Deck 7: Risk Management: Controlling Risk

Question 1

Application of training and education is a common method of which risk control strategy?

A) mitigation
B) defense
C) acceptance
D) transferal

Answer 1

B

Question 2

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

A) incident response plan
B) business continuity plan
C) disaster recovery plan
D) damage control plan

Answer 2

A

Question 3

Unlike other risk management frameworks,FAIR relies on the qualitative assessment of many risk components using scales with value ranges.

Answer 3

True

Question 4

The risk control strategy that attempts to shift risk to other assets,other processes,or other organizations is known as the defense risk controlstrategy.___________

Question 5

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.____________

Question 6

The only use of the acceptance strategy that is recognized as valid by industry practicesoccurs when the organization has done all but which of the following?

A) Determined the level of risk posed to the information asset
B) Performed a thorough cost-benefit analysis
C) Determined that the costs to control the risk to an information asset are much lower than the benefit gained from the information asset
D) Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability

Question 7

The ISO 27005 Standard for InfoSec Risk Management includes a five-stage management methodology; among them are risk treatment and risk communication.

Question 8

In a cost-benefit analysis,the expected frequency of an attack,expressed on a per-year basis is known as​theannualized risk of occurrence.____________

Question 9

Risks can be avoided by countering the threats facing an asset or by eliminating the exposure of an asset.

Question 10

Which of the following can be described as the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility?

A) residual risk
B) risk appetite
C) risk assurance
D) risk termination

Question 11

The defense risk control strategy may be accomplished by outsourcing to other organizations.

Question 12

Due care and due diligence occur when an organization adopts a certain minimum level of security-that is,what any prudent organization would do in similar circumstances.____________

Question 13

The risk control strategy that attempts to reduce the impact of the loss caused by a realized incident,disaster,or attack through effective contingency planning and preparation is known as themitigationrisk control strategy.____________

Question 14

Also known as an economic feasibility study,the formal assessment and presentation of the economic expenditures needed for a particular security control,contrasted with its projected value to the organization is known ascost-benefit analysis (CBA).____________

Question 15

The risk control strategy that eliminates all risk associated with an information asset by removing it from service is known as the​terminationrisk control strategy.

Question 16

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

A) acceptance
B) avoidance
C) transference
D) mitigation

Question 17

The risk control strategy that indicates the organization is willing to accept the current level of risk.As a result,the organization makes a conscious decision to do nothing to protect an information asset from risk and to accept the outcome from any resulting exploitation is known as the terminationrisk control strategy.

Question 18

A benchmark is derived by comparing measured actual performance against established standards for the measured category.____________ ​

Question 19

An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources,which include hardware,software,networking,and personnel is known as operationalfeasibility.____________

Question 20

The criterion most commonly used when evaluating a strategy to implement InfoSec controlsand safeguards is economic feasibility.

Question 21

Which of the following is not a step in the FAIR risk management framework?

A) identify scenario components
B) evaluate loss event frequency
C) assess control impact
D) derive and articulate risk

Question 22

The ISO 27005 Standard for Information Security Risk Management includes five stages including all but which of the following?

A) risk assessment
B) risk treatment
C) risk communication
D) risk determination

Question 23

Which of the followingdescribes the financial savings from using the defense risk control strategy to implement a control and eliminate the financial ramifications of an incident?

A) feasibility analysis
B) asset valuation
C) cost avoidance
D) cost-benefit analysis

Question 24

What does FAIR rely on to build the risk management framework that is unlike many other risk management frameworks?

A) qualitative assessment of many risk components
B) quantitative valuation of safeguards
C) subjective prioritization of controls
D) risk analysis estimates

Question 25

By multiplying the asset value by the exposure factor,you can calculate which of the following?

A) annualized cost of the safeguard
B) single loss expectancy
C) value to adversaries
D) annualized loss expectancy

Question 26

The ____________________ risk control strategy attempts to shift the risk to other assets,processes,or organizations.

Question 27

Which of the following is NOT an alternative to using CBA to justify risk controls?

A) benchmarking
B) due care and due diligence
C) selective risk avoidance
D) the gold standard

Question 28

The Microsoft Risk Management Approach includes four phases.Which of the following is NOT one of them?

A) conducting decision support
B) implementing controls
C) evaluating alternative strategies
D) measuring program effectiveness

Question 29

To keep up with the competition organizations must design and create a ____________ environment in which business processes and procedures can function and evolve effectively.

