Question 1

Remains even after current control has been applied.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Question 2

An estimate made by the manager using good judgement and experience can account for which factor of risk assessment?

Accepted Answer

A)  Risk determination 
B)  Assessing potential loss 
C)  Likelihood and consequences 
D)  Uncertainty 
A)  Risk determination 
B)  Assessing potential loss 
C)  Likelihood and consequences 
D)  Uncertainty

Question 3

What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create?

Accepted Answer

A)  Risk exposure report 
B)  Threats-vulnerabilities-assets worksheet 
C)  Costs-risks-prevention database 
D)  Threat assessment catalog 
A)  Risk exposure report 
B)  Threats-vulnerabilities-assets worksheet 
C)  Costs-risks-prevention database 
D)  Threat assessment catalog

Question 4

The likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability are each examples of _____.

Accepted Answer

A)  Vulnerability mitigation controls 
B)  Risk assessment estimate factors 
C)  Exploit likelihood equation 
D)  Attack analysis calculation 
A)  Vulnerability mitigation controls 
B)  Risk assessment estimate factors 
C)  Exploit likelihood equation 
D)  Attack analysis calculation

Question 5

An evaluation of the threats to information assets,including a determination of their potential to endanger the organization is known as exploit assessment.

Accepted Answer

A) True 
 B)False

Question 6

Classification categories must be ____________________ and mutually exclusive.

Accepted Answer

The answer of Classification categories must be ____________________ and mutually...

Question 7

The recognition,enumeration,and documentation of risks to an organization's information assets.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Question 8

As each information asset is identified,categorized,and classified,a ________ value must also be assigned to it.

Accepted Answer

The answer of As each information asset is identified,categorized,and classified,a...

Question 9

​An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

Accepted Answer

A) True 
 B)False

Question 10

An evaluation of the dangers to information assets,including a determination of their potential to endanger the organization.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Question 11

What should you be armed with to adequately assess potential weaknesses in each information asset?

Accepted Answer

A)  Properly classified inventory 
B)  Audited accounting spreadsheet 
C)  Intellectual property assessment 
D)  List of known threats 
A)  Properly classified inventory 
B)  Audited accounting spreadsheet 
C)  Intellectual property assessment 
D)  List of known threats

Question 12

List the stages in the risk identification process in order of occurrence.

Accepted Answer

Plan and Organize ProcessCreate System C

Question 13

​The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.

Accepted Answer

A) True 
 B)False

Question 14

How should the initial inventory be used when classifying and categorizing assets?

Accepted Answer

The inventory should reflect the sensiti

Question 15

The quantity and nature of risk that organizations are willing to accept.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Question 16

The Australian and New Zealand Risk Management Standard 4360 uses qualitative methods to determine risk based on a threat's probability of occurrence and expected results of a successful attack.

Accepted Answer

A) True 
 B)False

Question 17

Which of the following is an attribute of a network device is physically tied to the network interface?

Accepted Answer

A)  Serial number 
B)  MAC address 
C)  IP address 
D)  Model number 
A)  Serial number 
B)  MAC address 
C)  IP address 
D)  Model number

Question 18

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Question 19

Determining the cost of recovery from an attack is one calculation that must be made to identify risk,what is another?

Accepted Answer

A)  Cost of prevention 
B)  Cost of litigation 
C)  Cost of detection 
D)  Cost of identification 
A)  Cost of prevention 
B)  Cost of litigation 
C)  Cost of detection 
D)  Cost of identification

Question 20

An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures.

Accepted Answer

A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet 
A)  risk management 
B)  risk analysis 
C)  classification categories 
D)  risk identification 
E)  field change order
F) threat assessment
G) risk appetite
H) qualitative assessment
I) residual risk
J) ranked vulnerability risk worksheet

Remains even after current control has been applied.

An estimate made by the manager using good judgement and experience can account for which factor of risk assessment?

What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create?

The likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability are each examples of _____.

An evaluation of the threats to information assets,including a determination of their potential to endanger the organization is known as exploit assessment.

Classification categories must be ____________________ and mutually exclusive.

The recognition,enumeration,and documentation of risks to an organization's information assets.

As each information asset is identified,categorized,and classified,a ________ value must also be assigned to it.

An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

An evaluation of the dangers to information assets,including a determination of their potential to endanger the organization.

What should you be armed with to adequately assess potential weaknesses in each information asset?

List the stages in the risk identification process in order of occurrence.

The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.

How should the initial inventory be used when classifying and categorizing assets?

The quantity and nature of risk that organizations are willing to accept.

The Australian and New Zealand Risk Management Standard 4360 uses qualitative methods to determine risk based on a threat's probability of occurrence and expected results of a successful attack.

Which of the following is an attribute of a network device is physically tied to the network interface?

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.

Determining the cost of recovery from an attack is one calculation that must be made to identify risk,what is another?

An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 6: Risk Management: Identifying and Assessing Risk

Remains even after current control has been applied.

An estimate made by the manager using good judgement and experience can account for which factor of risk assessment?

What should the prioritized list of assets and their vulnerabilities and the prioritized list of threats facing the organization be combined to create?

The likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability are each examples of _____.

An evaluation of the threats to information assets,including a determination of their potential to endanger the organization is known as exploit assessment.

Classification categories must be ____________________ and mutually exclusive.

The recognition,enumeration,and documentation of risks to an organization's information assets.

As each information asset is identified,categorized,and classified,a ________ value must also be assigned to it.

​An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

An evaluation of the dangers to information assets,including a determination of their potential to endanger the organization.

What should you be armed with to adequately assess potential weaknesses in each information asset?

List the stages in the risk identification process in order of occurrence.

​The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.

How should the initial inventory be used when classifying and categorizing assets?

The quantity and nature of risk that organizations are willing to accept.

The Australian and New Zealand Risk Management Standard 4360 uses qualitative methods to determine risk based on a threat's probability of occurrence and expected results of a successful attack.

Which of the following is an attribute of a network device is physically tied to the network interface?

An approach to combining risk identification,risk assessment,and risk appetite into a single strategy.

Determining the cost of recovery from an attack is one calculation that must be made to identify risk,what is another?

An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

An asset valuation approach that uses categorical or nonnumeric values rather than absolute numerical measures is known as numberless assessment.

The probability that a specific vulnerability within an organization will be the target of an attack is known as risk.