Question 1

A(n)____ is a plan or course of action used by an organization to convey instructions from its senior-most management to those who make decisions,take actions,and perform other duties on behalf of the organization.
A)policy
B)assessment
C)asset
D)residual risk

Accepted Answer

A policy is a set of guidelines or rules that an organization follows to achieve a specific goal. It is a plan or course of action that conveys instructions from senior management to those who make decisions, take actions, and perform other duties on behalf of the organization. Policies are designed to ensure consistency, reduce risk, and improve overall performance. Assessments, assets, and residual risk are all important components of an organization's overall risk management strategy, but they are not plans or courses of action used to convey instructions from senior management to those who make decisions and take actions.

Question 2

Match each statement with an item below. -The risk that remains to the information asset even after the existing control has been applied. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

Residual risk refers to the risk that remains even after controls have been applied.

Question 3

Match each statement with an item below. -The probability that a specific vulnerability within an organization will be successfully attacked. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

Likelihood refers to the probability of a specific vulnerability being successfully attacked.

Answer: F
 Risk management refers to the process of identifying, assessing, and prioritizing risks, and taking steps to mitigate or eliminate them.

Answer: A
 Threat agents are individuals or groups who pose a threat to an organization's security.

Answer: H
 Residual risk refers to the risk that remains after safeguards have been implemented.

Answer: I
 Standards are guidelines or best practices that organizations can follow to improve their security posture.

The other items in the list (B, C, D, E) are not directly related to the probability of a vulnerability being successfully attacked.

Question 4

Match each statement with an item below. -Segments of code that perform malicious actions. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

Computer viruses are segments of code that perform malicious actions.

Question 5

Information has the characteristic of ____________________ when disclosure or exposure to unauthorized individuals or systems is prevented.

Accepted Answer

The answer of Information has the characteristic of ____________________ when...

Question 6

Match each statement with an item below. -A person who uses and creates computer software to gain access to information illegally. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

A hacker is a person who uses and creates computer software to gain access to information illegally.

Answer: B
 Intellectual property refers to creations of the mind, such as inventions, literary and artistic works, and symbols, names, and images used in commerce.

Answer: D
 Computer viruses are malicious programs that replicate themselves and infect other computers.

Answer: E
 A Trojan is a type of malicious program that disguises itself as legitimate software in order to infect a computer and cause damage.

Answer: A
 A threat agent is a person or entity with the capability and motivation to exploit a vulnerability in a system.

Answer: F
 Risk management is the process of identifying, assessing, and prioritizing risks and taking steps to minimize, monitor, and control those risks.

Answer: G
 Likelihood refers to the probability that a risk will occur.

Answer: H
 Residual risk is the risk that remains after risk management efforts have been implemented.

Answer: I
 Standards are established guidelines or criteria for products, services, or processes.

Question 7

Match each statement with an item below. -Something that looks like a desirable program or tool,but that is in fact a malicious entity. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

A Trojan is a type of malware that disguises itself as a legitimate program or tool in order to trick users into downloading and installing it. Once installed, the Trojan can cause various types of harm, such as stealing sensitive information or taking control of the victim's computer.

Answer: D
 Computer viruses are a type of malicious software that can replicate themselves and spread to other computers. They can cause a variety of harmful effects, such as deleting files, corrupting data, or even damaging hardware.

Answer: C
 A hacker is someone who uses their computer expertise to gain unauthorized access to computer networks or systems, often with malicious intent.

Answer: F
 Risk management is the process of identifying, assessing, and mitigating risks to an organization or system. It involves evaluating the likelihood and potential impact of various threats, and implementing measures to reduce or eliminate them.

Answer: G
 Likelihood refers to the probability of a particular event occurring. In the context of cybersecurity, it is commonly used to assess the probability of a particular threat or attack.

Answer: H
 Residual risk refers to the level of risk that remains after mitigation measures have been implemented. In other words, it is the risk that an organization or system is still exposed to even after taking steps to reduce it.

Answer: I
 Standards refer to guidelines or best practices that are established by industry or government organizations for various aspects of cybersecurity, such as network security, software development, or data privacy. Following these standards can help organizations improve their cybersecurity posture and reduce the risk of security breaches.

