Question 1

Asset valuation does NOT have to consider the value of information to adversaries or loss of revenue while information assets are unavailable.

Accepted Answer

Asset valuation should take into consideration the value of information to adversaries or loss of revenue while information assets are unavailable. This is because such risks can have a significant impact on a company's financial performance and reputation.

Question 2

Communicating new or revised policy to employees is adequate to assure compliance.

Accepted Answer

While communicating new or revised policies is an important step, it does not necessarily assure compliance. Additional measures may be necessary such as employee training, monitoring and enforcement of the policy, and consequences for non-compliance.

Question 3

Economic and non-economic effects of a weakness must be evaluated after a strategy for dealing with a particular vulnerability has been selected.

Accepted Answer

The economic and non-economic effects of a weakness should be evaluated before selecting a strategy to ensure that the chosen approach effectively addresses the vulnerability and aligns with organizational goals.

Question 4

Avoidance of risk is the choice to forgo the use of security measures and accept loss in the event of an attack._________________________

Accepted Answer

Acceptance

Question 5

According to the Microsoft Risk Management Approach,risk management is not a stand-alone subject and should be part of a general governance program to allow the organization's management to evaluate the organization's operations and make better,more informed decisions.

Accepted Answer

This statement is in alignment with the Microsoft Risk Management Approach, which emphasizes the need for risk management to be integrated into the overall governance program of an organization rather than treated as a separate function.

Question 6

Organizations can establish a competitive business model,method,or technique allowing it to provide a product or service that is superior in some way creating competitive disadvantage._________________________

Accepted Answer

advantage

Question 7

Risks can be avoided by countering the threats that an asset faces.

Accepted Answer

Risks can indeed be avoided by countering the threats that an asset faces. Mitigating or eliminating the threat will reduce or remove the risk.

Question 8

Corporations that previously used IT systems to gain a competitive advantage now are faced with competitive disadvantage if they fail to keep up with changes in technology.

Accepted Answer

This statement is true. As technology continues to evolve and improve, companies must adapt and update their IT systems in order to remain competitive. Failure to do so may result in a disadvantage compared to competitors who have implemented more advanced technology.

Question 9

The final choice of a risk control strategy may call for a balanced mixture of controls that provides the greatest value for as many asset-threat pairs as possible.

Accepted Answer

This statement is true. A risk control strategy should aim to mitigate risk for as many assets and threats as possible, and a balanced mixture of controls may be the most effective approach to achieve this goal.

Question 10

Economic feasibility is a standard that is commonly used when evaluating a project that implements information security safeguards.

Accepted Answer

Economic feasibility is an important factor to consider when implementing information security safeguards as it assesses the costs and benefits of the project in terms of both financial and non-financial aspects. Therefore, it is commonly used in the evaluation process.

Question 11

Common sense dictates that an organization should spend more to protect an asset than its value.

Accepted Answer

Spending more to protect an asset than its value is not cost-effective and contradicts basic economic principles.

Question 12

OCTAVE is an InfoSec risk evaluation methodology that allows organizations to balance the protection of critical information assets against the costs of providing protective and detection controls.

Accepted Answer

This is a true statement. OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a risk assessment methodology developed by the Software Engineering Institute (SEI) that looks at information security holistically, taking into account operational and technology factors. It uses a collaborative approach that involves various stakeholders in the organization, such as business leaders, IT managers, and technical specialists, to evaluate and prioritize risks based on the impact and likelihood of their occurrence. The end goal is to develop risk mitigation strategies that address the most critical threats and vulnerabilities, while also considering the cost-effectiveness and feasibility of implementing controls.

Question 13

A system's exploitable vulnerabilities are usually determined after the system is designed.

Accepted Answer

Vulnerabilities are often identified during testing and assessment phases, which occur after the system design is completed.

Question 14

Avoidance of risk is accomplished through the application of procedures,training and education and the implementation of technical security controls and safeguards._________________________

Accepted Answer

policy,policies

Question 15

In Risk Management is asset valuation,as it is relatively easy to determine accurately the true value of information and information-bearing assets.

Accepted Answer

Valuation of information and information-bearing assets is not always easy, as their value can be subjective and dependent on various factors such as market demand and the specific use and context of the asset.

Question 16

The goal of information security is to bring residual risk to zero.

Accepted Answer

The goal of information security is to reduce the level of risk to within an acceptable range, not to eliminate it entirely. It is impossible to completely eliminate all risk in any system or process.

Question 17

The risk control strategy of avoidance means understanding the consequences and avoiding risk by not placing a system in a situation that could result in a loss..

Accepted Answer

The answer of The risk control strategy of avoidance means...

Question 18

Residual risk is also known as risk tolerance and is the amount of risk organizations are willing to accept after all reasonable controls have been implemented.

Accepted Answer

Residual risk is the remaining risk after all controls have been applied, while risk tolerance is the level of risk an organization is willing to accept. They are related but not the same.

Question 19

Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges,for example very high to very low.

Accepted Answer

FAIR uses a combination of qualitative and quantitative assessments, including scales with value ranges, to evaluate risk components.

Question 20

Mitigation of risk involves applying safeguards that eliminate or reduce the remaining uncontrolled risks._________________________

Accepted Answer

Avoidance

Quiz 9: Risk Management: Controlling Risk