Question 1

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

Accepted Answer

A)   acceptance
B)   avoidance
C)   transference
D)   mitigationE) None of the above
F) B) and C)

Question 2

What does the result of a CBA determine?What is the formula for the CBA?

Accepted Answer

The CBA determines whether the benefit f...

Question 3

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

Accepted Answer

A)   incident response plan
B)   business continuity plan
C)   disaster recovery plan
D)   damage control planE) C) and D)
F) A) and B)

Question 4

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.____________

Accepted Answer

A) True 
 B)False

Question 5

The risk control strategy that indicates the organization is willing to accept the current level of risk.As a result,the organization makes a conscious decision to do nothing to protect an information asset from risk and to accept the outcome from any resulting exploitation is known as the termination risk control strategy.

Accepted Answer

A) True 
 B)False

Question 6

What is the OCTAVE method approach to risk management?

Accepted Answer

The Operationally Critical Threat,Asset,...

Question 7

A risk control strategy that indicates the organization iswilling to accept the current level of risk and that the organization makes a conscious decisionto do nothing to protect an information asset from risk and to accept the outcome from anyresulting exploitation.

Accepted Answer

A)  defense risk control strategy
B)  mitigation risk control strategy
C)  acceptance risk control strategy
D)  termination risk control strategy
E)  risk appetiteF) cost-benefit analysisG) cost avoidanceH) asset valuationI) organizational feasibilityJ) single loss expectancyK) D) and G)
L) D) and H)

Question 8

In which technique does a group rate or rank a set of information,compile the results and repeat until everyone is satisfied with the result?

Accepted Answer

A)   OCTAVE
B)   FAIR
C)   Hybrid Measures
D)   DelphiE) None of the above
F) C) and D)

Question 9

Which of the following is NOT an alternative to using CBA to justify risk controls?

Accepted Answer

A)   benchmarking
B)   due care and due diligence
C)   selective risk avoidance
D)   the gold standardE) A) and B)
F) C) and D)

Question 10

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

Accepted Answer

The answer of When a vulnerability (flaw or weakness)exists in...

Question 11

Describe the use of hybrid assessment to create a quantitative assessment of asset value.

Accepted Answer

The hybrid assessment,tries to improve u...

Question 12

The goal of InfoSec is not to bring residual risk to zero; rather,it is to bring residual risk in line with an organization's risk ___________.

Accepted Answer

The answer of The goal of InfoSec is not to...

Question 13

What are the four phases of the Microsoft risk management strategy?

Accepted Answer

1.Assessing risk
2.Conducting...

Question 14

The NIST risk management approach includes all but which of the following elements?

Accepted Answer

A)   inform
B)   assess
C)   frame
D)   respondE) A) and C)
F) A) and B)

Question 15

A risk control strategy that attempts to reduce the impactof the loss caused by a realized incident,disaster,or attack through effective contingencyplanning and preparation.

Accepted Answer

A)  defense risk control strategy
B)  mitigation risk control strategy
C)  acceptance risk control strategy
D)  termination risk control strategy
E)  risk appetiteF) cost-benefit analysisG) cost avoidanceH) asset valuationI) organizational feasibilityJ) single loss expectancyK) G) and I)
L) D) and E)

Question 16

The financial savings from using the defense risk control strategy to implementa control and eliminate the financial ramifications of an incident.

Accepted Answer

A)  defense risk control strategy
B)  mitigation risk control strategy
C)  acceptance risk control strategy
D)  termination risk control strategy
E)  risk appetiteF) cost-benefit analysisG) cost avoidanceH) asset valuationI) organizational feasibilityJ) single loss expectancyK) B) and I)
L) G) and J)

Question 17

Application of training and education is a common method of which risk control strategy?

Accepted Answer

A)   mitigation
B)   defense
C)   acceptance
D)   transferalE) None of the above
F) B) and D)

Question 18

The ____________________ risk control strategy attempts to shift the risk to other assets,processes,or organizations.

Accepted Answer

transferen...

Question 19

Which of the following is not a step in the FAIR risk management framework?

Accepted Answer

A)   identify scenario components
B)   evaluate loss event frequency
C)   assess control impact
D)   derive and articulate riskE) A) and C)
F) B) and C)

Question 20

Which of the following affects the cost of a control?

Accepted Answer

A)   liability insurance
B)   CBA report
C)   asset resale
D)   maintenanceE) A) and B)
F) C) and D)

Exam 7: Risk Management: Controlling Risk

What are the four phases of the Microsoft risk management strategy?

Correct Answer
verified
1.Assessing risk
2.Conducting...
View Answer

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.____________

Correct Answer
verified

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

Correct Answer
verified

What does the result of a CBA determine?What is the formula for the CBA?

