Question 1

What does it mean to 'know the enemy' with respect to risk management?

Accepted Answer

Once an organization becomes aware of it

Question 2

The InfoSec community often takes on the leadership role in addressing risk.

Accepted Answer

A) True 
 B)False

Question 3

Risk ____________ is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be mitigated.

Accepted Answer

The answer of Risk ____________ is the process of discovering...

Question 4

Assigns a risk-rating ranked value to each uncontrolled asset-vulnerability pair.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Question 5

What are the included tasks in the identification of risks?

Accepted Answer

Creating an inventory of information ass

Question 6

Some threats can manifest in multiple ways,yielding multiple vulnerabilities for an asset-threat pair.

Accepted Answer

A) True 
 B)False

Question 7

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process?

Accepted Answer

A)  Creating an inventory of information assets 
B)  Classifying and organizing information assets into meaningful groups 
C)  Assigning a value to each information asset 
D)  Calculating the severity of risks to which assets are exposed in their current setting 
A)  Creating an inventory of information assets 
B)  Classifying and organizing information assets into meaningful groups 
C)  Assigning a value to each information asset 
D)  Calculating the severity of risks to which assets are exposed in their current setting

Question 8

A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme.

Accepted Answer

A) True 
 B)False

Question 9

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet​.

Accepted Answer

A) True 
 B)False

Question 10

Why is threat identification so important in the process of risk management?

Accepted Answer

Any organization typically faces a wide

Question 11

Discuss the trends in frequency of attacks and how that plays into a risk management strategy.

Accepted Answer

The number of detected attacks is steadi

Question 12

Labels that must be comprehensive and mutually exclusive.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Question 13

The information technology management community of interest often takes on the leadership role in addressing risk.​

Accepted Answer

A) True 
 B)False

Question 14

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.is known as risk protection.

Accepted Answer

A) True 
 B)False

Question 15

Describe the use of an IP address when deciding which attributes to track for each information asset.

Accepted Answer

This attribute is useful for network dev

Question 16

Which of the following attributes does NOT apply to software information assets?

Accepted Answer

A)  Serial number 
B)  Controlling entity 
C)  Manufacturer name 
D)  Product dimensions 
A)  Serial number 
B)  Controlling entity 
C)  Manufacturer name 
D)  Product dimensions

Question 17

Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats.

Accepted Answer

likelihood

Question 18

Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest,which includes all but which of the following?

Accepted Answer

A)  General management must structure the IT and InfoSec functions 
B)  IT management must serve the IT needs of the broader organization 
C)  Legal management must develop corporate-wide standards 
D)  InfoSec management must lead the way with skill, professionalism, and flexibility 
A)  General management must structure the IT and InfoSec functions 
B)  IT management must serve the IT needs of the broader organization 
C)  Legal management must develop corporate-wide standards 
D)  InfoSec management must lead the way with skill, professionalism, and flexibility

Question 19

The recognition,enumeration,and documentation of risks to an organization's information assets.is known as risk control.

Accepted Answer

A) True 
 B)False

Question 20

Which of the following is NOT among the typical columns in the ranked vulnerability risk worksheet?

Accepted Answer

A)  Uncertainty percentage 
B)  Asset impact 
C)  Risk-rating factor 
D)  Vulnerability likelihood 
A)  Uncertainty percentage 
B)  Asset impact 
C)  Risk-rating factor 
D)  Vulnerability likelihood

What does it mean to 'know the enemy' with respect to risk management?

The InfoSec community often takes on the leadership role in addressing risk.

Risk ____________ is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be mitigated.

Assigns a risk-rating ranked value to each uncontrolled asset-vulnerability pair.

What are the included tasks in the identification of risks?

Some threats can manifest in multiple ways,yielding multiple vulnerabilities for an asset-threat pair.

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process?

A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme.

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet.

Why is threat identification so important in the process of risk management?

Discuss the trends in frequency of attacks and how that plays into a risk management strategy.

Labels that must be comprehensive and mutually exclusive.

The information technology management community of interest often takes on the leadership role in addressing risk.

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.is known as risk protection.

Describe the use of an IP address when deciding which attributes to track for each information asset.

Which of the following attributes does NOT apply to software information assets?

Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats.

Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest,which includes all but which of the following?

The recognition,enumeration,and documentation of risks to an organization's information assets.is known as risk control.

Which of the following is NOT among the typical columns in the ranked vulnerability risk worksheet?

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 6: Risk Management: Identifying and Assessing Risk

What does it mean to 'know the enemy' with respect to risk management?

The InfoSec community often takes on the leadership role in addressing risk.

Risk ____________ is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be mitigated.

Assigns a risk-rating ranked value to each uncontrolled asset-vulnerability pair.

What are the included tasks in the identification of risks?

Some threats can manifest in multiple ways,yielding multiple vulnerabilities for an asset-threat pair.

Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process?

A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme.

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet​.

Why is threat identification so important in the process of risk management?

Discuss the trends in frequency of attacks and how that plays into a risk management strategy.

Labels that must be comprehensive and mutually exclusive.

The information technology management community of interest often takes on the leadership role in addressing risk.​

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.is known as risk protection.

Describe the use of an IP address when deciding which attributes to track for each information asset.

Which of the following attributes does NOT apply to software information assets?

Assessing risks includes determining the ____________________ that vulnerable systems will be attacked by specific threats.

Each manager in the organization should focus on reducing risk. This is often done within the context of one of the three communities of interest,which includes all but which of the following?

The recognition,enumeration,and documentation of risks to an organization's information assets.is known as risk control.

Which of the following is NOT among the typical columns in the ranked vulnerability risk worksheet?

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet.

The information technology management community of interest often takes on the leadership role in addressing risk.