Risk Assessment: Risk Analysis

Estimating risks is not considered as an exact science, True or False?

• False, it is considered a scientific conclusion.

• False, because organizations can conclude it depending on fixed variables.

• True, because it does not include a mathematical equation.

• True, because organizations have to rely on various information sources.

When should we use the aggregation method?

• When the risk management process overwhelms the SMB, as it will reduce the number of categories that are studied.

• When the risk management categories become very high-level, as they need to include more details

• When the manager of the risk management process concludes so.

• None of the above

Risk can be calculated as:

• Impact + Likelihood

• Severity x Impact

• Likelihood x Impact

• Uncertainty / Impact

Why is it beneficial for organizations to retain information form the “worst case/ most likely outcome” approach?

• It helps in evaluating the risk impact.

• It helps in evaluating the risk impact and can be used in while contingency planning.

• It helps in approximating the likelihood of risk occurrence.

• None of the above

Aggregation is the only tool to assist the risk management process. True or False.

• True, it is the only tool used.

• False, there are others which include using simpler methodologies that guide the organization through the entire process.

• True, it is the only tool that gives specific information.

• False, are others that include using methodologies that are more complex so they are avoided.

Identify: risk and threat

• They are the same.

• Risk is the probability of a threat to succeed in exploiting a system vulnerability, while threat is any type of danger that may cause harmful results such as data loss.

• Risk is any type of danger that may cause harmful results such as data loss, threat is the probability of a threat to succeed in exploiting a system vulnerability.

• None of the above.

Risk likelihood table includes fixed scale. True or False.

• True, it is a standardized procedure.

• False, it depends on the organization’s needs.

• True, so auditing and assessing procedure becomes easier.

• False, it depends on the organization’s country regulations.