Deck 14: It Risk Analysis and Risk Management

Question 1

A given threat is usually associated with one risk

Answer 1

False

Question 2

If assessed using the NIST 800-39 framework, the risk estimate is an accurate measure of the IT risk facing the organization

Answer 2

False

Question 3

In the NIST 800-39 framework, risk monitoring

A) Addresses how organizations respond to risks
B) Identifies and aggregates the risks facing the organization
C) Describes the environment in which risk-based decisions are made
D) Evaluates the effectiveness of the organization's risk-management plan

Answer 3

D

Question 4

Section 302 of the Sarbanes-Oxley act of 2002 specifies that

A) Penalties for non-compliance with the law
B) Attestations are made in accordance with PCAOB standards
C) Signing officers take personal responsibility for the reported financial statements
D) Privacy requirements for healthcare records

Question 5

The motivation for the passage of the Sarbanes-Oxley act was

A) Failure of Internet technologies
B) Denial of culpability by senior executives for falsification of records
C) To prevent stock market crashes
D) To recover retiree savings

Question 6

Section 404 of the Sarbanes-Oxley act of 2002 specifies that

A) The signing officer has reviewed financial statements
B) Penalties for non-compliance with the law
C) Privacy requirements for healthcare records have been followed
D) Attestations are made in accordance with PCAOB standards

Question 7

In the NIST 800-39 framework, risk response

A) Addresses how organizations respond to risks
B) Identifies and aggregates the risks facing the organization
C) Describes the environment in which risk-based decisions are made
D) Evaluates the effectiveness of the organization's risk-management plan

Question 8

The NIST risk management framework includes

A) Profits, losses
B) Agent, action, asset
C) Assets, threats, vulnerabilities, controls
D) Frame, assess, monitor, respond

Question 9

The management model that guides the ISO risk management methodology is

A) Toyota's Muda, Kaizen, Jidoka, Muri
B) Juran's planning, control, improvement
C) Shewart's mean, range, standard error
D) Deming's Plan-Do-Check-Act

Question 10

IT risk is

A) The risk associated with the use of IT in an organization
B) A quantified measure of the potential damage caused by a specified threat
C) IT resource or information that is to be protected
D) Weaknesses in an IT system that can lead to a compromise of an asset

Question 11

A certain risk has a 1% likelihood of occurrence in the coming year. If the risk is observed, the organization estimates a loss of $1million. The risk is then assessed as

A) 1%
B) $1,000,000
C) 1,000
D) $10,000

Question 12

The Sarbanes-Oxley act applies to

A) Internal control over financial reporting by publicly traded companies
B) Internal control over financial reporting by all financial entities
C) Privacy of healthcare information
D) External audits of publicly traded companies

Question 13

Risk is

A) A quantified measure of the potential damage caused by a specified threat
B) Capabilities, intentions and attack methods of adversaries to cause harm to assets
C) Resource or information that is to be protected
D) Weaknesses in an information system that can lead to a compromise of an asset

Question 14

Risk is quantified by taking the product of

A) Hours and hourly rates
B) GDP and growth rate
C) Likelihood and magnitude
D) Risk frame and risk assessment

Question 15

As described in the text, a statement of a risk includes

A) Agent, threat, asset, damage
B) Agent, action, damage, threat
C) Agent, action, asset, damage
D) Threat, asset, action, damage

Question 16

In the NIST 800-39 framework, risk assessment

A) Addresses how organizations respond to risks
B) Identifies and aggregates the risks facing the organization
C) Describes the environment in which risk-based decisions are made
D) Evaluates the effectiveness of the organization's risk-management plan

Question 17

A certain risk has a 1% likelihood of occurrence in the coming year. If the risk is observed, the organization estimates a loss of $1million. A second risk has a 15% likelihood of occurrence in the coming year. If the second risk is observed, the organization estimates a loss of $100,000. Comparing the two risks

A) Risk 2 is greater than risk 1
B) Risk 1 is greater than risk 2
C) Risk 2 is equal to risk 1
D) Risk 2 is negligible

Question 18

The NIST risk-management framework is specified in the NIST document

A) 27002
B) 404
C) 800-39
D) 27000

Question 19

In the NIST 800-39 framework, the risk frame

A) Addresses how organizations respond to risks
B) Identifies and aggregates the risks facing the organization
C) Describes the environment in which risk-based decisions are made
D) Evaluates the effectiveness of the organization's risk-management plan

Question 20

Risk management is

A) A quantified measure of the potential damage caused by a specified threat
B) Managing the financial impacts of unusual events
C) Avoiding risks
D) Avoiding uncertainty

Question 21

The verification of IT general controls as part of a SOX audit follows a

A) Top-down procedure
B) Bottom-up procedure
C) Either of the above, depending upon the organization
D) Both the above, to ensure comprehensive coverage

Question 22

Internal controls over financial reporting involve all of the following except

A) A process
B) Supervision of the company's principal executives
C) Profit guidance
D) Maintenance of records

Question 23

Section 906 of the Sarbanes-Oxley act of 2002 specifies

A) Penalties for non-compliance with the law
B) That the signing officer has reviewed financial statements
C) Privacy requirements for healthcare records have been followed
D) That attestations are made in accordance with PCAOB standards

Question 24

IT general controls are controls that

A) Only affect non-financial systems such as email systems
B) Involve the most important financial applications
C) Are directly supervised by the organization's senior leadership
D) Involve the underlying IT systems which support financial applications

Question 25

The PCAOB created by the Sarbanes-Oxley act of 2002

A) Defines the format of annual financial reports
B) Oversees auditors and defines auditing standards
C) Performs independent audits of suspect firms
D) Regulates the stock market