IC34M01 - Assessment Overview

Question 1

Waht are the four parts to defining scope?

Answer 1

• Identify Requirements
• Specify Devices
• Select collection Method
• Document

Question 2

Name some benefits of Cybersecurity Risk Assessments

Answer 2

• Determine order or priority
• Define threats, vulnerabilities, and consequences
• Design and apply countermeasures
• Prioritize mitigation activities and resources
• Evaluate effectiveness versus cost of countermeasure procedures

Question 3

What is produced in every step of the Cyber Risk Assessment Process?

Answer 3

Documentation
If you didn’t document your steps, there is nothing to verify, audit, or prove the findings of the assessment.

Question 4

What are the four key concepts of scope?

Answer 4

• System Architecture Diagrams
• Network Diagrams
• Asset Assessment
• Criticality Assessment

Question 5

What determines the parameters of what is included in the assessment and how it is performed?
1. Scope
2. Vulnerability
3. Threat
4. Documentation

Answer 5

Scope

Question 6

Why conduct Cybersecurity Vulnerability Assessments?
1. To determine return on investment
2. To identify requirements for specific devices
3. To define, identify and classify vulnerabilities in systems&networks.
4. To collect data and document system diagrams

Answer 6

To define, identify and classify vulnerabilities in systems&networks.

Question 7

Which key concept of Scope details a list of all elements in a system?
1. Asset Inventory
2. Criticicality Assessment
3. Network Diagram
4. System Architecture Diagram

Answer 7

Asset Inventory

Question 8

Which is not a benefit of a Cybersecurity Risk Assessment?
1. Define threat, vulnerabilities & consequences
2. Design & apply countermeasures
3. Prevent audits by documenting procedures
4. Prioritize activities & resources for mitigation

Answer 8

Prevent audits by documenting procedures

Question 9

Why should you partition the system under consideration into zones and conduits when conducting a cyber risk assessment?
1. To ensure the best possible protection
2. To practice by repeating the process for each zone & conduit
3. To determine the Security Level Target
4. To determine the residual cyber risk

Answer 9

To ensure the best possible protection