Deck 4: Risk Management

Question 1

Once the organizational threats have been identified,an assets identification process is undertaken.

Answer 1

False

Question 2

Examples of exceptionally grave damage include armed hostilities against the United States or its allies and disruption of foreign relations vitally affecting the national security.

Answer 2

True

Question 3

Comprehensive means that an information asset should fit in only one category.

Answer 3

False

Question 4

You cannot use qualitative measures to rank values.

Question 5

The general management of an organization must structure the IT and information security functions to defend the organization's information assets.

Question 6

The amount of money spent to protect an asset is based in part on the value of the asset.

Question 7

A certificate authority should actually be categorized as a software security component.

Question 8

Eliminating a threat is an impossible proposition.

Question 9

When determining the relative importance of each asset,refer to the organization's mission statement or statement of objectives to determine which elements are essential,which are supportive,and which are merely adjuncts.

Question 10

Leaving unattended computers on is one of the top information security mistakes made by individuals.

Question 11

Risk control is the application of controls to reduce the risks to an organization's data and information systems.

Question 12

Information security managers and technicians are the creators of information.

Question 13

"If you realize you do not know the enemy,you will gain an advantage in every battle." (Sun Tzu)

Question 14

You should adopt naming standards that do not convey information to potential system attackers.

Question 15

The value of intellectual property influences asset valuation.

Question 16

Know yourself means identifying,examining,and understanding the threats facing the organization.

Question 17

If every vulnerability identified in the organization is handled through mitigation,it may reflect an inability to conduct proactive security activities and an apathetic approach to security in general.

Question 18

To determine if the risk is acceptable or not,you estimate the expected loss the organization will incur if the risk is exploited.

Question 19

Protocols are activities performed within the organization to improve security.

Question 20

Identifying human resources,documentation,and data information assets of an organization is less difficult than identifying hardware and software assets.

Question 21

Some argue that it is virtually impossible to determine the true value of information and information-bearing assets.

Question 22

Program-specific policies address the specific implementations or applications of which users should be aware._________________________

Question 23

Every organization should have the collective will and budget to manage every threat by applying controls.

Question 24

One way to determine which information assets are critical is by evaluating how much of the organization's revenue depends on a particular asset._________________________

Question 25

Risk control is the examination and documenting of the security posture of an organization's information technology and the risks it faces._________________________

Question 26

Metrics-based measures are generally less focused on numbers and more strategic than process-based measures.

Question 27

One problem with benchmarking is that there are many organizations that are identical.

Question 28

The mitigate control strategy attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation._________________________

Question 29

Policies are documents that specify an organization's approach to security._________________________

Question 30

Best business practices are often called recommended practices.

Question 31

Each of the threats faced by an organization must be examined to assess its potential to endanger the organization and this examination is known as a threat profile._________________________

Question 32

Internal benchmarking can provide the foundation for baselining.

Question 33

The most common of the mitigation procedures is the disaster recovery plan._________________________

Question 34

CBAs cannot be calculated after controls have been functioning for a time.

Question 35

Risk evaluation assigns a risk rating or score to each information asset._________________________

Question 36

A best practice proposed for a small home office setting is appropriate to help design control strategies for a multinational company.

Question 37

Organizations should communicate with system users throughout the development of the security program,letting them know that change are coming.

Question 38

Mutually exclusive means that all information assets must fit in the list somewhere._________________________

Question 39

The results from risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control,a project-based risk assessment,or a topic-specific risk assessment.

Question 40

Establishing a competitive business model,method,or technique enabled an organization to provide a product or service that was superior and created a(n)competitive advantage._________________________

Question 41

ALE determines whether or not a particular control alternative is worth its cost._________________________

Question 42

____ addresses are sometimes called electronic serial numbers or hardware addresses.

A)HTTP
B)IP
C)DHCP
D)MAC

Question 43

Security efforts that seek to provide a superior level of performance in the protection of information are referred to as best business practices._________________________

Question 44

The first phase of risk management is ____.

A)risk identification
B)design
C)risk control
D)risk evaluation

Question 45

A(n)exposure factor is the expected percentage of loss that would occur from a particular attack._________________________

Question 46

Operational feasibility is also known as behavioral feasibility._________________________

Question 47

Risk measure defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility._________________________

Question 48

A(n)disaster recovery plan dictates the actions an organization can and perhaps should take while an incident is in progress._________________________

Question 49

Many corporations use a ____ to help secure the confidentiality and integrity of information.

