IS3110 CHAP 1

Question 1

Which of the following properly defines risk?

1. Threat x Mitigation
2. Vulnerability x Controls
3. Controls - Residual Risk
4. Threat x Vulnerability

Answer 1

Threat x Vulnerability

Question 2

Which of the following properly defines total risk?

1. Threat - Mitigation
2. Threat x Vulnerability x Asset Value
3. Vulnerability - Controls
4. Vulnerability x Controls

Answer 2

Threat x Vulnerability x Asset Value

Question 3

You can completely eliminate risk in an IT environment.

TRUE OR FALSE

Answer 3

FALSE

Question 4

Which of the following are accurate pairings of threat categories? (Select Two)

1. External and Internal
2. Natural and supernatural
3. Intentional and accidental
4. Computer and user

Answer 4

External and Internal
AND
Intentional and accidental

Question 5

A loss of client confidence or public trust is an example of loss of ___.

Answer 5

Intangible value

Question 6

A ___ is used to reduce a vulnerability.

Answer 6

RISK MANAGEMENT PLAN

Question 7

As long as a company is profitable, it does not need to consider survivability.
TRUE OR FALSE

Answer 7

FALSE

Question 8

What is the primary goal of an information security program?

1. Eliminate losses related to employee actions
2. Eliminate losses related to risk
3. Reduce losses related to residual risk
4. Reduce losses related to loss of confidentiality, integrity, and availability

Answer 8

Reduce losses related to loss of confidentiality, integrity, and availability

Question 9

The ___ is an industry-recognized standard list of common vulnerabilities.

Answer 9

CVE

Question 10

Which of the following is a goal of a risk management?

1. Identify the correct cost balance between risk and controls
2. Eliminate risk by implementing controls
3. Eliminate the loss associated with risk
4. Calculate value associated with residual risk

Answer 10

Identify the correct cost balance between risk and controls

Question 11

If the benefits outweighs the cost, a control is implemented. Costs and benefits are identified by completing a ___.

Answer 11

COST BENEFIT ANALYSIS

Question 12

A company decides to reduce losses of a threat by purchasing insurance. This is known as risk ___.

Answer 12

Transfer

Question 13

What can you do to manage risk? (Select three)

1. Accept
2. Transfer
3. Avoid
4. Migrate

Answer 13

Accept
Transfer
Avoid

Question 14

You have applied controls to minimize risk in the environment. What is the remaining risk called?

1. Remaining Risk
2. Mitigated risk
3. Managed Risk
4. Residual Risk

Answer 14

Residual Risk

Question 15

Who is ultimately responsible for losses resulting from residual risk?

1. End users
2. Technical staff
3. Senior Management
4. Security personnel

Answer 15

Senior Management

Question 16

A technique used to manage risk.
When the cost to reduce the risk is greater than the potential loss, the risk is accepted.
A risk is also accepted if management considers the risk necessary and tolerable for business

Answer 16

ACCEPT

Question 17

Ensuring that data or a service is available when needed. Data and services are protected using fault tolerance and redundancy techniques

Answer 17

AVAILABILITY

Question 18

A technique used to manage risk.
A risk can be avoided by eliminating the source of the risk or eliminating the exposure of assets to the risk.
A company can either stop the risk activity or move the asset.

Answer 18

AVOID

Question 19

Database of vulnerabilities maintained by the MITRE Corporation
MITRE works in conjunction with the US Dept of Homeland Security

Answer 19

CVE

Question 20

Protecting data from unauthorized disclosure. Data is protected using access controls and encryption technologies.

Answer 20

CONFIDENTIALITY

Question 21

An action or change put in place to reduce a weakness or potential loss. A control is also referred to as a countermeasure

Answer 21

CONTROL

Question 22

A process used to determine how to manage a risk.
If the benefits of a control outweigh the costs, the control can be implemented to reduce the risk. If the costs are greater than the benefits, the risk can be accepted.

Answer 22

COST-BENEFIT ANALYSIS (CBA)

Question 23

The amount of the loss resulting from a threat exploiting a vulnerability. The loss can be expressed in monetary terms or a relative value. The impact identifies the severity of the loss. Impact is derived from the opinions of experts.

Answer 23

IMPACT

Question 24

Value that isn’t directly related to the actual cost of a physical asset. Intangibles can include future lost revenue, client confidence, and customer influence.

Answer 24

INTANGIBLE VALUE

Question 25

Ensuring data or IT systems are not modified or destroyed. Hashing is often used to ensure integrity

Answer 25

INTEGRITY

Question 26

One of the techniques used to manage risk. Mitigation is also known as risk reduction. Vulnerabilities are reduced by implementing controls or countermeasures

Answer 26

MITIGATE

Question 27

The ability of a company to make a profit.

It is calculated as revenues minus costs. Risk management considers both profitability and survivability

Answer 27

PROFITABILITY

Question 28

A judgement test that a company can apply to determine if the risk should be managed. If a reasonable person would expect the risk to be managed, it should be managed.

Answer 28

REASONABLENESS

Question 29

The risk that remains after controls have been applied. This is also referred to as acceptable risk.

Answer 29

RESIDUAL RISK

Question 30

A process used to identify and evaluate risks based on an analysis of threats and vulnerabilities to assets. Risks are quantified based on their importance or impact severity. These risks are then prioritized.

Answer 30

RISK ASSESSMENT

Question 31

The practice of identifying, assessing, controlling, and mitigating risks. Techniques to manage risk include avoiding, transferring, mitigating, and accepting the risk.

Answer 31

RISK MANAGEMENT

Question 32

The ability of a company to survive loss due to a risk. Some losses can be so severe they will cause the business to fail if not managed.

Answer 32

SURVIVABILITY

Question 33

The actual cost of an asset

Answer 33

TANGIBLE VALUE

Question 34

Any activity that represents a possible danger. This includes any circumstances or events with the potential to adversely impact confidentiality, integrity, or availability of a business’s assets

Answer 34

THREAT

Question 35

The amount of risk when the affected asset value is known. It is often expressed as:
Threat x Vulnerability x asset value = ___

Answer 35

TOTAL RISK

Question 36

One of the techniques used to manage risk. The risk is transferred by shifting responsibility to another party. This can be done by purchasing insurance or outsourcing the activity

Answer 36

TRANSFER

Question 37

A weakness or exposure to a threat.

The weakness can be weakness in an asset or the environment. It can be mitigated with a control

Answer 37

VULNERABILITY