Question 1

Briefly describe the five basic strategies to control risk that result from vulnerabilities.

Accepted Answer

​ Defense-Applying controls and safeguar

Question 2

By multiplying the asset value by the exposure factor,you can calculate which of the following?

Accepted Answer

A)  annualized cost of the safeguard 
B)  single loss expectancy 
C)  value to adversaries 
D)  annualized loss expectancy 
A)  annualized cost of the safeguard 
B)  single loss expectancy 
C)  value to adversaries 
D)  annualized loss expectancy

Question 3

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

Accepted Answer

A)  When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exploited. 
B)  When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack. 
C)  When the attacker's potential gain is less than the costs of attack: Apply protections to decrease the attacker's cost or reduce the attacker's gain, by using technical or operational controls. 
D)  When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss. 
A)  When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exploited. 
B)  When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack. 
C)  When the attacker's potential gain is less than the costs of attack: Apply protections to decrease the attacker's cost or reduce the attacker's gain, by using technical or operational controls. 
D)  When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss.

Question 4

Due care and due diligence occur when an organization adopts a certain minimum level of security-that is,what any prudent organization would do in similar circumstances.____________

Accepted Answer

A) True 
 B)False

Question 5

Describe operational feasibility.

Accepted Answer

Operational feasibility refers to user a

Question 6

A benchmark is derived by comparing measured actual performance against established standards for the measured category.____________ ​

Accepted Answer

A) True 
 B)False

Question 7

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .

Accepted Answer

The answer of The risk control strategy that seeks to...

Question 8

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

Accepted Answer

A)  risk assessment 
B)  risk treatment 
C)  risk communication 
D)  risk determination 
A)  risk assessment 
B)  risk treatment 
C)  risk communication 
D)  risk determination

Question 9

Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

Accepted Answer

What damage could occur,and what financi

Question 10

A process of assigning financial value or worth to each information asset.

Accepted Answer

A) defense risk control strategy 
B) mitigation risk control strategy 
C) acceptance risk control strategy 
D) termination risk control strategy 
E) risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy 
A) defense risk control strategy 
B) mitigation risk control strategy 
C) acceptance risk control strategy 
D) termination risk control strategy 
E) risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy

Question 11

An examination of how well a particular solution fits within theorganization's strategic planning objectives and goals.

Accepted Answer

A) defense risk control strategy 
B) mitigation risk control strategy 
C) acceptance risk control strategy 
D) termination risk control strategy 
E) risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy 
A) defense risk control strategy 
B) mitigation risk control strategy 
C) acceptance risk control strategy 
D) termination risk control strategy 
E) risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy

Question 12

A risk control strategy that eliminates all risk associatedwith an information asset by removing it from service.

Accepted Answer

A) defense risk control strategy 
B) mitigation risk control strategy 
C) acceptance risk control strategy 
D) termination risk control strategy 
E) risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy 
A) defense risk control strategy 
B) mitigation risk control strategy 
C) acceptance risk control strategy 
D) termination risk control strategy 
E) risk appetite
F)cost-benefit analysis
G)cost avoidance
H)asset valuation
I)organizational feasibility
J)single loss expectancy

Question 13

Explain two practical guidelines to follow in risk control strategy selection.

Accepted Answer

- When a vulnerability (flaw or weakness

Question 14

What is the result of subtracting the post-control annualized loss expectancy and the ACS from the pre-control annualized loss expectancy?

Accepted Answer

A)  cost-benefit analysis 
B)  exposure factor 
C)  single loss expectancy 
D)  annualized rate of occurrence 
A)  cost-benefit analysis 
B)  exposure factor 
C)  single loss expectancy 
D)  annualized rate of occurrence

Question 15

What are the four stages of a basic FAIR analysis?

Accepted Answer

Stage 1-Identify Scenario Comp

Question 16

An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources,which include hardware,software,networking,and personnel is known as operational feasibility.____________

Accepted Answer

A) True 
 B)False

Question 17

To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.

Accepted Answer

The answer of To keep up with the competition organizations...

Question 18

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

Accepted Answer

A)  organizational feasibility 
B)  political feasibility 
C)  technical feasibility 
D)  operational feasibility 
A)  organizational feasibility 
B)  political feasibility 
C)  technical feasibility 
D)  operational feasibility

Question 19

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the ​termination  risk control strategy.

Accepted Answer

A) True 
 B)False

Question 20

Risks can be avoided by countering the threats facing an asset or by eliminating the exposure of an asset.

Accepted Answer

A) True 
 B)False

Briefly describe the five basic strategies to control risk that result from vulnerabilities.

By multiplying the asset value by the exposure factor,you can calculate which of the following?

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

Due care and due diligence occur when an organization adopts a certain minimum level of security-that is,what any prudent organization would do in similar circumstances.____________

Describe operational feasibility.

A benchmark is derived by comparing measured actual performance against established standards for the measured category.____________

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

A process of assigning financial value or worth to each information asset.

An examination of how well a particular solution fits within theorganization's strategic planning objectives and goals.

A risk control strategy that eliminates all risk associatedwith an information asset by removing it from service.

Explain two practical guidelines to follow in risk control strategy selection.

What is the result of subtracting the post-control annualized loss expectancy and the ACS from the pre-control annualized loss expectancy?

What are the four stages of a basic FAIR analysis?

An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources,which include hardware,software,networking,and personnel is known as operational feasibility.____________

To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the termination risk control strategy.

Risks can be avoided by countering the threats facing an asset or by eliminating the exposure of an asset.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 7: Risk Management: Controlling Risk

Briefly describe the five basic strategies to control risk that result from vulnerabilities.

By multiplying the asset value by the exposure factor,you can calculate which of the following?

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

Due care and due diligence occur when an organization adopts a certain minimum level of security-that is,what any prudent organization would do in similar circumstances.____________

Describe operational feasibility.

A benchmark is derived by comparing measured actual performance against established standards for the measured category.____________ ​

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

A process of assigning financial value or worth to each information asset.

An examination of how well a particular solution fits within theorganization's strategic planning objectives and goals.

A risk control strategy that eliminates all risk associatedwith an information asset by removing it from service.

Explain two practical guidelines to follow in risk control strategy selection.

What is the result of subtracting the post-control annualized loss expectancy and the ACS from the pre-control annualized loss expectancy?

What are the four stages of a basic FAIR analysis?

An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources,which include hardware,software,networking,and personnel is known as operational feasibility.____________

To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the ​termination risk control strategy.

Risks can be avoided by countering the threats facing an asset or by eliminating the exposure of an asset.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

A benchmark is derived by comparing measured actual performance against established standards for the measured category.____________

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the termination risk control strategy.