz.

16
00:00:39,570 --> 00:00:42,147
Feel free to put me on pause anytime

17
00:00:42,147 --> 00:00:45,060
that you wanna think
about an answer, right?

18
00:00:45,060 --> 00:00:46,650
And then take me off pause,

19
00:00:46,650 --> 00:00:47,970
and we'll go through the answer together.

20
00:00:47,970 --> 00:00:51,540
So, let's start our quiz. Question one.

21
00:00:51,540 --> 00:00:53,079
Which statement does not describe

22
00:00:53,079 --> 00:00:55,515
how controls minimize risk?

23
00:00:55,515 --> 00:00:58,140
Remember, we said that controls had to

24
00:00:58,140 --> 00:00:59,895
meet one of three criteria.

25
00:00:59,895 --> 00:01:03,210
Controls reduce or eliminate
the impact of an exploit.

26
00:01:03,210 --> 00:01:05,128
Controls reduce or
eliminate vulnerabilities.

27
00:01:05,128 --> 00:01:07,860
Controls reduce or eliminate expenses.

28
00:01:07,860 --> 00:01:11,340
Or controls reduce or eliminate
the likelihood of exploit.

29
00:01:11,340 --> 00:01:14,670
Now, this question is a
really good example of why

30
00:01:14,670 --> 00:01:16,950
it's so important to read the question

31
00:01:16,950 --> 00:01:19,056
carefully, slowly, and for comprehension

32
00:01:19,056 --> 00:01:24,056
because the key word in this
question is the word not.

33
00:01:24,240 --> 00:01:26,624
Which statement does not describe

34
00:01:26,624 --> 00:01:28,980
how controls minimize risk?

35
00:01:28,980 --> 00:01:30,960
Three of these statements do describe

36
00:01:30,960 --> 00:01:32,550
how controls minimize risk.

37
00:01:32,550 --> 00:01:35,433
One does not. So, go ahead
and make your choice.

38
00:01:37,890 --> 00:01:39,780
I am gonna choose the third one.

39
00:01:39,780 --> 00:01:42,513
Controls reduce or eliminate expense.

40
00:01:43,860 --> 00:01:47,580
Let's see if we're right.
And that is correct.

41
00:01:47,580 --> 00:01:50,130
Now, could a control reduce
or eliminate expense?

42
00:01:50,130 --> 00:01:50,963
Absolutely.

43
00:01:50,963 --> 00:01:52,234
It may well do that,

44
00:01:52,234 --> 00:01:55,740
but that's not one of our
criteria for controls.

45
00:01:55,740 --> 00:01:58,020
Our criteria was to reduce or eliminate

46
00:01:58,020 --> 00:01:59,640
the impact of an exploit,

47
00:01:59,640 --> 00:02:01,380
reduce or eliminate vulnerabilities,

48
00:02:01,380 --> 00:02:04,791
or reduce or eliminate
the likelihood of exploit.

49
00:02:04,791 --> 00:02:06,573
Alright, let's continue on.

50
00:02:07,830 --> 00:02:11,670
Which statement best describes
control effectiveness?

51
00:02:11,670 --> 00:02:13,817
Effectiveness is how well a control works.

52
00:02:13,817 --> 00:02:17,250
Effectiveness is how much
value a control adds.

53
00:02:17,250 --> 00:02:20,000
Effectiveness is how
often a control is used.

54
00:02:20,000 --> 00:02:22,983
Effectiveness is what a control does.

55
00:02:23,910 --> 00:02:27,150
Which statement best describes
control effectiveness?

56
00:02:27,150 --> 00:02:28,950
And don't ever hesitate to put me on pause

57
00:02:28,950 --> 00:02:30,700
while you're thinking this through.

58
00:02:32,580 --> 00:02:34,890
Well, I'm going to say effectiveness,

59
00:02:34,890 --> 00:02:38,850
going up to the top, is
how well a control works.

60
00:02:38,850 --> 00:02:42,660
Okay. It's not really how
much value a control adds.

61
00:02:42,660 --> 00:02:45,060
Doesn't really reflect
how often it's used.

62
00:02:45,060 --> 00:02:47,970
And what a control does,
that would be functionality.

63
00:02:47,970 --> 00:02:49,770
So, I like our first choice.

64
00:02:49,770 --> 00:02:52,290
Effectiveness is how well a control works.

65
00:02:52,290 --> 00:02:56,417
Do you agree? Let's check
it out. And that is correct.

66
00:02:56,417 --> 00:02:59,363
Alright, let's move on
to our third question.

67
00:02:59,363 --> 00:03:01,642
A new exploit is in the wild.

68
00:03:01,642 --> 00:03:03,840
After conducting a threat assessment,

69
00:03:03,840 --> 00:03:08,190
it has been determined that
your organization is at risk.

70
00:03:08,190 --> 00:03:11,097
Fortunately, threat intelligence
has detailed information on

71
00:03:11,097 --> 00:03:15,180
deterrent and detective mechanisms

72
00:03:15,180 --> 00:03:17,640
that should be implemented.

