The five Risk Management Process core components include the…
QuestionAnswered step-by-stepThe five Risk Management Process core components include the…The five Risk Management Process core components include the following except forGroup of answer choicesIdentification Evaluation Treatment Planning Treatment Monitoring Disposition Flag question: Question 2Question The three constraints in strategy development can be which of the following:Group of answer choicesa. Direct, objective, or organizational b. Direct, consequential, or peripheral c. Strategic, tactical, or operational d. None of the above Flag question: Question 3Question 32 pts In managing a cyber crisis, it requires expertise in which of the followingGroup of answer choicesa. Business Continuity b. Crisis Management c. Incident Response d. Cyber Security e. a and b f. a and c g. b and d h. None of the above Flag question: Question 4Question 42 pts What risks should one concentrate their efforts on first?Group of answer choicesCritical business applications All high risks Any risk that causes harm to an asset It depends on the threat or threat agent All of the above None of the above Flag question: Question 5Question 52 pts Risk can only exists if there isGroup of answer choicesAn asset, a threat to that asset, a weakness that may be exploited by that threat An asset, a threat to that asset, a vulnerability that may be exploited by that threat An asset, a threat, a vulnerability that may be exploited by that threat A threat to that asset, a vulnerability that may be exploited by that threat Flag question: Question 6Question 62 pts Event Damage Classifications as presented in class include the following except for:Group of answer choicesa. Negligible b. Minor c. Major d. Captain e. Crisis Flag question: Question 7Question 72 pts What do business continuity plans build within a business?Group of answer choicesa. A more resilient, agile business b. A less resilient business c. More focused and productive business d. A safe and enjoyable business e. A less competitive business f. All of the above g. None of the above Flag question: Question 8Question 82 pts The six forms of loss according to the Bald Tire Review Slides include the following except for:Group of answer choicesProductivity Stock Value Replacement Competitive Advantage Fines & Judgments Reputation Flag question: Question 9Question 92 pts Policies are important because:Group of answer choicesThey are primary tools for implementing a security strategy They provide the critical linkage to overall corporate governance and business objectives They are the primary instrument of operational governance by setting the boundaries within which people, processes, and technology must operate They set the security baselines across the organization by defining the minimum security limits Answers a and c Answers b and d Answers a and b Answers c and d None of the above Flag question: Question 10Question 102 pts Classification of Services as presented in class include the following except for:Group of answer choicesa. Critical b. Medium d. Sensitive e. Nonsensitive Flag question: Question 11Question 112 pts Major areas of security concerns for cloud as presented in class include the following except for:Group of answer choicesa. Multi-tenancy b. Service Level Agreement (SLA) c. Your Coverage d. Physical Location e. None of the above Flag question: Question 12Question 122 pts Standards are important because:Group of answer choicesThey set the security baselines across the organization by defining the minimum security limits They are the primary instrument of operational governance by setting the boundaries within which people, processes, and technology must operate They are the primary tool for setting the measures by which policy compliance is determined and enforced All of the above None of the above Flag question: Question 13Question 132 pts For this question, identify what level of risk exists in this picture : Tire swing hung over a Tree Branch. Group of answer choicesLow Medium High Very High Flag question: Question 14Question 142 pts For this question, identify what level of risk exists in this picture : Tire swing hung over a cliff 80 feet to bottom of cliff. Group of answer choicesLow Medium High Very High Flag question: Question 15Question 152 pts An information security strategy isGroup of answer choicesa. The objectives of information security coupled with the plans to achieve it b. The objectives of Information Technology coupled with the one year plan to achieve it c. The strategic objectives of the Business d. The objectives of information security and coupled with the procedures to achieve it Flag question: Question 16Question 162 pts If one has a vulnerability, a threat agent that can exploit the vulnerability, do you have risk?Group of answer choicesYes you have risk because threat agent can exploit the vulnerability. No you do not have risk because the threat agent cannot exploit the weakness. No you do not have risk because you are assuming you have an asset. Yes you have risk because the threat agent has the capability, means, motive and resources to exploit the vulnerability. None of the above. Flag question: Question 17Question 172 pts The uniformity of 1s and 0s in the logic layer of the Internet is what makes the magic of cyberspace information transmission possible, but all the 1s and 0s look the same describes which of the five gateways of Internet vulnerabilities discussed in Class.Group of answer choicesInstantaneous Action at a Distance The Asymmetries of Cyberspace Anonymity in Cyberspace Lack of Defensible States The Difficulty of Distinction Flag question: Question 18Question 182 pts The two general classes of constraints are:Group of answer choicesa. Contextual and Operational b. Strategic and Tactical c. Strategic and Operational d. Physical and Contextual e. None of the above Flag question: Question 19Question 192 pts The two greatest issues or difficulties in developing strategy are:Group of answer choicesa. Contextual and Operational b. Strategic and Tactical c. Cultural and Structural d. Physical and Contextual e. None of the above Flag question: Question 20Question 202 pts The five gateways of Internet vulnerabilities as presented in class include all the following except for:Group of answer choicesInstantaneous Action at a Distance The Asymmetries of Cyberspace Anonymity in Cyberspace The Difficulty of Distinction Lack of Defensible States Flag question: Question 