A)system classification scheme
B)data restoration scheme
C)data hierarchy
D)data classification scheme

Question 50

When the organization is pursuing an overall risk management program,it requires a(n)systematic report that enumerates the opportunities for controlling risk._________________________

Question 51

The concept of competitive ____ refers to falling behind the competition.

A)disadvantage
B)drawback
C)failure
D)shortcoming

Question 52

Likelihood risk is the risk to the information asset that remains even after the application of controls._________________________

Question 53

Major risk is a combined function of (1)a threat less the effect of threat-reducing safeguards,(2)a vulnerability less the effect of vulnerability reducing safeguards,and (3)an asset less the effect of asset value-reducing safeguards._________________________

Question 54

Risk ____ is the application of controls to reduce the risks to an organization's data and information systems.

A)management
B)control
C)identification
D)security

Question 55

Within organizations,technical feasibility defines what can and cannot occur based on the consensus and relationships between the communities of interest._________________________

Question 56

Qualitative-based measures are comparisons based on numerical standards,such as numbers of successful attacks._________________________

Question 57

Benefit is the value that an organization realizes by using controls to prevent losses associated with a specific vulnerability._________________________

Question 58

Within best practices,the optimum standard is a subcategory of practices that are typically viewed as "the best of the best." _________________________

Question 59

A(n)qualitative assessment is based on characteristics that do not use numerical measures._________________________

Question 60

In information security,benchmarking is the comparison of security activities and events against the organization's future performance._________________________

Question 61

The ____ strategy attempts to prevent the exploitation of the vulnerability.

A)suspend control
B)defend control
C)transfer control
D)defined control

Question 62

The ____ security policy is a planning document that outlines the process of implementing security in the organization.

A)program
B)agency
C)issue-specific
D)system-specific

Question 63

The ____ security policy is an executive-level document that outlines the organization's approach and attitude towards information security and relates the strategic value of information security within the organization.

A)general
B)agency
C)issue-specific
D)system-specific

Question 64

____ equals likelihood of vulnerability occurrence times value (or impact)minus percentage risk already controlled plus an element of uncertainty.

A)Probability
B)Risk
C)Possibility
D)Chance

Question 65

Management of classified data includes its storage and ____.

A)distribution
B)portability
C)destruction
D)All of the above

Question 66

____ policies address the particular use of certain systems.

A)Systems-specific
B)General
C)Network-specific
D)Platform-specific

Question 67

In a(n)____,each information asset is assigned a score for each of a set of assigned critical factor.

A)OPSEC
B)COMSEC
C)weighted factor analysis
D)data classification scheme

Question 68

The military uses a ____-level classification scheme.

A)three
B)four
C)five
D)six

Question 69

There are individuals who search trash and recycling - a practice known as ____ - to retrieve information that could embarrass a company or compromise information security.

A)side view
B)dumpster diving
C)recycle diving
D)garbage collection

Question 70

____ is simply how often you expect a specific type of attack to occur.

A)ARO
B)CBA
C)ALE
D)SLE

Question 71

When organizations adopt levels of security for a legal defense,they may need to show that they have done what any prudent organization would do in similar circumstances.This is referred to as a(n)____.

A)due diligence action
B)best practice
C)golden standard action
D)standard of due care

Question 72

The ____ strategy attempts to shift risk to other assets,other processes,or other organizations.

A)transfer control
B)defend control
C)accept control
D)mitigate control

Question 73

The ____ strategy is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation.

A)avoidance of risk
B)transference
C)mitigation
D)accept control

Question 74

____ plans usually include all preparations for the recovery process,strategies to limit losses during the disaster,and detailed steps to follow when the smoke clears,the dust settles,or the floodwaters recede.

A)IR
B)DR
C)BC
D)BR

Question 75

In the U.S.military classification scheme,____ data is any information or material the unauthorized disclosure of which reasonably could be expected to cause damage to the national security.

A)confidential
B)secret
C)top secret
D)sensitive

Question 76

The actions an organization can and perhaps should take while an incident is in progress should be specified in a document called the ____ plan.

A)BC
B)DR
C)IR
D)BR

Question 77

A(n)____ is an authorization issued by an organization for the repair,modification,or update of a piece of equipment.

A)IP
B)FCO
C)CTO
D)HTTP

Question 78

The formal decision making process used when considering the economic feasibility of implementing information security controls and safeguards is called a(n)____.

A)ARO
B)CBA
C)ALE
D)SLE

Question 79

____ feasibility analysis examines user acceptance and support,management acceptance and support,and the overall requirements of the organization's stakeholders.

A)Organizational
B)Technical
C)Operational
D)Political

Question 80

Risk ____ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility.

A)benefit
B)appetite
C)acceptance
D)avoidance