Deck 14: IT Security Management and Risk Assessment

Question 1

__________ ensures that critical assets are sufficiently protected in a cost-effective manner.

A) IT control
B) IT security management
C) IT discipline
D) IT risk implementations

Answer 1

B

Question 2

Organizational security objectives identify what IT security outcomesshould be achieved.

Answer 2

True

Question 3

A major disadvantage of the baseline risk assessment approach is thesignificant cost in time, resources, and expertise needed to performthe analysis.

Answer 3

False

Question 4

Because the responsibility for IT security is shared across theorganization, there is a risk of inconsistent implementation of security and a loss of central monitoring and control.

Question 5

IT security management functions include:

A) determining organizational IT security objectives, strategies, and policies
B) detecting and reacting to incidents
C) specifying appropriate safeguards
D) all of the above

Question 6

Maintaining and improving the information security risk management processin response to incidents is part of the _________ step.

A) act
B) plan
C) check
D) do

Question 7

A major advantage of the informal approach is that the individualsperforming the analysis require no additional skills.

Question 8

Implementing the risk treatment plan is part of the ______ step.

A) check
B) act
C) do
D) plan

Question 9

Detecting and reacting to incidents is not a function of IT securitymanagement.

Question 10

The assignment of responsibilities relating to the management of ITsecurity and the organizational infrastructure is not addressed in acorporate security policy.

Question 11

IT security needs to be a key part of an organization's overallmanagement plan.

Question 12

Organizational security policies identify what needs to be done.

Question 13

IT security management consists of first determining a clear view of anorganization's IT security objectives and general risk profile.

Question 14

Legal and regulatory constraints may require specific approaches torisk assessment.

Question 15

One asset may have multiple threats and a single threat may targetmultiple assets.

Question 16

A threat may be either natural or human made and may be accidentalor deliberate.

Question 17

Once the IT management process is in place and working the processnever needs to be repeated.

Question 18

The ________ has revised and consolidated a number of national and international standards into a consensus of best practice.

A) ISO
B) CSI
C) VSB
D) DBI

Question 19

IT security management has evolved considerably over the last fewdecades due to the rise in risks to networked systems.

Question 20

It is not critical that an organization's IT security policy have fullapproval or buy-in by senior management.

Question 21

The advantages of the _________ approach are that it doesn't require the expenditure of additional resources in conducting a more formal risk assessment and that the same measures can be replicated over a range of systems.

A) combined
B) informal
C) baseline
D) detailed

Question 22

The intent of the ________ is to provide a clear overview of how an organization's IT infrastructure supports its overall business objectives.

A) risk register
B) corporate security policy
C) vulnerability source
D) threat assessment

Question 23

The aim of the _________ process is to provide management with the information necessary for them to make reasonable decisions on where available resources will be deployed.

Question 24

________ specification indicates the impact on the organization should the particular threat in question actually eventuate.

A) Risk
B) Consequence
C) Threat
D) Likelihood

Question 25

The term ________ refers to a document that details not only the overall security objectives and strategies, but also procedural policies that define acceptable behavior, expected practices, and responsibilities.

Question 26

_________ include management, operational, and technical processes and procedures that act to reduce the exposure of the organization to some risks by reducing the ability of a threat source to exploit some vulnerabilities.

A) Security controls
B) Risk appetite
C) Risk controls
D) None of the above

Question 27

ISO details a model process for managing information security that comprises the following steps: plan, do, ________, and act.

Question 28

The purpose of ________ is to determine the basic parameters within which the risk assessment will be conducted and then to identify the assets to be examined.

A) establishing the context
B) control
C) risk avoidance
D) combining

Question 29

The __________ approach to risk assessment aims to implement a basic general level of security controls on systems using baseline documents, codes of practice, and industry best practice.

Question 30

A ________ is anything that might hinder or present an asset from providing appropriate levels of the key security services.

A) vulnerability
B) threat
C) risk
D) control

Question 31

The results of the risk analysis should be documented in a _________.

A) journal
B) consequence
C) risk register
D) none of the above

Question 32

The _________ approach involves conducting a risk analysis for the organization's IT systems that exploits the knowledge and expertise of the individuals performing the analysis.

A) baseline
B) combined
C) detailed
D) informal

Question 33

The use of the _________ approach would generally be recommended for small to medium-sized organizations where the IT systems are not necessarily essential to meeting the organization's business objectives and additional expenditure on risk analysis cannot be justified.

Question 34

Establishing security policy, objectives, processes and procedures is part of the ______ step.

A) plan
B) check
C) act
D) none of the above

Question 35

_________ is a process used to achieve and maintain appropriate levels of confidentiality, integrity, availability, accountability, authenticity, and reliability.

Question 36

The advantages of the _________ risk assessment approach are that it provides the most detailed examination of the security risks of an organization's IT system and produces strong justification for expenditure on the controls proposed.

Question 37

The four approaches to identifying and mitigating risks to an organization's IT infrastructure are: baseline approach, detailed risk analysis, combined approach, and __________ approach.

Question 38

A(n) _________ is anything that has value to the organization.

Question 39

A(n) _________ is a weakness in an asset or group of assets that can be exploited by one or more threats.

Question 40

_________ is choosing to accept a risk level greater than normal for business reasons.

A) Risk avoidance
B) Reducing likelihood
C) Risk transfer
D) Risk acceptance

Question 41

_________ is sharing responsibility for the risk with a third party.

Question 42

Not proceeding with the activity or system that creates the risk is _________.

Question 43

The level of risk the organization views as acceptable is the organization's __________.

Question 44

The _________ approach combines elements of the baseline, informal, and detailed risk analysis approaches.

Question 45

The _________ provides the most accurate evaluation of an organization's IT system's security risks.