Deck 4: Information Security Governance and Risk Management

Question 1

A countermeasure reduces the potential risk.

Answer 1

True

Question 2

The Zachman Framework is an enterprise architecture framework.

Answer 2

True

Question 3

The first step of a risk assessment is to identify threats and vulnerabilities.

Answer 3

False

Question 4

Tangible assets include intellectual property, data, and organizational reputation.

Question 5

A quantitative risk analysis does not assign monetary and numeric values to all facets of the risk analysis process.

Question 6

One of the disadvantages of qualitative risk analysis is that all results are subjective.

Question 7

After an organization understands its total and residual risk, it must determine how to get rid of the risk.

Question 8

Policies are broad and provide the foundation for development of standards, baselines, guidelines, and procedures.

Question 9

Commercial organizations usually classify data using five main classification levels: Top Secret, Secret, Confidential, Sensitive but Unclassified, and Unclassified.

Question 10

The data custodian implements the information classification and controls after they are determined.

Question 11

What is the probability that a threat agent will exploit vulnerability and the impact if the threat is carried out?

A) Exposure
B) Countermeasure
C) Risk
D) Due diligence

Question 12

Which of the following is an enterprise security architecture framework?

A) MODAF
B) TOGAF
C) ITIL
D) SABSA

Question 13

According to the NIST SP 800-30, what is the last step of a risk assessment?

A) Determine risk as a combination of likelihood and impact.
B) Identify impact.
C) Determine likelihood.
D) Identify threats.

Question 14

Which threat agent group includes malicious users?

A) Natural
B) Human
C) Technical
D) Operational

Question 15

Which calculation uses the formula AV × EF?

A) SLE
B) ARO
C) ALE
D) Cost-benefit analysis

Question 16

What is the calculation you should use for safeguard value?

A) (ALE before safeguard) + (ALE after safeguard) - (annual cost of safeguard)
B) (ALE before safeguard) - (ALE after safeguard) - (annual cost of safeguard)
C) (ALE before safeguard) - (ALE after safeguard) + (annual cost of safeguard)
D) (ALE before safeguard) + (ALE after safeguard) + (annual cost of safeguard)

Question 17

Which risk handling method defines the acceptable risk level the organization can tolerate and reduces the risk to that level?

A) Risk avoidance
B) Risk transfer
C) Risk mitigation
D) Risk acceptance

Question 18

What is a baseline?

A) Recommended actions that are more flexible than standards
B) All the detailed actions that personnel are required to follow
C) Mandatory actions that describe how policies will be implemented within an organization
D) A reference point defined and captured to be used as a future reference

Question 19

Which type of data includes patents, trade secrets, and other information that could seriously affect the government if unauthorized disclosure occurred?

A) Confidential
B) Top secret
C) Secret
D) Sensitive

Question 20

Which role evaluates the security needs of the organization and develops the internal information security governance documents?

A) Security administrator
B) Security analyst
C) Data custodian
D) Data owner