Question 30

Which of the following is NOT a valid rule of thumb on risk control strategy selection?

A) When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exploited.
B) When a vulnerability can be exploited: Apply layered protections, architectural designs, and administrative controls to minimize the risk or prevent the occurrence of an attack.
C) When the attacker's potential gain is less than the costs of attack: Apply protections to decrease the attacker's cost or reduce the attacker's gain, by using technical or operational controls.
D) When the potential loss is substantial: Apply design principles, architectural designs, and technical and non-technical protections to limit the extent of the attack, thereby reducing the potential for loss.

Question 31

The NIST risk management approach includes all but which of the following elements?

A) inform
B) assess
C) frame
D) respond

Question 32

The risk control strategy that seeks to reduce the impact of a successful attack through the use of IR,DR and BC plans is ____________________ .

Question 33

In which technique does a group rate or rank a set of information,compile the results and repeat until everyone is satisfied with the result?

A) OCTAVE
B) FAIR
C) Hybrid Measures
D) Delphi

Question 34

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

Question 35

The goal of InfoSec is not to bring residual risk to zero; rather,it is to bring residual risk in line with an organization's risk ___________.

Question 36

Which of the following determines acceptable practices based on consensus and relationships among the communities of interest.

A) organizational feasibility
B) political feasibility
C) technical feasibility
D) operational feasibility

Question 37

What should each information asset-threat pair have at a minimum that clearly identifies any residual risk that remains after the proposed strategy has been executed?

A) probability calculation
B) documented control strategy
C) risk acceptance plan
D) mitigation plan

Question 38

Once a control strategy has been selected and implemented,what should be done on an ongoing basis to determine their effectiveness and to estimate the remaining risk?

A) analysis and adjustment
B) review and reapplication
C) monitoring and measurement
D) evaluation and funding

Question 39

What is the result of subtracting the post-control annualized loss expectancy and the ACS from the pre-control annualized loss expectancy?

A) cost-benefit analysis
B) exposure factor
C) single loss expectancy
D) annualized rate of occurrence

Question 40

Which of the following affects the cost of a control?

A) liability insurance
B) CBA report
C) asset resale
D) maintenance

Question 41

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
The formalassessment and presentation of the economic expenditures needed for a particular securitycontrol,contrasted with its projected value to the organization.

Question 42

What are the four phases of the Microsoft risk management strategy?

Question 43

What does the result of a CBA determine?What is the formula for the CBA?

Question 44

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
A process of assigning financial value or worth to each information asset.

Question 45

Once an organization has estimated the worth of various assets,what three questions must be asked to calculate the potential loss from the successful exploitation of a vulnerability?

Question 46

What are the four stages of a basic FAIR analysis?

Question 47

Discuss three alternatives to feasibility analysis.

Question 48

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
An examination of how well a particular solution fits within theorganization's strategic planning objectives and goals.

Question 49

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
A risk control strategy that eliminates all risk associatedwith an information asset by removing it from service.

Question 50

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
The calculated value associated with themost likely loss from a single attack.

Question 51

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
The quantity and nature of risk that organizations are willing to accept.

Question 52

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
A risk control strategy that attempts to reduce the impactof the loss caused by a realized incident,disaster,or attack through effective contingencyplanning and preparation.

Question 53

Describe operational feasibility.

Question 54

Explain two practical guidelines to follow in risk control strategy selection.

Question 55

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
A risk control strategy that attempts to eliminate or reduceany remaining uncontrolled risk through the application of additional controls and safeguards.

Question 56

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
A risk control strategy that indicates the organization iswilling to accept the current level of risk and that the organization makes a conscious decisionto do nothing to protect an information asset from risk and to accept the outcome from anyresulting exploitation.

Question 57

a.defense risk control strategy
b.mitigation risk control strategy
c.acceptance risk control strategy
d.termination risk control strategy
e.risk appetite
f.cost-benefit analysis
g.cost avoidance
h.asset valuation
i.organizational feasibility
j.single loss expectancy
The financial savings from using the defense risk control strategy to implementa control and eliminate the financial ramifications of an incident.

Question 58

Briefly describe the five basic strategies to control risk that result from vulnerabilities.

Question 59

Describe the use of hybrid assessment to create a quantitative assessment of asset value.

Question 60

What is the OCTAVE method approach to risk management?