21Question 212 pts The amount of data transactions that are allowed to be lost following a computer failure (i.e., duration of orphan data) is theGroup of answer choicesa. Recovery Time Objective b. Recovery Point Objective c. Service Delivery Objective d. Maximum Tolerable Outage Flag question: Question 22Question 222 pts Information Security must be aligned withGroup of answer choicesa. The Chief Risk Officer b. The Chief Financial Officer c. The Business d. The Chief Compliance Officer e. The Chief Information Officer Flag question: Question 23Question 232 pts The steps for making Ethical Decision Making include all the following except for:Group of answer choicesa. Evaluate the alternative actions from various moral perspectives b. Recognize a moral issue c. Get the facts d. Reflect on the results of the decision afterwards e. None of the above Flag question: Question 24Question 242 pts In Project Management, Triple Constraints could include which of the following:Group of answer choicesa. Increased Scope may cause increased time or increased cost b. Tight Time may cause decreased costs or reduced scope Tight Budget may cause increased time or reduced scope d. Tight Time may cause increased costs or increased scope e. Answers a, b and c f. Answers a and c g. Answers b and c h. Answers c and d Flag question: Question 25Question 252 pts According Shawn Tuma’s, “What is Reasonable Security” video, who defines what is reasonable for an organization?Group of answer choicesa. Chief Information Security Officer b. Chief Information Officer c. Chief Complaince Officer d. The Organization f. No one is responsible Flag question: Question 26Question 262 pts Disaster Recovery Plan determines the most crucial IT operations from the business perspective.Group of answer choicesTrue False Flag question: Question 27Question 272 pts Two forms of loss materializes from an event are primary and ancillary loss.Group of answer choicesTrue False Flag question: Question 28Question 282 pts Two factors used in whether to report metrics are if you have no influence over the metric, or there is an action that you are going to recommend as a result of this metric, then consider not reporting them.Group of answer choicesTrue False Flag question: Question 29Question 292 pts A good metric will be more than just a number; it will be an indicator that more resources are needed for the CISO to secure their infrastructure.Group of answer choicesTrue False Flag question: Question 30Question 302 pts Vulnerabilities are a subset of weaknesses.Group of answer choicesTrue False Flag question: Question 31Question 312 pts Response is included in both Primary and Secondary costsGroup of answer choicesTrue False Flag question: Question 32Question 322 pts One of the first steps in performing a Business Impact Analysis is to ask which business processes are of strategic importance.Group of answer choicesTrue False Flag question: Question 33Question 332 pts Risks remain static.Group of answer choicesTrue False Flag question: Question 34Question 342 pts The first and most important Business Continuity Planning (BCP) test is the Desk-based paper test.Group of answer choicesTrue False Flag question: Question 35Question 352 pts The Optimal Point is where cost of remediation equals cost of compromise.Group of answer choicesTrue False Flag question: Question 36Question 362 pts The bottom line in regards to risk monitoring is decreasing situational awareness to help determine risk to organizational operations and assets, individuals, other organizations, and the Nation.Group of answer choicesTrue False Flag question: Question 37Question 372 pts The Minimum Cost associated with Disruption versus Recovery Costs is where the Curve for Alternative Recovery Strategies and Service Downtime intersect.Group of answer choicesTrue False Flag question: Question 38Question 382 pts In case of a Business Continuity Plan/Disaster Recovery Planning, People’s lives always take first priority.Group of answer choicesTrue False Flag question: Question 39Question 392 pts RACI is not a tool used in establishing Disaster Recovery Responsibilities.Group of answer choicesTrue False Flag question: Question 40Question 402 pts Data which is lost and never recovered is known as Orphan Data.Group of answer choicesTrue False Flag question: Question 41Question 412 pts CEO Fraud is defined as:A sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. The scam is carried out by compromising legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of fundsGroup of answer choicesTrue False Flag question: Question 42Question 422 pts According to the class presentation on the five gateways of Internet vulnerabilities, the asymmetries of cyberspace is a radical development.Group of answer choicesTrue False Flag question: Question 43Question 432 pts Operational planning is anything greater than 10 months or more.Group of answer choicesTrue False Flag question: Question 44Question 442 pts Security Steering Committee can be instrumental in gaining consensus to aid security program activities as well as serving as a forum for dispute resolution.Group of answer choicesTrue False Flag question: Question 45Question 452 pts The major deference as presented in class as to what is considered data and what is considered information is physical in nature.Group of answer choicesTrue False Flag question: Question 46Question 462 pts Implementing the “Principle of Least Privilege” is not a way of increasing an organization’s confidence in defending against Ransomware.Group of answer choicesTrue False Flag question: Question 47Question 472 pts “What information on security do they want in order to better make decisions for the organization?” is the most important question for Business Leaders and Executives in regards to security metrics.Group of answer choicesTrue False Flag question: Question 48Question 482 pts GAP Analysis is not used when comparing current to desired level.Group of answer choicesTrue False Flag question: Question 49Question 492 pts Information security cannot be a part of an organization’s IT Security organization.Group of answer choicesTrue False Flag question: Question 50Question 502 pts In RACI (Responsibility, Accountability, Informed, and Consulted, your can have more than one “A” assigned to a task, especially for those high priority task assigned by the Board of Directors.Group of answer choicesTrue False Computer ScienceEngineering & TechnologyInformation SecurityITSY 2401Share Question
