Exam 8: Risk Management: Identifying and Assessing Risk

During risk identification managers identify the organization's information assets,classify and categorize them into useful groups,and prioritize them by their overall importance._________________________

The amount of danger posed by a threat is sometimes difficult to assess.It may be simply the impact of a threat attacking the organization,or it may reflect the amount of damage that the threat could create or the frequency with which an attack can occur._________________________

A TVA spreadsheet combines prioritized lists of assets and threats to identify vulnerabilities and provide a prioritized list of efforts relating to the implementation of needed controls.

Which of the following attributes does not apply to software information assets?

A(n)comprehensive classification of information assets means that all inventoried assets fit into a category._________________________

Which of the following distinctly identifies an asset and can be vital in later analysis of threats directed to specific models of certain devices or software components?

The ____ uniquely identifies a specific device.

One of the calculations that guides corporate spending on controls is the cost of ____ operations if an attack occurs and is successful.

The process of evaluating potential weaknesses in each information asset is known as ____________________ identification.

Which of the following is an example of human error?

Which of the following activities is part of the risk identification process?

____ should be avoided when identifying people assets.

Information technology managers and technicians are the defenders of information._________________________

When determining the relative importance of each information asset,refer to the organization's ____ or statement of objectives.From this source,determine which assets are essential for meeting the organization's objectives,which assets support the objectives,and which are merely adjuncts.

A well-developed risk management program consists of two formal processes: risk identification and assessment and risk control._________________________

To make the process of analyzing threats less daunting,steps in the threat and vulnerability identification processes should be handled jointly.

The first stage in the Risk Identification process is to develop an inventory of information assets.

____ is the identification and assessment of levels of risk in the organizations?