Question 1

Application of training and education is a common method of which risk control strategy?

Accepted Answer

A)  mitigation 
B)  defense 
C)  acceptance 
D)  transferal 
A)  mitigation 
B)  defense 
C)  acceptance 
D)  transferal

Question 2

By multiplying the asset value by the exposure factor,you can calculate which of the following?

Accepted Answer

A)  annualized cost of the safeguard 
B)  single loss expectancy 
C)  value to adversaries 
D)  annualized loss expectancy 
A)  annualized cost of the safeguard 
B)  single loss expectancy 
C)  value to adversaries 
D)  annualized loss expectancy

Question 3

Explain two practical guidelines to follow in risk control strategy selection.

Accepted Answer

- When a vulnerability (flaw or weakness

Question 4

The Microsoft Risk Management Approach includes four phases.Which of the following is NOT one of them?

Accepted Answer

A)  conducting decision support 
B)  implementing controls 
C)  evaluating alternative strategies 
D)  measuring program effectiveness 
A)  conducting decision support 
B)  implementing controls 
C)  evaluating alternative strategies 
D)  measuring program effectiveness

Question 5

What are the four stages of a basic FAIR analysis?

Accepted Answer

Stage 1-Identify Scenario Comp

Question 6

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

Accepted Answer

The answer of When a vulnerability (flaw or weakness)exists in...

Question 7

The calculated value associated with the most likely loss from a single attack.

Accepted Answer

A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy 
A)  defense risk control strategy 
B)  mitigation risk control strategy 
C)  acceptance risk control strategy 
D)  termination risk control strategy 
E)  risk appetite
F) cost-benefit analysis
G) cost avoidance
H) asset valuation
I) organizational feasibility
J) single loss expectancy

Question 8

​The risk control strategy that attempts to shift risk to other assets,other processes,or other organizations is known as the defense risk control strategy.

Accepted Answer

A) True 
 B)False

Question 9

In a cost-benefit analysis,the expected frequency of an attack,expressed on a per-year basis is known as ​the annualized risk of occurrence.

Accepted Answer

A) True 
 B)False

Question 10

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

Accepted Answer

A)  incident response plan 
B)  business continuity plan 
C)  disaster recovery plan 
D)  damage control plan 
A)  incident response plan 
B)  business continuity plan 
C)  disaster recovery plan 
D)  damage control plan

Question 11

What is the OCTAVE method approach to risk management?

Accepted Answer

The Operationally Critical Threat,Asset,

Question 12

The ISO 27005 Standard for InfoSec Risk Management includes a five-stage management methodology; among them are risk treatment and risk communication.

Accepted Answer

A) True 
 B)False

Question 13

Which of the following describes the financial savings from using the defense risk control strategy to implement a control and eliminate the financial ramifications of an incident?

Accepted Answer

A)  feasibility analysis 
B)  asset valuation 
C)  cost avoidance 
D)  cost-benefit analysis 
A)  feasibility analysis 
B)  asset valuation 
C)  cost avoidance 
D)  cost-benefit analysis

Question 14

The criterion most commonly used when evaluating a strategy to implement InfoSec controls and safeguards is economic feasibility.

Accepted Answer

A) True 
 B)False

Question 15

Which of the following is NOT an alternative to using CBA to justify risk controls?

Accepted Answer

A)  benchmarking 
B)  due care and due diligence 
C)  selective risk avoidance 
D)  the gold standard 
A)  benchmarking 
B)  due care and due diligence 
C)  selective risk avoidance 
D)  the gold standard

Question 16

The ____________________ risk control strategy attempts to shift the risk to other assets,  processes,or organizations.

Accepted Answer

transferen

Question 17

The NIST risk management approach includes all but which of the following elements?

Accepted Answer

A)  inform 
B)  assess 
C)  frame 
D)  respond 
A)  inform 
B)  assess 
C)  frame 
D)  respond

Question 18

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

Accepted Answer

A)  organizational feasibility 
B)  political feasibility 
C)  technical feasibility 
D)  operational feasibility 
A)  organizational feasibility 
B)  political feasibility 
C)  technical feasibility 
D)  operational feasibility

Question 19

The defense risk control strategy may be accomplished by outsourcing to other organizations.

Accepted Answer

A) True 
 B)False

Question 20

​The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.

Accepted Answer

A) True 
 B)False

Application of training and education is a common method of which risk control strategy?

By multiplying the asset value by the exposure factor,you can calculate which of the following?

Explain two practical guidelines to follow in risk control strategy selection.

The Microsoft Risk Management Approach includes four phases.Which of the following is NOT one of them?

What are the four stages of a basic FAIR analysis?

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

The calculated value associated with the most likely loss from a single attack.

The risk control strategy that attempts to shift risk to other assets,other processes,or other organizations is known as the defense risk control strategy.

In a cost-benefit analysis,the expected frequency of an attack,expressed on a per-year basis is known as the annualized risk of occurrence.

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

What is the OCTAVE method approach to risk management?

The ISO 27005 Standard for InfoSec Risk Management includes a five-stage management methodology; among them are risk treatment and risk communication.

Which of the following describes the financial savings from using the defense risk control strategy to implement a control and eliminate the financial ramifications of an incident?

The criterion most commonly used when evaluating a strategy to implement InfoSec controls and safeguards is economic feasibility.

Which of the following is NOT an alternative to using CBA to justify risk controls?

The ____________________ risk control strategy attempts to shift the risk to other assets, processes,or organizations.

The NIST risk management approach includes all but which of the following elements?

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

The defense risk control strategy may be accomplished by outsourcing to other organizations.

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 7: Risk Management: Controlling Risk

Application of training and education is a common method of which risk control strategy?

By multiplying the asset value by the exposure factor,you can calculate which of the following?

Explain two practical guidelines to follow in risk control strategy selection.

The Microsoft Risk Management Approach includes four phases.Which of the following is NOT one of them?

What are the four stages of a basic FAIR analysis?

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

The calculated value associated with the most likely loss from a single attack.

​The risk control strategy that attempts to shift risk to other assets,other processes,or other organizations is known as the defense risk control strategy.

In a cost-benefit analysis,the expected frequency of an attack,expressed on a per-year basis is known as ​the annualized risk of occurrence.

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

What is the OCTAVE method approach to risk management?

The ISO 27005 Standard for InfoSec Risk Management includes a five-stage management methodology; among them are risk treatment and risk communication.

Which of the following describes the financial savings from using the defense risk control strategy to implement a control and eliminate the financial ramifications of an incident?

The criterion most commonly used when evaluating a strategy to implement InfoSec controls and safeguards is economic feasibility.

Which of the following is NOT an alternative to using CBA to justify risk controls?

The ____________________ risk control strategy attempts to shift the risk to other assets, processes,or organizations.

The NIST risk management approach includes all but which of the following elements?

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

The defense risk control strategy may be accomplished by outsourcing to other organizations.

​The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

The risk control strategy that attempts to shift risk to other assets,other processes,or other organizations is known as the defense risk control strategy.

In a cost-benefit analysis,the expected frequency of an attack,expressed on a per-year basis is known as the annualized risk of occurrence.

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.