Risk Assessment and Asset Valuation Quiz

What is the purpose of an Incident Response Plan (IRP) according to the text?

To define actions to take after an incident has occurred
To define actions to take while an incident is in progress (correct)
To increase the potential gain for an attacker
To minimize the risk of a vulnerability being exploited

Which plan encompasses the continuation of business activities if a catastrophic event occurs?

Business Continuity Plan (BCP) (correct)
Acceptance Control Approach
Incident Response Plan (IRP)
Disaster Recovery Plan (DRP)

What is the primary goal when applying layered protections, architectural designs, and administrative controls?

To minimize the risk of vulnerability exploitation (correct)
To maximize the system user's access
To increase the attacker's potential gain
To accept the outcome of vulnerability exploitation

In which scenario would an organization apply protections to increase the attacker's cost?

When attacker's cost is less than potential gain (B) Signup and view all the answers

What is the essence of the Acceptance Control Approach mentioned in the text?

To evaluate and allow a risky state to continue as is (B) Signup and view all the answers

When should an organization apply layered protections and controls?

When a vulnerability can be exploited (A) Signup and view all the answers

What is the purpose of terminating a business activity according to the text?

To limit the extent of an attack (B) Signup and view all the answers

What is the Annualized Loss Expectancy (ALE) used for?

To calculate expected monetary loss due to risk over a year (C) Signup and view all the answers

What is the starting point to determine the single loss that would occur from a specific item according to the text?

Single Loss Expectancy (SLE) (B) Signup and view all the answers

What does Cost Benefit Analysis (CBA) evaluate before deciding on a strategy?

Assets to be protected and their value (C) Signup and view all the answers

What is the purpose of Feasibility Studies mentioned in the text?

To determine economic consequences of vulnerability (C) Signup and view all the answers

What is the number of times per year that an incident is likely to occur according to the text?

Annualized Rate of Occurrence (ARO) (B) Signup and view all the answers

What is the formula for Annualized Loss Expectancy (ALE) according to the text?

ALE = single loss expectancy (SLE) × annualized rate of occurrence (ARO) (D) Signup and view all the answers

What is the purpose of the Annualized Cost of the Safeguard (ACS) according to the text?

To evaluate the effectiveness of controls (B) Signup and view all the answers

In the context of risk controls, what is ACS an abbreviation for?

Annualized Cost of Security (D) Signup and view all the answers

What is the purpose of Benchmarking as described in the text?

To duplicate practices from other organizations (A) Signup and view all the answers

What is one of the measures typically used in Benchmarking to compare practices?

Metrics-based measures (A) Signup and view all the answers

What should be done after selecting and implementing a control strategy, according to the text?

Continue monitoring and reevaluating controls on an ongoing basis (B) Signup and view all the answers

What is the main purpose of the Cost Benefit Analysis (CBA) formula?

To determine if the alternative being evaluated is worth the cost incurred to control vulnerability. (D) Signup and view all the answers

What type of measures are generally less number-focused and more strategic than metrics-based measures?

Process-based measures (C) Signup and view all the answers

Which of the following is NOT a metrics-based measure for security efforts?

Best business practices (C) Signup and view all the answers

What aspect does the Technical dimension of risk management primarily focus on?

Technology implementation and support (A) Signup and view all the answers

When considering best practices for adoption in an organization, what factor should be assessed regarding resources?

Similarity to identified targets with best practices (D) Signup and view all the answers

What does the Political dimension of risk management define?

Consensus and relationships governing risk decisions (B) Signup and view all the answers

What defines the quantity and nature of risk that organizations are willing to accept?

Risk appetite (B) Signup and view all the answers

Which term refers to the risk that has not been completely removed, shifted, or planned for?

Residual risk (B) Signup and view all the answers

What is one of the key issues mentioned regarding the application of benchmarking and best practices?

No two organizations are similar (B) Signup and view all the answers

What is the process of formally examining and documenting risks in information systems called?

Risk identification (D) Signup and view all the answers

What is the main purpose of baselining in information security?

To compare security activities against past performance (A) Signup and view all the answers

What are the five strategies used to control risks that result from vulnerabilities?

Defend, Transfer, Mitigate, Accept, Terminate (A) Signup and view all the answers