The answer isn't A or B as they don't match the given statements.

Question 8

____________________ is the process of applying controls to reduce the risks to an organization's data and information systems.

Accepted Answer

The answer of ____________________ is the process of applying controls...

Question 9

A(n)____ is an investigation and assessment of the impact that various attacks can have on the organization.
A)BIA
B)intellectual property
C)incident
D)threat

Accepted Answer

A Business Impact Analysis (BIA) is specifically designed to identify potential impacts on an organization resulting from possible threats or incidents. The goal of a BIA is to evaluate the significance of each impact and make recommendations to minimize risk and optimize recovery. The other options are not specific to assessing the potential impact of attacks on an organization.

Question 10

____________________ is the process of identifying vulnerabilities in an organization's information systems and taking carefully reasoned steps to ensure the confidentiality,integrity,and availability of all the components in the organization's information system.

Accepted Answer

The answer of ____________________ is the process of identifying vulnerabilities...

Question 11

____ is the process of moving the organization toward its vision.
A)Transference
B)Avoidance
C)Strategic planning
D)Mitigation

Accepted Answer

Strategic planning is the process of setting the organization's vision and developing a roadmap to achieve it. Therefore, moving towards the vision is the core objective of strategic planning. Transference refers to transferring risks to another party, avoidance means avoiding risks, and mitigation is reducing the impact of risks. None of these options specifically deal with moving towards an organization's vision.

Question 12

A ____ deals with the preparation for and recovery from a disaster,whether natural or man-made.
A)mitigation plan
B)disaster recovery plan
C)risk management
D)risk assessment

Accepted Answer

A disaster recovery plan deals specifically with preparing for and recovering from disasters, whereas a mitigation plan deals with reducing the impact of potential disasters, risk management deals with identifying and managing risks, and risk assessment is the process of evaluating potential risks.

Question 13

A(n)____ is any clearly identified attack on the organization's information assets that would threaten the assets' confidentiality,integrity,or availability.
A)threat
B)Trojan horse
C)worm
D)incident

Accepted Answer

The definition provided best describes an incident, which is any identified attack or threat to an organization's information assets that compromises their security, confidentiality, integrity, or availability. A threat refers to any potential danger or risk that can harm the organization's assets. A Trojan horse and a worm are types of malicious software or malware that can be used to carry out attacks or unauthorized activities on an information system.

Question 14

Match each statement with an item below. -Detailed statements of what must be done to comply with policy. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

Standards are detailed statements that provide guidance on how to comply with policy.

Answer: A
 Threat agents refer to individuals or groups with the capability and intent to exploit vulnerabilities and cause harm.

Answer: B
 Intellectual property refers to the legal rights owners have over their creations, inventions, and ideas.

Answer: D
 Computer viruses are malicious software programs designed to disrupt, damage, or destroy computer systems.

Answer: E
 Trojans are programs that appear harmless but contain hidden malicious code that can damage or steal information from a computer system.

Answer: F
 Risk management is the process of identifying, assessing, and prioritizing risks to minimize the impact of potential threats.

Answer: G
 Likelihood refers to the probability of a risk occurring.

Answer: H
 Residual risk refers to the remaining risk after risk management measures have been implemented.

Question 15

For the purpose of relative risk assessment,____________________ equals likelihood of vulnerability occurrence times value (or impact)minus percentage risk already controlled plus an element of uncertainty.

Accepted Answer

The answer of For the purpose of relative risk assessment,____________________...

Question 16

Match each statement with an item below. -The process used to identify and then control risks to an organization's information assets. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

Risk management is the process used to identify and then control risks to an organization's information assets.

Answer: A
 Threat agent refers to a person or entity that carries out a threat, such as a hacker.

Answer: B
 Intellectual property refers to the legal rights that protect creations of the human mind, such as patents and copyrights.

Answer: D
 Computer viruses are a type of malicious software (malware) designed to replicate itself and spread to other computers.

Answer: E
 A Trojan is a type of malware disguised as legitimate software, used by attackers to gain unauthorized access to systems.

