Exam 7: Risk Management: Controlling Risk

The goal of InfoSec is not to bring residual risk to zero; rather,it is to bring residual risk in line with an organization's risk ___________.

In which technique does a group rate or rank a set of information,compile the results and repeat until everyone is satisfied with the result?

What is the OCTAVE method approach to risk management?

Which of the following affects the cost of a control?

The NIST risk management approach includes all but which of the following elements?

The financial savings from using the defense risk control strategy to implementa control and eliminate the financial ramifications of an incident.

A risk control strategy that attempts to reduce the impactof the loss caused by a realized incident,disaster,or attack through effective contingencyplanning and preparation.

Which of the following is not a step in the FAIR risk management framework?

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

The risk control strategy that indicates the organization is willing to accept the current level of risk.As a result,the organization makes a conscious decision to do nothing to protect an information asset from risk and to accept the outcome from any resulting exploitation is known as the termination risk control strategy.

What does the result of a CBA determine?What is the formula for the CBA?

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.____________

Which of the following is NOT an alternative to using CBA to justify risk controls?

What are the four phases of the Microsoft risk management strategy?

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

A risk control strategy that indicates the organization iswilling to accept the current level of risk and that the organization makes a conscious decisionto do nothing to protect an information asset from risk and to accept the outcome from anyresulting exploitation.

The ____________________ risk control strategy attempts to shift the risk to other assets,processes,or organizations.

Application of training and education is a common method of which risk control strategy?

Describe the use of hybrid assessment to create a quantitative assessment of asset value.