CISSP Crash Course - Risk Management

The video tutorial covers risk management, explaining how organizations identify and mitigate risks to assets. It discusses key terms, phases, and techniques in risk management, including qualitative and quantitative assessments. Various risk response strategies are explored, such as mitigation and transfer. The tutorial also delves into risk calculation, security controls, and different risk management frameworks, providing a comprehensive overview of the topic.

What are the three main components of risk management?

• Analysis, Mitigation, Reporting

• Planning, Execution, Monitoring

• Assessment, Response, Awareness

• Identification, Evaluation, Control

Why is it important to have a team perform risk assessment?

• To reduce the time taken for assessment

• To ensure a diverse set of feedback

• To comply with legal requirements

• To minimize costs

Which method involves using both numbers and gut feeling to assess risk?

• Quantitative

• Qualitative

• Delphi Technique

• Mixed Method

What is the term for the risk that remains after controls are applied?

• Total Risk

• Accepted Risk

• Residual Risk

• Transferred Risk

Which risk response involves transferring risk to a third party?

• Mitigation

• Acceptance

• Avoidance

• Transfer

What does ALE stand for in risk management?

• Asset Liability Expectation

• Annualized Liability Estimate

• Asset Loss Evaluation

• Annualized Loss Expectancy

What is the purpose of a cost versus benefit analysis in risk management?

• To determine the cheapest safeguard

• To compare the cost of safeguards with the potential loss

• To prioritize risks based on severity

• To evaluate the effectiveness of controls

Which type of control is designed to stop attacks before they occur?

• Compensating

• Detective

• Preventive

• Corrective

What is a risk register used for?

• To store financial data

• To list all company assets

• To document all identified risks

• To track employee performance

Which risk framework involves preparing, categorizing, selecting, and implementing controls?

• Risk Management Framework

• Cybersecurity Framework

• OCTAVE

• FAIR