73
00:03:17,640 --> 00:03:20,229
Which term best describes the mechanisms?

74
00:03:20,229 --> 00:03:25,036
Defense-in-depth.
Controls. Control baseline.

75
00:03:25,036 --> 00:03:29,280
Or countermeasure. This is a tough one.

76
00:03:29,280 --> 00:03:31,710
So, really what we've learned
is there's this new exploit,

77
00:03:31,710 --> 00:03:32,940
so a new threat,

78
00:03:32,940 --> 00:03:35,813
and there's something that
we can specifically do.

79
00:03:35,813 --> 00:03:38,550
There's some deterrent and
detective mechanism that

80
00:03:38,550 --> 00:03:43,360
we can specifically implement
for that particular threat.

81
00:03:43,360 --> 00:03:47,820
Defense-in-depth.
Control. Control baseline.

82
00:03:47,820 --> 00:03:51,513
Or countermeasure. What do you like?

83
00:03:53,520 --> 00:03:56,970
Well, I like the last one. Countermeasure.

84
00:03:56,970 --> 00:03:58,200
Alright, defense-in-depth means that

85
00:03:58,200 --> 00:03:59,700
we have multiple layers of controls,

86
00:03:59,700 --> 00:04:00,930
which we do have here.

87
00:04:00,930 --> 00:04:03,300
Perhaps we have deterrent and detective,

88
00:04:03,300 --> 00:04:06,996
but that doesn't really describe
what we're accomplishing.

89
00:04:06,996 --> 00:04:09,450
We know that we're putting
a control in place,

90
00:04:09,450 --> 00:04:10,500
so we're not gonna use control.

91
00:04:10,500 --> 00:04:12,210
And it's not a control baseline.

92
00:04:12,210 --> 00:04:14,880
Remember, a countermeasure
is a reactive process.

93
00:04:14,880 --> 00:04:18,420
One that we're doing in
reaction, right, to a threat.

94
00:04:18,420 --> 00:04:21,720
So, we're reacting to this
particular threat, right?

95
00:04:21,720 --> 00:04:23,460
This new exploit in the wild,

96
00:04:23,460 --> 00:04:26,400
and so our controls
that we're implementing,

97
00:04:26,400 --> 00:04:28,050
those deterrent and detective,

98
00:04:28,050 --> 00:04:30,330
will be very, very, effective.

99
00:04:30,330 --> 00:04:32,370
Specifically, effective for that threat

100
00:04:32,370 --> 00:04:33,880
but not broadly efficient like our

101
00:04:33,880 --> 00:04:36,383
normal set of controls are.

102
00:04:36,383 --> 00:04:39,180
So countermeasure's what
we'd be looking for here.

103
00:04:39,180 --> 00:04:44,103
Do you agree? Let's check
it out. And that is correct.

104
00:04:46,004 --> 00:04:47,820
Alright, question four.

105
00:04:47,820 --> 00:04:49,230
Here's where we're gonna match

106
00:04:49,230 --> 00:04:52,350
the control classifications
and descriptions.

107
00:04:52,350 --> 00:04:54,660
We have directive controls,
detective controls,

108
00:04:54,660 --> 00:04:57,240
preventative controls, deterrent controls.

109
00:04:57,240 --> 00:04:58,980
Down the right hand side,

110
00:04:58,980 --> 00:05:01,740
stop a threat agent from being successful.

111
00:05:01,740 --> 00:05:03,860
Identify and report a threat agent.

112
00:05:03,860 --> 00:05:06,550
Discourage a threat agent from acting.

113
00:05:06,550 --> 00:05:09,990
Or used to increase
effectiveness of other controls.

114
00:05:09,990 --> 00:05:11,373
For example, training.

115
00:05:12,660 --> 00:05:14,520
So, looking down those.

116
00:05:14,520 --> 00:05:16,860
Starting with directive at the top,

117
00:05:16,860 --> 00:05:21,120
which one of these best
describes a directive control?

118
00:05:21,120 --> 00:05:23,250
Stops a threat agent
from being successful,

119
00:05:23,250 --> 00:05:24,990
identifies and reports a threat agent,

120
00:05:24,990 --> 00:05:26,580
discourages a threat agent,

121
00:05:26,580 --> 00:05:30,255
or used to increase the
effectiveness of other controls?

122
00:05:30,255 --> 00:05:31,739
Again, you can put me on pause anytime

123
00:05:31,739 --> 00:05:34,140
while you're doing this.

124
00:05:34,140 --> 00:05:35,493
I'm gonna choose

125
00:05:35,493 --> 00:05:39,637
"used to increase the
effectiveness of other controls."

126
00:05:39,637 --> 00:05:42,180
Next is detective.

127
00:05:42,180 --> 00:05:43,830
Well, we know that a detective is

128
00:05:43,830 --> 00:05:46,800
identifying and reports on a threat agent.

129
00:05:46,800 --> 00:05:49,143
So look, it's right
there. I put it together.

