Question 1

A risk control strategy that eliminates all risk associated with an information asset by removing it from service.

Accepted Answer

A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy 
A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy D

Question 2

An examination of how well a particular solution fits within the organization's strategic planning objectives and goals.

Accepted Answer

A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy 
A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy I

Question 3

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the ​termination risk control strategy.

Accepted Answer

A) True 
 B)False  True

Question 4

The formal assessment and presentation of the economic expenditures needed for a particular security control,contrasted with its projected value to the organization.

Accepted Answer

A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy 
A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy

Question 5

The only use of the acceptance strategy that is recognized as valid by industry practices occurs when the organization has done all but which of the following?

Accepted Answer

A)  Determined the level of risk posed to the information asset 
B)  Performed a thorough cost-benefit analysis 
C)  Determined that the costs to control the risk to an information asset are much lower than the benefit gained from the information asset 
D)  Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability 
A)  Determined the level of risk posed to the information asset 
B)  Performed a thorough cost-benefit analysis 
C)  Determined that the costs to control the risk to an information asset are much lower than the benefit gained from the information asset 
D)  Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability

Question 6

Which of the following affects the cost of a control?

Accepted Answer

A)  liability insurance 
B)  CBA report 
C)  asset resale 
D)  maintenance 
A)  liability insurance 
B)  CBA report 
C)  asset resale 
D)  maintenance

Question 7

The quantity and nature of risk that organizations are willing to accept.

Accepted Answer

A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy 
A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy

Question 8

A process of assigning financial value or worth to each information asset.

Accepted Answer

A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy 
A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy

Question 9

To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.

Accepted Answer

The answer of To keep up with the competition organizations...

Question 10

Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

Accepted Answer

What damage could occur,and what financi

Question 11

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .

Accepted Answer

The answer of The risk control strategy that seeks to...

Question 12

Describe operational feasibility.

Accepted Answer

Operational feasibility refers to user a

Question 13

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

Accepted Answer

A)  risk assessment 
B)  risk treatment 
C)  risk communication 
D)  risk determination 
A)  risk assessment 
B)  risk treatment 
C)  risk communication 
D)  risk determination

Question 14

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

Accepted Answer

A)  When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exploited. 
B)  When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack. 
C)  When the attacker's potential gain is less than the costs of attack: Apply protections to decrease the attacker's cost or reduce the attacker's gain, by using technical or operational controls. 
D)  When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss. 
A)  When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exploited. 
B)  When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack. 
C)  When the attacker's potential gain is less than the costs of attack: Apply protections to decrease the attacker's cost or reduce the attacker's gain, by using technical or operational controls. 
D)  When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss.

Question 15

What is the result of subtracting the post-control annualized loss expectancy and the ACS from the pre-control annualized loss expectancy?

Accepted Answer

A)  cost-benefit analysis 
B)  exposure factor 
C)  single loss expectancy 
D)  annualized rate of occurrence 
A)  cost-benefit analysis 
B)  exposure factor 
C)  single loss expectancy 
D)  annualized rate of occurrence

Question 16

Discuss three alternatives to feasibility analysis.

Accepted Answer

--Benchmarking is the process of seeking

Question 17

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

Accepted Answer

A)  acceptance 
B)  avoidance 
C)  transference 
D)  mitigation 
A)  acceptance 
B)  avoidance 
C)  transference 
D)  mitigation

Question 18

Which of the following is not a step in the FAIR risk management framework?

Accepted Answer

A)  identify scenario components 
B)  evaluate loss event frequency 
C)  assess control impact 
D)  derive and articulate risk 
A)  identify scenario components 
B)  evaluate loss event frequency 
C)  assess control impact 
D)  derive and articulate risk

Question 19

Briefly describe the five basic strategies to control risk that result from vulnerabilities.

Accepted Answer

​Defense-Applying controls and safeguard

Question 20

Once a control strategy has been selected and implemented,what should be done on an ongoing basis to determine their effectiveness and to estimate the remaining risk?

Accepted Answer

A)  analysis and adjustment 
B)  review and reapplication 
C)  monitoring and measurement 
D)  evaluation and funding 
A)  analysis and adjustment 
B)  review and reapplication 
C)  monitoring and measurement 
D)  evaluation and funding

A risk control strategy that eliminates all risk associated with an information asset by removing it from service.

An examination of how well a particular solution fits within the organization's strategic planning objectives and goals.

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the termination risk control strategy.

The formal assessment and presentation of the economic expenditures needed for a particular security control,contrasted with its projected value to the organization.

The only use of the acceptance strategy that is recognized as valid by industry practices occurs when the organization has done all but which of the following?

Which of the following affects the cost of a control?

The quantity and nature of risk that organizations are willing to accept.

A process of assigning financial value or worth to each information asset.

To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.

Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .

Describe operational feasibility.

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

What is the result of subtracting the post-control annualized loss expectancy and the ACS from the pre-control annualized loss expectancy?

Discuss three alternatives to feasibility analysis.

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

Which of the following is not a step in the FAIR risk management framework?

Briefly describe the five basic strategies to control risk that result from vulnerabilities.

Once a control strategy has been selected and implemented,what should be done on an ongoing basis to determine their effectiveness and to estimate the remaining risk?

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 7: Risk Management: Controlling Risk

A risk control strategy that eliminates all risk associated with an information asset by removing it from service.

An examination of how well a particular solution fits within the organization's strategic planning objectives and goals.

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the ​termination risk control strategy.

The formal assessment and presentation of the economic expenditures needed for a particular security control,contrasted with its projected value to the organization.

The only use of the acceptance strategy that is recognized as valid by industry practices occurs when the organization has done all but which of the following?

Which of the following affects the cost of a control?

The quantity and nature of risk that organizations are willing to accept.

A process of assigning financial value or worth to each information asset.

To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.

Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .

Describe operational feasibility.

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

What is the result of subtracting the post-control annualized loss expectancy and the ACS from the pre-control annualized loss expectancy?

Discuss three alternatives to feasibility analysis.

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

Which of the following is not a step in the FAIR risk management framework?

Briefly describe the five basic strategies to control risk that result from vulnerabilities.

Once a control strategy has been selected and implemented,what should be done on an ongoing basis to determine their effectiveness and to estimate the remaining risk?

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the termination risk control strategy.