Quiz 2 - PROFE5 313 - BSIS 3A

What is the first step in the Risk Management Process?

• Risk Assessment
• Risk Evaluation
• Risk Identification
• Risk Treatment
• Monitoring and Review

Answer explanation

Risk Identification is the process of recognizing potential threats to information security.

Which of the following is NOT considered an information asset?

• Data
• Hardware
• Employees
• Risk
• Processes

Answer explanation

Risk is a concept in security management but not an asset that requires protection.

What is the purpose of Risk Evaluation?

• To classify risks
• To identify risks
• To treat risks
• To accept risks
• To remove all risks

Answer explanation

Risk evaluation helps determine which risks need immediate action based on their level.

Which is a common security risk?

• Malware
• Encryption
• Data Backup
• Multi-Factor Authentication
• Firewall

Answer explanation

Malware is a type of cyberattack that can compromise security.

Which risk treatment strategy involves accepting the risk as it is?

• Risk Avoidance
• Risk Reduction
• Risk Transfer
• Risk Acceptance
• Risk Monitoring

Answer explanation

Risk Acceptance means choosing to accept a risk if it falls within acceptable levels.

What is an example of a physical security threat?

• Phishing
• Data Encryption
• Firewall Misconfiguration
• Theft
• Weak Passwords

Answer explanation

Theft is a physical threat that could lead to unauthorized access to information.

What does risk reduction aim to achieve?

• Eliminate risk completely
• Minimize the impact of risk
• Transfer risk to another party
• Ignore risk
• Evaluate risk

Answer explanation

Risk reduction involves implementing security controls to minimize risk.

Which of the following is a type of cyberattack?

• Firewall
• Backup
• Encryption
• Phishing
• Multi-Factor Authentication

Answer explanation

Phishing is a social engineering attack that tricks users into revealing sensitive information.

What is the role of monitoring and review in risk management?

• To eliminate all risks
• To continuously evaluate security risks
• To accept risks
• To stop all cyberattacks
• To remove security controls

Answer explanation

Monitoring and review ensure that risk management strategies remain effective.

What is the main focus of Information Security Risk Management?

• Protecting organizational assets
• Eliminating all risks
• Ignoring potential threats
• Removing all information
• Avoiding cybersecurity measures

Answer explanation

The main goal of Information Security Risk Management is to protect an organization’s data and systems.