Question 1

The results from risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment.

Accepted Answer

Risk assessment results can indeed be presented in a variety of formats, including those listed.

Question 2

Each of the threats faced by an organization must be evaluated, including determining the threat's potential to endanger the organization, which is known as a threat prioritization. _________________________

Accepted Answer

assessment

Question 3

Process-based measures are performance measures that are focused on numbers and are less strategic than metric-based measures.

Accepted Answer

This statement is incorrect. Process-based measures are strategic performance measures that focus on the processes and activities that lead to achieving strategic goals. Metric-based measures, on the other hand, focus on numerical outcomes and may not necessarily be tied to strategic objectives.

Question 4

One way to determine which information assets are valuable is by evaluating which information asset(s) would expose the company to liability or embarrassment if revealed. _________________________

Accepted Answer

It is true that evaluating which information asset(s) would expose the company to liability or embarrassment if revealed can help determine which information assets are valuable. This is because protecting such information assets is crucial for the success and reputation of the company.

Question 5

Risk acceptance defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility. _________________________

Accepted Answer

appetite

Question 6

Likelihood is the probability that a specific vulnerability within an organization will be the target of an attack. _________________________

Accepted Answer

Likelihood pertains to the probability of a vulnerability being targeted by an attack, so the statement is true.

Question 7

A best practice proposed for a small to medium-sized business will be similar to one used to help design control strategies for a large multinational company.

Accepted Answer

The scale, complexity, and resources of a small to medium-sized business differ significantly from those of a large multinational company, requiring different strategies and practices.

Question 8

Cost-benefit analyses (CBAs) cannot be calculated after controls have been functioning for a time, as observation over time prevents precision in evaluating the benefits of the safeguard and determining whether it is functioning as intended.

Accepted Answer

Cost-benefit analyses can be conducted after controls have been in place, as ongoing observation can provide valuable data to assess the effectiveness and benefits of the safeguards, allowing for adjustments and improvements.

Question 9

Risk mitigation is the process of assigning a risk rating or score to each information asset. _________________________

Accepted Answer

assessment

Question 10

Pervasive risk is the amount of risk that remains to an information asset even after the organization has applied its desired level of controls. _________________________

Accepted Answer

Residual

Question 11

One advantage to benchmarking is that best practices change very little over time.

Accepted Answer

Best practices can change over time due to advancements in technology, changes in consumer preferences, and shifts in the market. Therefore, benchmarking must continually be updated and adjusted to maintain its relevance and effectiveness.

Question 12

Risk control is the enumeration and documentation of risks to an organization's information assets. _________________________

Accepted Answer

identification

Question 13

Establishing a competitive business model, method, or technique enables an organization to provide a product or service that is superior and creates a(n) competitive advantage. _________________________

Accepted Answer

Establishing a competitive business model, method, or technique helps an organization to provide better products or services, resulting in a competitive advantage.

Question 14

Some information security experts argue that it is virtually impossible to determine the true value of information and information-bearing assets.

Accepted Answer

The value of information and information-bearing assets is subjective and can vary based on numerous factors, making it difficult to determine a true and objective value.

Question 15

Within data classification schemes, it is important that all categories used be classified and mutually exclusive. _________________________

Accepted Answer

comprehensive

Question 16

Organizations should communicate with system users throughout the development of the security program, letting them know that changes are coming, and reduce resistance to these expected changes through communication, education, and involvement.

Accepted Answer

Effective communication with system users is an important aspect of developing a security program as it can keep them informed about any changes that may impact their work and reduce resistance to these changes. Involving them in the process and providing education can also help to increase their understanding and support for the new security measures.

Question 17

Operational feasibility is an assessment of whether the organization can acquire the technology necessary to implement and support the proposed control.

Accepted Answer

Operational feasibility assesses whether the proposed system can be implemented within the existing operational framework of the organization, including processes, procedures, and human resources, rather than focusing solely on technology acquisition.

Question 18

TVA safeguard risk is a combined function of (1) a threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards. _________________________

Accepted Answer

Residual

Question 19

Best business practices are often called recommended practices.

Accepted Answer

Best business practices are often recommended practices because they are proven to be effective in achieving success in various aspects of a business. These practices are often tested and refined over time, making them trusted and recommended by industry experts and professionals.

Question 20

Baselining is the comparison of past security activities and events against the organization's current performance.

Accepted Answer

The answer of Baselining is the comparison of past security...

Quiz 5: Risk Management