BSIT 3-2: IAS - Final Quiz - 7-19-2023

The terms "threat" and "risk" can be used interchangeably; for exaple, a "threat assessment" is the same as a "risk assessment"

• True

• False

Because vulnerabilities are actually a charactristic of the organization or facility, they are:

• The risk factor over which the organization has the most control

• Impossible to accurately assess by an outside consultant

• The risk factor that is most expensive to correct

• The only risk factor that can be influenced by the organization

In order to effectively mitigate risks, a security professional should:

• Limit their strategy to using proven security measures only

• Assess all possible threats to the organization

• Apply a protection strategy that employs a suite of solutions

• Ensure that management is aware of existing vulnerabilities

Which step in the risk identification process involves the enumeration of assets, including people, procedures, data, software, hardware, and networking elements?

• Risk Assessment

• Identifying vulnerabilities

• Classifying and prioritizing information assets

• Asset Identification and Inventory

Which of the following is a key deliverable in the risk identification process?

• Developing risk control strategies

• Quantifying the risks facing each asset

• Presenting periodic reports to management

• Implementing security measures for all information assets

How does following project management principles benefit the risk identification process?

• It ensures that risk control strategies are effectively implemented

• It allows for efficient allocation of budget for risk management

• It eliminates the need for representatives from different departments in the team

• It helps establish a systematic and well-organized approach to risk identification

What is the primary goal of the risk identification process?

• To identify and document potential risks and vulnerabilities

• To prioritize information assets based on their value

• To quantify the potential impact of risks on the organization

• To classify organizational assets based on their level of sensitivity

What is the purpose of risk assessment in the context of information security?

• To establish the overall effectiveness of security technologies in the organization

• To assign a numerical value to the likelihood of successful attacks

• To determine the absolute risk level of an information asset

• To create a comprehensive list of potential controls for each vulnerability

According to the National Institute of Standards and Technology, how is the likelihood value typically assigned in risk assessment?

• Using a scale from 0.1 to 1.0

• Using a scale from 1 to 100

• Using a scale from 0 to 10

• Using a scale from low to high

What does residual risk refer to in the risk assessment process?

• The total risk of all identified vulnerabilities

• The initial risk level before applying any controls

• The risk that remains after implementing controls

• The risk associated with unknown threats