Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1: Security and Risk Management; Risk Analysis > Flashcards

Domain 1: Security and Risk Management; Risk Analysis Flashcards

1
Q

Why is Risk Analysis a critical skill?

A

Our risk decisions will dictate which safeguards we deploy to protect our assets, and the amount of money and resources we spend doing so. Poor decisions will result in wasted money, or even worse, compromised data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are assets?

A

Assets are valuable resources you are trying to protect. Assets can be data, systems, people, buildings, property, and so forth. The value and criticality of the asset will dictate what safeguards you deploy. People are your most valuable asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a threat?

A

A threat is a potentially harmful occurence. A threat is a negative action that may harm a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a vulnerability?

A

A vulnerability is a weakness that allows a threat to cause harm. Examples: Buildings that are not built to withstand earthquakes, a data center without proper backup power, Microsoft XP systems that haven’t been patched for years.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an attack vector?

A

A condition that makes a system vulnerable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How do you calculate risk?

A

Risk = Threat x vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is impact?

A

Impact is the severity of the damage, sometimes expressed in dollars. Risk = Threat x Vulnerability x Cost. A synonym for impact is consequences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

On a scale of 1 to 5, what is the impact value of loss of human life?

A

Loss of human life has near-infinite impact on the exam. Any risk involving loss of human life is extremely high and must be mitigated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

True or false? When assigning a number to threats and vulnerabilities, the range is arbitrary. Keep it consistent when comparing different risk.

A

True.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the Risk Analysis Matrix?

A

The Risk Analysis Matrix uses a quadrant to map the likelihood of a risk occurring against the consequences (or impact) that risk would have. The resulting scores are low, medium, high, and extremely high.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the goal of the Risk Analysis Matrix?

A

To identify high likelihood/high consequence risks and drive them down to low likelihood/low consequence risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How are risks handled?

A

Low risks are handled via normal process; moderate risk require management notification; high risks require senior management notification, and extreme risks require immediate action including a detailed mitigation plan (and senior management notification).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ALE?

A

Annualized Loss Expectancy. Allows you to determine the annual cost of a loss due to a risk. ALE allows you to make informed decisions to mitigate risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is AV?

A

Asset Value. The value of the asset you’re trying to protect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the true Asset Value of a laptop with PII?

A

The cost of the laptop plus the cost to the company from the theft of unencrypted PII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the cost to the company for theft of unencrypted PII?

A

Regulatory fines, bad publicity, legal fees, staff hours spent investigating, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are tangible assets? Is it easy to calculate their value?

A

Examples of tangible assets are buildings and computers. They are easy to calculate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are intangible assets? Is it easy to calculate their value?

A

An example would be brand loyalty. It’s challenging to calculate the value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the three methods of calculating the value of intangible assets according to Deloitte?

A

Market approach.
Income approach.
Cost approach.

20
Q

What is Market Approach?

A

This approach assumes that fair value of an asset reflects the price which comparable assets have been purchased in transactions under similar circumstances.

21
Q

What is Income Approach?

A

This approach is based on the premise that the value of an asset is the present value of the future earning capacity that an asset will generate over its remaining useful life.

22
Q

What is Cost Approach?

A

This approach estimates the fair value of the asset by reference to the costs that would be incurred in order to recreate or replace the asset.

23
Q

What is EF (Exposure Factor)?

A

The Exposure Factor is the percentage of value an asset lost due to an incident.

24
Q

What is SLE (Single Loss Expectancy)?

A

Single Loss Expectancy is the cost of a single loss. SLE is calculated by AV x EF.

25
Q

What is ARO (Annual Rate of Occurence)?

A

Annual Rate of Occurence is the number of losses you suffer per year.

26
Q

What is ALE (Annualized Loss Expectancy)?

A

Annualized Loss Expectancy is your yearly cost due to a risk. It is calculated by multiplying the SLE with ARO.

27
Q

What is TCO (Total Cost of Ownership)?