Answer: G
 Likelihood refers to the probability that a risk will occur.

Answer: H
 Residual risk is the risk that remains after risk treatment measures have been put in place.

Answer: I
 Standards refer to established guidelines or criteria for ensuring quality, consistency, and safety in various industries and processes.

Question 17

Match each statement with an item below. -A specific and identifiable instance of a general threat. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

The answer of Match each statement with an item below. -A...

Question 18

Match each statement with an item below. -Includes trade secrets,copyrights,trademarks,and patents. A)Threat agent B)Intellectual property C)Hacker D)Computer viruses E)Trojan F)Risk management G)Likelihood H)Residual risk I)Standards

Accepted Answer

Intellectual property includes trade secrets, copyrights, trademarks, and patents.

Answer: F 
 Risk management is the process of identifying, assessing, and minimizing risks.

Answer: I 
 Standards are established guidelines or criteria for products, services, or systems.

Answer: G 
 Likelihood refers to the probability of a risk occurring.

Answer: H 
 Residual risks are risks that remain after risk management strategies have been implemented.

Question 19

____________________ is defined by the Committee on National Security Systems (CNSS)as the protection of information and its critical elements,including the systems and hardware that use,store,and transmit that information.

Accepted Answer

The answer of ____________________ is defined by the Committee on...

Question 20

A ____ is a document that expresses how an organization ensures that critical business functions continue at an alternate location while the organization recovers its ability to function at the primary site if a catastrophic incident or disaster occurs.
A)risk assessment plan
B)business continuity plan
C)Trojan horse
D)worm

Accepted Answer

A business continuity plan is specifically designed to outline the steps an organization will take to ensure critical business functions can continue in the event of a disaster or catastrophic incident. It typically includes strategies for both immediate response and long-term recovery, such as backup systems, alternate locations, communication plans, and training protocols. A risk assessment plan is a separate document that identifies potential threats and vulnerabilities to an organization's operations and assets, while a Trojan horse and worm are types of malware that can be used in cyber attacks.

Quiz 1: Contingency Planning Within Information Security

A(n) ____ is a plan or course of action used by an organization to convey instructions from its senior-most management to those who make decisions,take actions,and perform other duties on behalf of the organization.

Match each statement with an item below. -The risk that remains to the information asset even after the existing control has been applied.

Match each statement with an item below. -The probability that a specific vulnerability within an organization will be successfully attacked.

Match each statement with an item below. -Segments of code that perform malicious actions.

Information has the characteristic of ____________________ when disclosure or exposure to unauthorized individuals or systems is prevented.

Match each statement with an item below. -A person who uses and creates computer software to gain access to information illegally.

Match each statement with an item below. -Something that looks like a desirable program or tool,but that is in fact a malicious entity.

____________________ is the process of applying controls to reduce the risks to an organization's data and information systems.

A(n) ____ is an investigation and assessment of the impact that various attacks can have on the organization.

____________________ is the process of identifying vulnerabilities in an organization's information systems and taking carefully reasoned steps to ensure the confidentiality,integrity,and availability of all the components in the organization's information system.

____ is the process of moving the organization toward its vision.

A ____ deals with the preparation for and recovery from a disaster,whether natural or man-made.

A(n) ____ is any clearly identified attack on the organization's information assets that would threaten the assets' confidentiality,integrity,or availability.

Match each statement with an item below. -Detailed statements of what must be done to comply with policy.

For the purpose of relative risk assessment,____________________ equals likelihood of vulnerability occurrence times value (or impact)minus percentage risk already controlled plus an element of uncertainty.

Match each statement with an item below. -The process used to identify and then control risks to an organization's information assets.

Match each statement with an item below. -A specific and identifiable instance of a general threat.

Match each statement with an item below. -Includes trade secrets,copyrights,trademarks,and patents.

____________________ is defined by the Committee on National Security Systems (CNSS)as the protection of information and its critical elements,including the systems and hardware that use,store,and transmit that information.

A ____ is a document that expresses how an organization ensures that critical business functions continue at an alternate location while the organization recovers its ability to function at the primary site if a catastrophic incident or disaster occurs.