130
00:05:50,460 --> 00:05:52,140
Now, I've got preventative and deterrent

131
00:05:52,140 --> 00:05:53,670
as my last two options,

132
00:05:53,670 --> 00:05:55,117
and my descriptions were

133
00:05:55,117 --> 00:05:57,360
"discourage a threat agent from acting"

134
00:05:57,360 --> 00:05:59,807
or "stop a threat agent
from being successful."

135
00:05:59,807 --> 00:06:02,490
We know that preventative is to

136
00:06:02,490 --> 00:06:04,710
stop a threat agent from being successful,

137
00:06:04,710 --> 00:06:06,237
and deterrent is designed to

138
00:06:06,237 --> 00:06:08,793
discourage a threat agent from acting.

139
00:06:10,050 --> 00:06:11,790
So our recap, directive used to

140
00:06:11,790 --> 00:06:14,010
increase the effectiveness
of other controls.

141
00:06:14,010 --> 00:06:17,010
Detective identifies and
reports a threat agent.

142
00:06:17,010 --> 00:06:19,980
Preventative stops a threat
agent from being successful.

143
00:06:19,980 --> 00:06:23,850
And deterrent discourages
a threat agent from acting.

144
00:06:23,850 --> 00:06:28,850
Do you agree? Let's check it
out. And those are correct.

145
00:06:29,003 --> 00:06:31,290
Alight, our last question.

146
00:06:31,290 --> 00:06:33,360
This one is gonna be drag and drop.

147
00:06:33,360 --> 00:06:35,622
We're gonna drag and drop the words

148
00:06:35,622 --> 00:06:36,455
to complete the sentences,

149
00:06:36,455 --> 00:06:38,460
so let's read the
sentences together first.

150
00:06:38,460 --> 00:06:41,778
Blank refers to eliminating
unnecessary controls.

151
00:06:41,778 --> 00:06:44,672
Blank refers to customizing controls.

152
00:06:44,672 --> 00:06:47,580
Blank refers to substituting controls,

153
00:06:47,580 --> 00:06:50,670
and blank refers to adding controls.

154
00:06:50,670 --> 00:06:53,897
And the options we have
are tailoring, organizing,

155
00:06:53,897 --> 00:06:58,897
compensating, baselining,
supplementing, and scoping.

156
00:06:59,250 --> 00:07:00,720
Now, we're not gonna use all of them,

157
00:07:00,720 --> 00:07:02,190
but we're gonna drag and drop the words

158
00:07:02,190 --> 00:07:04,350
to complete the sentence correctly.

159
00:07:04,350 --> 00:07:07,800
If you want, put me on pause
while you think about it.

160
00:07:07,800 --> 00:07:10,470
Alright, so blank refers to

161
00:07:10,470 --> 00:07:12,660
eliminating unnecessary controls.

162
00:07:12,660 --> 00:07:14,763
That is going to be scoping.

163
00:07:15,750 --> 00:07:18,300
Blank refers to customizing controls.

164
00:07:18,300 --> 00:07:21,150
Hm, that's gonna be when we
just fine tune them beautifully.

165
00:07:21,150 --> 00:07:23,280
I like tailoring right there.

166
00:07:23,280 --> 00:07:28,140
Blank refers to substituting.
Ah, that must be compensating.

167
00:07:28,140 --> 00:07:32,700
And blank refers to adding.
I like supplementing.

168
00:07:32,700 --> 00:07:33,870
So, let's recap.

169
00:07:33,870 --> 00:07:36,603
Scoping refers to eliminating
unnecessary controls.

170
00:07:36,603 --> 00:07:39,114
Tailoring refers to customizing controls.

171
00:07:39,114 --> 00:07:42,330
Compensating refers to
substituting controls,

172
00:07:42,330 --> 00:07:45,090
and supplementing refers
to adding controls.

173
00:07:45,090 --> 00:07:48,720
We didn't use the terms
organizing or baselining.

174
00:07:48,720 --> 00:07:53,720
Do you agree? Let's check it
out. And those are correct.

175
00:07:54,390 --> 00:07:56,520
Alright, good work. I hope
that you enjoyed doing these.

176
00:07:56,520 --> 00:07:58,320
We're going to do these for every lesson,

177
00:07:58,320 --> 00:08:00,660
and really get in the habit
of putting me on pause

178
00:08:00,660 --> 00:08:03,600
between each question and
writing down the questions

179
00:08:03,600 --> 00:08:05,526
or at least thinking
through them in your head.

180
00:08:05,526 --> 00:08:07,860
So you're not just
listening to me, alright?

181
00:08:07,860 --> 00:08:10,053
You're really engaged in the quiz.

182
00:08:11,910 --> 00:08:15,030
Congratulations, we did a great
job. What's coming up next?

183
00:08:15,030 --> 00:08:16,710
We're gonna go right into Lesson 2

184
00:08:16,710 --> 00:08:19,110
Summarize Fundamental Security Concepts.

185
00:08:19,110 --> 00:08:20,060
I'll see you there.