Correct Answer
verified
The CBA determines whether the benefit f...
View Answer

The NIST risk management approach includes all but which of the following elements?

Correct Answer
verified

Which of the following is not a step in the FAIR risk management framework?

Correct Answer
verified

What is the OCTAVE method approach to risk management?

Correct Answer
verified
The Operationally Critical Threat,Asset,...
View Answer

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

Correct Answer
verified

The financial savings from using the defense risk control strategy to implementa control and eliminate the financial ramifications of an incident.

Correct Answer
verified

Which of the following is NOT an alternative to using CBA to justify risk controls?

Correct Answer
verified

The goal of InfoSec is not to bring residual risk to zero; rather,it is to bring residual risk in line with an organization's risk ___________.

Correct Answer
verified

A risk control strategy that attempts to reduce the impactof the loss caused by a realized incident,disaster,or attack through effective contingencyplanning and preparation.

Correct Answer
verified

The ____________________ risk control strategy attempts to shift the risk to other assets,processes,or organizations.

Correct Answer
verified
transferen...
View Answer

A risk control strategy that indicates the organization iswilling to accept the current level of risk and that the organization makes a conscious decisionto do nothing to protect an information asset from risk and to accept the outcome from anyresulting exploitation.

Correct Answer
verified

Application of training and education is a common method of which risk control strategy?

Correct Answer
verified

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

Correct Answer
verified

In which technique does a group rate or rank a set of information,compile the results and repeat until everyone is satisfied with the result?

Correct Answer
verified

Describe the use of hybrid assessment to create a quantitative assessment of asset value.

Correct Answer
verified
The hybrid assessment,tries to improve u...
View Answer

Correct Answer
verified

Which of the following affects the cost of a control?

Correct Answer
verified

Exam 7: Risk Management: Controlling Risk

What are the four phases of the Microsoft risk management strategy?

Correct Answerverified1.Assessing risk 2.Conducting...View AnswerShow Answer

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy,also known as the avoidance strategy.____________

Correct AnswerverifiedShow Answer

Strategies to limit losses before and during a realized adverse event is covered by which of the following plans in the mitigation control approach?

Correct AnswerverifiedShow Answer

What does the result of a CBA determine?What is the formula for the CBA?

Correct AnswerverifiedThe CBA determines whether the benefit f...View AnswerShow Answer

The NIST risk management approach includes all but which of the following elements?

Correct AnswerverifiedShow Answer

Which of the following is not a step in the FAIR risk management framework?

Correct AnswerverifiedShow Answer

What is the OCTAVE method approach to risk management?

Correct AnswerverifiedThe Operationally Critical Threat,Asset,...View AnswerShow Answer

Which of the following describes an organization's efforts to reduce damage caused by a realized incident or disaster?

Correct AnswerverifiedShow Answer

The financial savings from using the defense risk control strategy to implementa control and eliminate the financial ramifications of an incident.

Correct AnswerverifiedShow Answer

Which of the following is NOT an alternative to using CBA to justify risk controls?

Correct AnswerverifiedShow Answer

The goal of InfoSec is not to bring residual risk to zero; rather,it is to bring residual risk in line with an organization's risk ___________.

Correct AnswerverifiedShow Answer

A risk control strategy that attempts to reduce the impactof the loss caused by a realized incident,disaster,or attack through effective contingencyplanning and preparation.

Correct AnswerverifiedShow Answer

The ____________________ risk control strategy attempts to shift the risk to other assets,processes,or organizations.

Correct Answerverifiedtransferen...View AnswerShow Answer

A risk control strategy that indicates the organization iswilling to accept the current level of risk and that the organization makes a conscious decisionto do nothing to protect an information asset from risk and to accept the outcome from anyresulting exploitation.

Correct AnswerverifiedShow Answer

Application of training and education is a common method of which risk control strategy?

Correct AnswerverifiedShow Answer

When a vulnerability (flaw or weakness)exists in an important asset,implement security controls to reduce the likelihood of a vulnerability being ___________.

Correct AnswerverifiedShow Answer

In which technique does a group rate or rank a set of information,compile the results and repeat until everyone is satisfied with the result?

Correct AnswerverifiedShow Answer

Describe the use of hybrid assessment to create a quantitative assessment of asset value.

Correct AnswerverifiedThe hybrid assessment,tries to improve u...View AnswerShow Answer

Correct AnswerverifiedShow Answer

Which of the following affects the cost of a control?

Correct AnswerverifiedShow Answer

Correct Answer
verified
1.Assessing risk
2.Conducting...
View Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
The CBA determines whether the benefit f...
View Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
The Operationally Critical Threat,Asset,...
View Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
transferen...
View Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
The hybrid assessment,tries to improve u...
View Answer

Correct Answer
verified

Correct Answer
verified