A

The total cost of a mitigating safeguard. TCO combines upfront costs plus annual cost of maintenance, including staff hours, vendor maintenance fees, software subscriptions, etc. These ongoing costs are usually considered operational expenses.

28
Q

What is ROI (Return on Investment)?

A

The amount of money saved by implementing a safeguard. If your TCO is less than your ALE, then you have a positive ROI. If your TCO is greater than your ALE, then you have a negative ROI, which is a result or poor choices.

29
Q

Why are metrics important?

A

Metrics can greatly assist the information security budgeting process. They help illustrate potentially costly risks, and demonstrate the effectiveness (and potential cost savings) of existing controls. They also help champion the cause of information security.

30
Q

What are the four risk choices after an assessment has been made?

A

Accept the risk.
Mitigate or eliminate the risk.
Transfer the risk.
Avoid the risk.

31
Q

When does it make sense to accept a risk?

A

When it’s cheaper to leave an asset unprotected due to a specific risk, rather than make the effor (and spend the money) required to protect it. All options must be considered before accepting a risk.

32
Q

When is accepting a risk not an option?

A

High and extremely high risks cannot be accepted. Data protected by laws or regulations or risk to human life or safety are cases where accepting the risk is not an option.

33
Q

What is mitigating risk?

A

Mitigating risk is lowering risk to an acceptable level. Also called risk reduction.

34
Q

What is reduction analysis?

A

The process of lowering risk.

35
Q

What is eliminating risk?

A

Removing the risk entirely.

36
Q

What is transfer the risk?

A

Using a third party to accept the risk.

37
Q

What is risk avoidance?

A

After a risk assessment is made, if the ALE is higher than the ROI, then it’s best to avoid the risk and not implement what was proposed. Exceptions to this is if there are legal or regulatory reasons that dictates this decision.

38
Q

What is the difference between Quantitative and Qualitative Risk Analysis?

A

Quantitative uses hard metrics such as dollars. Qualitative uses simple approximate values. Quantitative is more objective. Qualitative is more subjective.

39
Q

What is Hybrid Risk Analysis?

A

Combines quantitative and qualitative analysis. Quantitative for risks that are easily calculated in hard numbers, and qualitative for the remainder.

40
Q

What is an example of Quantitative Risk Analysis?

A

Calculating the ALE.

41
Q

What is an example of Qualitative Risk Analysis?

A

The Risk Analysis Matrix.

42
Q

Why is Quantitative Risk Analysis more difficult to calculate?

A

It requires you to calculate the asset value of everything vulnerable to the risk. Damage to a data center due to an earthquake requires knowing the cost of the building, servers, network equipment, computer racks, monitors, etc. Then you have to calculate the Exposure Factor, and so on. To qualitatively analyze a risk, you would research and risk and agree to a number value (1-5) of the likelihood and consequence and use the Risk Analysis Matrix to determine the risk value.

43
Q

The NIST (United States National Institute of Standards and Technology) published the Risk Management Guide for Information Technology Systems. The guide describes what 9-step Risk Analysis process?

A
  1. System Characterization
  2. Threat Identification
  3. Vulnerability Identification
  4. Control Analysis
  5. Likelihood Determination
  6. Impact Analysis
  7. Risk Determination
  8. Control Recommmendations
  9. Results Documentation
44
Q

According to the Risk Management Guide for Information Technology Systems, what is System Characterization?

A

System characterization describes the scope of the risk management effort and the systems that will be analyzed.

45
Q

According to the Risk Management Guide for Information Technology Systems, what is Control Analysis?

A

Analyzes the security controls (safeguards) that are in place or planned to mitigate the risk.

46
Q

According to the Risk Management Guide for Information Technology Systems, what is Control Recommendations?

A

Risk mitigation strategy.

47
Q

According to the Risk Management Guide for Information Technology Systems, what is Results Documentation.

A

The risk mitigation strategy is documented in this step.

CISSP (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions