Deck 5: Risk Management

Question 1

Residual risk is the risk that has not been removed, shifted, or planned for after vulnerabilities have been completely resolved.

Answer 1

False

Question 2

When it is necessary to calculate, estimate, or derive values for information assets, you might give consideration to the value incurred from the cost of protecting the information.

Answer 2

True

Question 3

When determining the relative importance of each asset, refer to the organization's mission statement or statement of objectives to determine which elements are essential, which are supportive, and which are merely adjuncts.

Answer 3

True

Question 4

The value of information to the organization's competition should influence the asset's valuation.

Question 5

You should adopt naming standards that do not convey information to potential system attackers.

Question 6

In a cost-benefit analysis, a single loss expectancy (SLE) is the calculated value associated with the most likely loss from an attack; the SLE is the product of the asset's value and the annualized loss expectancy.

Question 7

A security clearance is a component of a data classification scheme that assigns a status level to systems to designate the maximum level of classified data that may be stored on them.

Question 8

A data classification scheme is a formal access control methodology used to assign a level of 
availability to an information asset and thus restrict the number of people who can access it.

Question 9

In addition to their other responsibilities, the three communities of interest are responsible for determining which control options are cost effective for the organization.

Question 10

If the acceptance strategy is used to handle every vulnerability in the organization, its managers may be unable to conduct proactive security activities and may portray an apathetic approach to security in general.

Question 11

The defense control strategy is the risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards, but it is not the preferred approach to controlling risk.

Question 12

To determine if the risk to an information asset is acceptable or not, you estimate the expected loss the organization will incur if the risk is exploited.

Question 13

According to Sun Tzu, if you know yourself and know your enemy, you have an average chance to be successful in an engagement.

Question 14

​The threats-vulnerabilities-assets (TVA) worksheet is a document that shows a comparative ranking of prioritized assets against prioritized threats, with an indication of any vulnerabilities in the asset/threat pairings.

Question 15

Within a data classification scheme, "comprehensive" means that an information asset should fit in only one category.

Question 16

The upper management of an organization must structure the IT and information security functions to defend the organization's information assets.

Question 17

Risk control is the application of controls that reduce the risks to an organization's information assets to an acceptable level.

Question 18

You cannot use qualitative measures to rank information asset values.

Question 19

Knowing yourself means identifying, examining, and understanding the threats facing the organization.

Question 20

Identifying human resources, documentation, and data information assets of an organization is less difficult than identifying hardware and software assets.

Question 21

The results from risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment.

Question 22

Each of the threats faced by an organization must be evaluated, including determining the threat's potential to endanger the organization, which is known as a threat prioritization. _________________________

Question 23

Process-based measures are performance measures that are focused on numbers and are less strategic than metric-based measures.

Question 24

One way to determine which information assets are valuable is by evaluating which information asset(s) would expose the company to liability or embarrassment if revealed. _________________________

Question 25

Risk acceptance defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility. _________________________

Question 26

Likelihood is the probability that a specific vulnerability within an organization will be the target of an attack. _________________________

Question 27

A best practice proposed for a small to medium-sized business will be similar to one used to help design control strategies for a large multinational company.

Question 28

Cost-benefit analyses (CBAs) cannot be calculated after controls have been functioning for a time, as observation over time prevents precision in evaluating the benefits of the safeguard and determining whether it is functioning as intended.

Question 29

Risk mitigation is the process of assigning a risk rating or score to each information asset. _________________________

Question 30

Pervasive risk is the amount of risk that remains to an information asset even after the organization has applied its desired level of controls. _________________________

Question 31

One advantage to benchmarking is that best practices change very little over time.

Question 32

Risk control is the enumeration and documentation of risks to an organization's information assets. _________________________

Question 33

Establishing a competitive business model, method, or technique enables an organization to provide a product or service that is superior and creates a(n) competitive advantage. _________________________

Question 34

Some information security experts argue that it is virtually impossible to determine the true value of information and information-bearing assets.

Question 35

Within data classification schemes, it is important that all categories used be classified and mutually exclusive. _________________________

Question 36

Organizations should communicate with system users throughout the development of the security program, letting them know that changes are coming, and reduce resistance to these expected changes through communication, education, and involvement.

Question 37

Operational feasibility is an assessment of whether the organization can acquire the technology necessary to implement and support the proposed control.

Question 38

TVA safeguard risk is a combined function of (1) a threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards. _________________________

Question 39

Best business practices are often called recommended practices.

Question 40

Baselining is the comparison of past security activities and events against the organization's current performance.

Question 41

Loss event frequency is the combination of an asset's value and the percentage of it that might be lost in an attack. _________________________

Question 42

Cost mitigation ​is the process of preventing the financial impact of an incident by implementing a control. _________________________

Question 43

The computed value of the ALE compares the costs and benefits of a particular control alternative to determine whether the control is worth its cost. _________________________

Question 44

The mitigation control strategy attempts to reduce the impact of a successful attack through planning and preparation. _________________________

Question 45

Risk _________ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.

