Risk Management Flashcards
Which of the following best describes a partnership?
A. The combination of two or more corporations transferring the properties to one surviving corporation
B. Two or more persons or companies contractually associated as joint principals in a business
C. Obtaining goods or services from an outside supplier
B. A condition in which a business cannot meet its debt obligations
B. A partnership is a type of business entity in which two or more entities share potential profit and risk with each other.
In what way is outsourcing different from a partnership?
A. Outsourcing only occurs when products come from third countries, whereas partnerships occur within the same country.
B. Both use in-house labor to create products for themselves.
C. One uses in-house labor, whereas the other contracts the labor from a partner.
D. One uses an outside supplier, whereas the other combines the two entities.
C. Outsourcing is when the customer assigns the work to the contractor.
Which of the following is not an issue to consider with cloud computing? A. Physical location of data B. Sensitivity of data C. Hiring practices D. Disaster recovery plans
A. With cloud computing, you don’t worry about the physical location of data.
Which of the following is not an advantage of quantitative risk assessments? A. Examination of real threats B. Fast results C. Real numbers D. Dollar values
B. Quantitative assessment takes much more time than qualitative assessment.
Which of the following is the formula for SLE? A. SLE = AV × EF B. SLE = AV / EF C. SLE = ARO × EF D. SLE = ARO × AV
A. Single loss expectancy (SLE) = asset value (AV) × exposure factor (EF).
Which of the following is not an advantage of qualitative risk assessments? A. Speed B. Use of numeric dollar values C. Based on CIA D. Performed by a team
B. There are no dollar values with qualitative assessment.
Which of the following is the formula for ALE? A. ALE = AV × ARO B. ALE = ARO x SLE C. ALE = SLE / ARO D. ALE = AV / ARO
B. Annualized loss expectancy (ALE) = annualized rate of occurrence (ARO) × single loss expectancy (SLE).
Which of the following is the approach for dealing with risk that incurs an ongoing continual cost from a third party? A. Accept B. Avoid C. Mitigate D. Transfer
D. Transferring the risk means to offload the risk to a third party, which would incur a monthly fee, such as, for example, an insurance premium.
Implementation of a firewall best maps to which of the following? A. Accept B. Avoid C. Mitigate D. Transfer
C. Implementing a technical control such as a firewall is an example of mitigating the risk (of network attacks).
The government-based information classification model is based on which of the following? A. Confidentiality B. Availability C. Integrity D. Service level
A. The governmental system focuses on confidentiality.
The industry-based model of information classification is based on which of the following? A. Confidentiality B. Availability C. Integrity D. Service level
C. An industrial or commercial system is based on integrity.
Which of the following is the highest level in the government model of information classification? A. Supersecret B. Top Secret C. Secret D. Sensitive
B. Top Secret is the highest classification level.
Which of the following is the lowest level of information classification in the public-sector model? A. Open B. Public C. Available D. Unclassified
B. Information classified as public is freely available for all to know.
Which of the following is not an attribute of TPM? A. Inexpensive
B. Specialized chip
C. External to device
D. Fast
C. The TPM is internal to the device.
Which of the following is not an attribute of HSM? A. Protects cryptographic algorithms
B. Comes in PCI blades
C. Sold as stand-alone devices
D. Can handle high volumes of transactions
D. HSM cannot handle high volumes of transactions.
