Question 1

Two of the activities involved in risk management include identifying risks and assessing risks.Which of the following activities is part of the risk identification process? 
A) Determining the likelihood that vulnerable systems will be attacked by specific threats 
B) Calculating the severity of risks to which assets are exposed in their current setting 
C) Assigning a value to each information asset 
D) Documenting and reporting the findings of risk identification and assessment

Accepted Answer

C

Question 2

MAC addresses are considered a reliable identifier for devices with network interfaces,since they are essentially foolproof.

Accepted Answer

While MAC addresses are supposed to be unique, they can be spoofed or changed. Therefore, they are not completely foolproof and can be unreliable in certain situations.

Question 3

​An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

Accepted Answer

qualitative

Question 4

Some threats can manifest in multiple ways,yielding multiple vulnerabilities for an asset-threat pair.

Accepted Answer

This is true as a single threat can have numerous ways of exploiting a vulnerability in an asset, resulting in multiple potential vulnerabilities for an asset-threat pair. It is crucial to identify all possible attack vectors to mitigate these risks effectively.

Question 5

The InfoSec community often takes on the leadership role in addressing risk.

Accepted Answer

The InfoSec community is responsible for managing and addressing cybersecurity risks within an organization. They often take a leadership role in identifying potential risks, implementing security controls, and responding to security incidents.

Question 6

Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest,which includes all but which of the following? 
A) General management must structure the IT and InfoSec functions
B) IT management must serve the IT needs of the broader organization 
C) Legal management must develop corporate-wide standards
D) InfoSec management must lead the way with skill, professionalism, and flexibility

Accepted Answer

The three communities of interest typically involved in reducing risk within an organization are general management, IT management, and InfoSec management. Legal management, while important, is not one of the standard communities of interest focused on in this context.

Question 7

Having an established risk management program means that an organization's assets are completely protected.

Accepted Answer

While having a strong risk management program can significantly mitigate risks, it is not possible to completely protect an organization's assets from all potential threats.

Question 8

​The secretarial community often takes on the leadership role in addressing risk.

Accepted Answer

InfoSec,infosec,Information Security,information security

Question 9

The Australian and New Zealand Risk Management Standard 4360 uses qualitative methods to determine risk based on a threat's probability of occurrence and expected results of a successful attack.

Accepted Answer

The statement accurately describes the approach used by the Australian and New Zealand Risk Management Standard 4360. It relies on a qualitative assessment of risk based on the likelihood of a threat occurring and the potential impact of a successful attack. This approach is different from a quantitative approach, which would use mathematical formulas and data to calculate risk.

Question 10

Some threats can manifest in multiple ways,yielding multiple exploits for an asset-threat pair.​

Accepted Answer

vulnerabilities

Question 11

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet​.

Accepted Answer

vulnerabilities

Question 12

The identification and assessment of levels of risk in an organization describes which of the following? 
A) Risk analysis
B) Risk identification 
C) Risk management
D) Risk reduction

Accepted Answer

The process of identifying and assessing the levels of risk in an organization is known as risk analysis. This involves evaluating potential risks, their likelihood of occurring, and their potential impact on the organization.

Question 13

​The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.

Accepted Answer

likelihood

Question 14

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process? 
A) Creating an inventory of information assets 
B) Classifying and organizing information assets into meaningful groups 
C) Assigning a value to each information asset 
D) Calculating the severity of risks to which assets are exposed in their current setting

Accepted Answer

The activity of calculating the severity of risks to which assets are exposed in their current setting is part of the risk assessment process. Creating an inventory of information assets, classifying and organizing information assets into meaningful groups, and assigning a value to each information asset are activities involved in identifying risks.

Question 15

Which of the following is a network device attribute that may be used in conjunction with DHCP,making asset-identification using this attribute difficult? 
A) Part number
B) Serial number 
C) MAC address
D) IP address

Accepted Answer

DHCP assigns IP addresses dynamically, so it may be challenging to use the IP address to identify a specific network device. Part numbers and serial numbers are unique to a device, and MAC addresses are also unique to a network card, making them more reliable options for identifying assets.

Question 16

A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme.

Accepted Answer

classification

Question 17

The information technology management community of interest often takes on the leadership role in addressing risk.​

Accepted Answer

infosec,information security

Question 18

The recognition,enumeration,and documentation of risks to an organization's information assets.is known as risk control.

Accepted Answer

identification

Question 19

An evaluation of the threats to information assets,including a determination of their potential to endanger the organization is known as exploit assessment.

Accepted Answer

threat

Question 20

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.is known as risk protection.

Accepted Answer

analysis

Quiz 6: Risk Management: Identifying and Assessing Risk

Two of the activities involved in risk management include identifying risks and assessing risks.Which of the following activities is part of the risk identification process?

MAC addresses are considered a reliable identifier for devices with network interfaces,since they are essentially foolproof.

An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

Some threats can manifest in multiple ways,yielding multiple vulnerabilities for an asset-threat pair.

The InfoSec community often takes on the leadership role in addressing risk.

Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest,which includes all but which of the following?

Having an established risk management program means that an organization's assets are completely protected.

The secretarial community often takes on the leadership role in addressing risk.

The Australian and New Zealand Risk Management Standard 4360 uses qualitative methods to determine risk based on a threat's probability of occurrence and expected results of a successful attack.

Some threats can manifest in multiple ways,yielding multiple exploits for an asset-threat pair.

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet.

The identification and assessment of levels of risk in an organization describes which of the following?

The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process?

Which of the following is a network device attribute that may be used in conjunction with DHCP,making asset-identification using this attribute difficult?

A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme.

The information technology management community of interest often takes on the leadership role in addressing risk.

The recognition,enumeration,and documentation of risks to an organization's information assets.is known as risk control.

An evaluation of the threats to information assets,including a determination of their potential to endanger the organization is known as exploit assessment.

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.is known as risk protection.

Quiz 6: Risk Management: Identifying and Assessing Risk

Two of the activities involved in risk management include identifying risks and assessing risks.Which of the following activities is part of the risk identification process?

MAC addresses are considered a reliable identifier for devices with network interfaces,since they are essentially foolproof.

​An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

Some threats can manifest in multiple ways,yielding multiple vulnerabilities for an asset-threat pair.

The InfoSec community often takes on the leadership role in addressing risk.

Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest,which includes all but which of the following?

Having an established risk management program means that an organization's assets are completely protected.

​The secretarial community often takes on the leadership role in addressing risk.

The Australian and New Zealand Risk Management Standard 4360 uses qualitative methods to determine risk based on a threat's probability of occurrence and expected results of a successful attack.

Some threats can manifest in multiple ways,yielding multiple exploits for an asset-threat pair.​

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet​.

The identification and assessment of levels of risk in an organization describes which of the following?

​The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process?

Which of the following is a network device attribute that may be used in conjunction with DHCP,making asset-identification using this attribute difficult?

A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme.

The information technology management community of interest often takes on the leadership role in addressing risk.​

The recognition,enumeration,and documentation of risks to an organization's information assets.is known as risk control.

An evaluation of the threats to information assets,including a determination of their potential to endanger the organization is known as exploit assessment.

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.is known as risk protection.

An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

The secretarial community often takes on the leadership role in addressing risk.

Some threats can manifest in multiple ways,yielding multiple exploits for an asset-threat pair.

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet.

The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.

The information technology management community of interest often takes on the leadership role in addressing risk.