A) benefit
B) appetite 
C) acceptance
D) avoidance

Question 46

The most common example of a mitigation procedure is a contingency plan. _________________________

Question 47

A(n) qualitative assessment is based on characteristics that do not use numerical measures. _________________________

Question 48

Sometimes a risk assessment report is prepared for a specific IT project at the request of the project manager, either because it is required by organizational policy or because it is good project management practice. _________________________

Question 49

Operational feasibility is also known as behavioral feasibility. _________________________

Question 50

Benchmarking is the process of comparing other organizations' activities against the practices used in one's own organization to produce results it would like to duplicate. _________________________

Question 51

Within organizations, the most important feasibility is technical feasibility, which defines what can and cannot occur based on the consensus and relationships between the communities of interest. _________________________

Question 52

_________ addresses are sometimes called electronic serial numbers or hardware addresses.

A) HTTP
B) IP 
C) DHCP
D) MAC

Question 53

Process-based measures are comparisons based on observed numerical data, such as numbers of successful attacks. _________________________

Question 54

In information security, benchmarking is the comparison of past security activities and events against the organization's current performance. _________________________

Question 55

The first phase of risk management is _________.

A) risk identification
B) design 
C) risk control
D) risk evaluation

Question 56

A(n) disaster recovery plan includes the steps necessary to ensure the continuation of the organization when a disaster's scope or scale exceeds the ability of the organization to restore operations, usually through relocation of critical business functions to an alternate location. _________________________

Question 57

The concept of competitive _________ refers to falling behind the competition.

A) disadvantage
B) drawback 
C) failure
D) shortcoming

Question 58

Exposure factor is the expected percentage of loss that would occur from a particular attack. _________________________

Question 59

Risk _________ is the application of security mechanisms to reduce the risks to an organization's data and information systems.

A) management
B) control 
C) identification
D) security

Question 60

Security efforts that seek to provide a superior level of performance in the protection of information are referred to as best business practices. _________________________

Question 61

Some people search trash and recycling bins-a practice known as _________-to retrieve information that could embarrass a company or compromise information security.

A) shoulder surfing
B) dumpster diving 
C) pretexting
D) corporate espionage

Question 62

The formal decision-making process used when considering the economic feasibility of implementing information security controls and safeguards is called a(n) __________.

A) ARO
B) CBA 
C) ALE
D) SLE

Question 63

The __________ control strategy attempts to shift risk to other assets, other processes, or other organizations.

A) transference
B) defense 
C) acceptance
D) mitigation

Question 64

__________ plans usually include all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the smoke clears, the dust settles, or the flood waters recede.

A) IR
B) DR 
C) BC
D) BR

Question 65

__________ is an asset valuation approach that uses categorical or non-numeric values rather than absolute numerical measures.

A) Qualitative assessment
B) A metric-centric model 
C) Quantitative assessment
D) A value-specific constant

Question 66

_________ equals the probability of a successful attack multiplied by the expected loss from a successful attack plus an element of uncertainty.

A) Loss magnitude
B) Risk 
C) Loss frequency
D) Loss

Question 67

When organizations adopt security measures for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances. This is referred to as __________.

A) baselining
B) best practices 
C) benchmarking
D) standards of due care

Question 68

__________ is simply how often you expect a specific type of attack to occur.

A) ARO
B) CBA 
C) ALE
D) SLE

Question 69

The calculation of the likelihood of an attack coupled with the attack frequency to determine the expected number of losses within a specified time range is called the __________.

A) loss frequency
B) annualized loss expectancy 
C) likelihood
D) benefit of loss

Question 70

The __________ is the difference between an organization's observed and desired performance.

A) performance gap
B) objective 
C) issue delta
D) risk assessment

Question 71

Federal agencies such as the NSA, FBI, and CIA use specialty classification schemes.For materials that are not considered "National Security Information," __________ data is the lowest-level classification.

A) sensitive
B) confidential 
C) unclassified
D) public

Question 72

The _________ control strategy attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards.

A) termination
B) defense 
C) transference
D) mitigation

Question 73

Management of classified data includes its storage and _________.

A) distribution
B) portability 
C) destruction
D) All of the above

Question 74

A _________  assigns a status level to employees to designate the maximum level of classified data they may access.

A) security clearance scheme
B) data recovery scheme 
C) risk management scheme
D) data classification scheme

Question 75

In a(n) __________, assets or threats can be prioritized by identifying criteria with differing levels of importance, assigning a score for each of the criteria, and then summing and ranking those scores.

A) threat assessment
B) risk management program 
C) weighted factor analysis
D) data classification scheme

Question 76

The __________ plan specifies the actions an organization can and should take while an adverse event is in progress. An adverse event could result in loss of an information asset or assets, but it does not currently threaten the viability of the entire organization.

A) BC
B) DR 
C) IR
D) BR

Question 77

A(n) _________ is a formal access control methodology used to assign a level ofconfidentiality to an information asset and thus restrict the number of people who can access it.

A) security clearance scheme
B) data recovery scheme 
C) risk management scheme
D) data classification scheme

Question 78

__________ feasibility analysis examines user acceptance and support, management acceptance and support, and the overall requirements of the organization's stakeholders.

A) Organizational
B) Technical 
C) Operational
D) Political

Question 79

A(n) _________ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment.

A) IP
B) FCO 
C) CTO
D) HTTP

Question 80

The __________ strategy is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation.

A) defense
B) transference 
C) mitigation
D) acceptance