Question 1

The secretarial community often takes on the leadership role in addressing risk.____________

Accepted Answer

InfoSec,infosec,Information Security,information security

Question 2

The identification and assessment of levels of risk in an organization describes which of the following?

Accepted Answer

The identification and assessment of levels of risk in an organization are part of the risk analysis process. Risk analysis involves identifying potential risks, assessing the likelihood and potential impact of those risks, and developing strategies to manage or reduce them. Risk identification and risk reduction are both components of risk management, which is a broader process that includes not only identifying and reducing risks but also monitoring and responding to them over time.

Question 3

The recognition,enumeration,and documentation of risks to anorganization's information assets.is known as risk control.____________

Accepted Answer

identification

Question 4

An evaluation of the threats to information assets,including adetermination of their potential to endanger the organization is known as exploit assessment.____________

Accepted Answer

threat

Question 5

The Australian and New Zealand Risk Management Standard 4360 uses qualitative methods to determine risk based on a threat's probability of occurrence and expected results of a successful attack.

Accepted Answer

The Australian and New Zealand Risk Management Standard 4360 does use qualitative methods to determine risk based on the probability of occurrence and the expected consequences of a threat.

Question 6

Two of the activities involved in risk management include identifying risks and assessing risks.Which of the following activities is part of the risk assessment process?

Accepted Answer

The activity of calculating the severity of risks to which assets are exposed in their current setting is part of the risk assessment process. Creating an inventory of information assets, classifying and organizing them into meaningful groups, and assigning a value to each information asset are part of the risk identification process.

Question 7

Some threats can manifest in multiple ways,yielding multiple exploits for an asset-threat pair. ____________

Accepted Answer

vulnerabilities

Question 8

A formal access control methodology used to assign a level ofconfidentiality to an information asset and thus restrict the number of people who can access it is known as a data categorization scheme.____________

Accepted Answer

classification

Question 9

An approach to combining risk identification,risk assessment,and risk appetiteinto a single strategy.is known as risk protection.___________

Accepted Answer

analysis

Question 10

Each manager in the organization should focus on reducing risk.This is often done within the context of one of the three communities of interest,which includes all but which of the following?

Accepted Answer

The three communities of interest mentioned are general management, IT management, and InfoSec management. Legal management is not one of the communities of interest mentioned, making option C incorrect.

Question 11

The probability that a specific vulnerability within an organization will be the targetof an attack is known as risk.____________

Accepted Answer

likelihood

Question 12

Some threats can manifest in multiple ways,yielding multiple vulnerabilities for an asset-threat pair.

Accepted Answer

This statement is true. One threat can potentially have multiple ways of exploiting a vulnerability in an asset, leading to multiple vulnerabilities for a single asset-threat pair. It is important to identify and address all such vulnerabilities to ensure effective security.

Question 13

The InfoSec community often takes on the leadership role in addressing risk.

Accepted Answer

The InfoSec community is responsible for identifying, analyzing, and mitigating risks related to information security. They often take on leadership roles in addressing these risks and implementing necessary changes to enhance the security of an organization.

Question 14

MAC addresses are considered a reliable identifier for devices with network interfaces,since they are essentially foolproof.

Accepted Answer

While MAC addresses are often considered reliable identifiers, they can be spoofed or changed by advanced users or attackers. Therefore, they are not completely foolproof.

Question 15

An asset valuation approach that uses categorical or nonnumericvalues rather than absolute numerical measures is known as numberless assessment.____________

Accepted Answer

qualitative

Question 16

The information technology management community of interest often takes on the leadership role in addressing risk. ____________

Accepted Answer

infosec,information security

Question 17

Which of the following is a network device attribute that may be used in conjunction with DHCP,making asset-identification using this attribute difficult?

Accepted Answer

DHCP assigns IP addresses dynamically, so it may be challenging to use the IP address to identify a specific network device. Part numbers and serial numbers are unique to a device, and MAC addresses are also unique to a network card, making them more reliable options for identifying assets.

Question 18

Two of the activities involved in risk management include identifying risks and assessing risks.Which of the following activities is part of the risk identification process?

Accepted Answer

Assigning a value to each information asset is part of the risk identification process, as it involves recognizing and categorizing assets to understand their importance and potential impact if compromised.

Question 19

Having an established risk management program means that an organization's assets are completely protected.

Accepted Answer

While having an established risk management program can greatly reduce the likelihood and impact of potential hazards or threats, it cannot completely protect all of an organization's assets. There is always some level of risk present, and risk management programs are designed to minimize and mitigate those risks, rather than eliminate them entirely.

Question 20

A prioritized lists ofassets and threats can be combined with exploit information into a specialized report known as a TVA worksheet.____________

Accepted Answer