Managing Risk Flashcards
1
Q
When is risk avoidance a logical choice?
- When cyber insurance is available
- When cyber insurance is unavailable
- When the level of risk is acceptable
- When the level of risk is unacceptable
A
When the level of risk is unacceptable
2
Q
What is the relationship between risk acceptance and security controls?
- Security controls must be continuously monitored
- Security controls are not a part of risk acceptance
- Security controls must have changed default values
- Security controls must cost less than the asset being protected
A
Security controls are not a part of risk acceptance
3
Q
What is the first step when conducting a risk assessment?
- Identify threats
- Determine threat likelihood
- Inventory assets
- Assign a value to assets
A
Inventory assets
4
Q
Which type of risk treatment applies security controls to reduce threat impact?
- Risk acceptance
- Risk reduction
- Risk transfer
- Risk avoidance
A
Risk reduction
5
Q
What is the purpose of calculating the Annual Loss Expectancy (ALE)?
- To determine the percentage of asset loss
- To determine the maximum cost that should be spent on mitigating security controls
- To determine threat likelihood
- To determine compliance with applicable regulations
A
To determine the maximum cost that should be spent on mitigating security controls
6
Q
Which are examples of risk transfer strategies?
- Implementing mitigating security controls
- The use of cloud computing
- Not engaging in risky business ventures
- Cyber security insurance
A
The use of cloud computing
Cyber security insurance
7
Q
Which items would be documented in a risk register?
- Cost of security control
- Risk owner
- Past threat history
- Threat impact
A
Risk owner
Threat impact
