CISM Practice B Topic 2 Flashcards
A risk mitigation report would include recommendations for:
assessment.
acceptance.
evaluation.
quantification.
acceptance
A risk management program should reduce risk to:
zero.
an acceptable level.
an acceptable percent of revenue.
an acceptable probability of occurrence.
an acceptable level.
\The MOST important reason for conducting periodic risk assessments is because:
- risk assessments are not always precise.
- security risks are subject to frequent change.
- reviewers can optimize and reduce the cost of controls.
- it demonstrates to senior management that the security function can add value.
security risks are subject to frequent change.
Which of the following BEST indicates a successful risk management practice?
Overall risk is quantified
Inherent risk is eliminated
Residual risk is minimized
Control risk is tied to business units
Residual risk is minimized
Which of the following would generally have the GREATEST negative impact on an organization?
Theft of computer software
Interruption of utility services
Loss of customer confidence
Internal fraud resulting in monetary loss
Loss of customer confidence
A successful information security management program should use which of the following to determine the amount of resources devoted to mitigating exposures?
Risk analysis results
Audit report findings
Penetration test results
Amount of IT budget available
Risk analysis results
Which of the following will BEST protect an organization from internal security attacks?
Static IP addressing
Internal address translation
Prospective employee background checks
Employee awareness certification program
Prospective employee background checks
For risk management purposes, the value of an asset should be based on:
original cost.
net cash flow.
net present value.
replacement cost.
replacement cost.
In a business impact analysis, the value of an information system should be based on the overall cost:
of recovery.
to recreate.
if unavailable.
of emergency operations.
if unavailable.
Acceptable risk is achieved when:
residual risk is minimized.
transferred risk is minimized.
control risk is minimized.
inherent risk is minimized.
residual risk is minimized.
The value of information assets is BEST determined by:
individual business managers.
business systems analysts.
information security management.
industry averages benchmarking.
individual business managers.
During which phase of development is it MOST appropriate to begin assessing the risk of a new application system?
Feasibility
Design
Development
Testing
Feasibility
The MOST effective way to incorporate risk management practices into existing production systems is through:
policy development.
change management.
awareness training.
regular monitoring.
change management.
Which of the following would be MOST useful in developing a series of recovery time objectives (RTOs)?
Gap analysis
Regression analysis
Risk analysis
Business impact analysis
Business impact analysis
The recovery time objective (RTO) is reached at which of the following milestones?
Disaster declaration
Recovery of the backups
Restoration of the system
Return to business as usual processing
Restoration of the system
Which of the following results from the risk assessment process would BEST assist risk management decision making?
Control risk
Inherent risk
Risk exposure
Residual risk
Residual risk
The decision on whether new risks should fall under periodic or event-driven reporting should be based on which of the following?
Mitigating controls
Visibility of impact
Likelihood of occurrence
Incident frequency
Visibility of impact
Risk acceptance is a component of which of the following?
Assessment
Mitigation
Evaluation
Monitoring
Mitigation
Risk management programs are designed to reduce risk to:
a level that is too small to be measurable.
the point at which the benefit exceeds the expense.
a level that the organization is willing to accept.
a rate of return that equals the current cost of capital.
a level that the organization is willing to accept.
A risk assessment should be conducted:
once a year for each business process and subprocess.
every three to six months for critical business processes.
by external parties to maintain objectivity.
annually or whenever there is a significant change.
annually or whenever there is a significant change.
The MOST important function of a risk management program is to:
quantify overall risk.
minimize residual risk.
eliminate inherent risk.
maximize the sum of all annualized loss expectancies (ALEs).
minimize residual risk.
Which of the following risks would BEST be assessed using qualitative risk assessment techniques?
Theft of purchased software
Power outage lasting 24 hours
Permanent decline in customer confidence
Temporary loss of e-mail due to a virus attack
Permanent decline in customer confidence
Which of the following will BEST prevent external security attacks?
Static IP addressing
Network address translation
Background checks for temporary employees
Securing and analyzing system access logs
Network address translation
In performing a risk assessment on the impact of losing a server, the value of the server should be calculated using the:
original cost to acquire.
cost of the software stored.
annualized loss expectancy (ALE).
cost to obtain a replacement.
cost to obtain a replacement.
A business impact analysis (BIA) is the BEST tool for calculating:
total cost of ownership.
priority of restoration.
annualized loss expectancy (ALE).
residual risk.
priority of restoration.
When residual risk is minimized:
acceptable risk is probable.
transferred risk is acceptable.
control risk is reduced.
risk is transferable.
acceptable risk is probable.
Quantitative risk analysis is MOST appropriate when assessment data:
include customer perceptions.
contain percentage estimates.
do not contain specific details.
contain subjective information.
contain percentage estimates.
Which of the following is the MOST appropriate use of gap analysis?
Evaluating a business impact analysis (BIA)
Developing a balanced business scorecard
Demonstrating the relationship between controls
Measuring current state vs. desired future state
Measuring current state vs. desired future state
Identification and prioritization of business risk enables project managers to:
establish implementation milestones.
reduce the overall amount of slack time.
address areas with most significance.
accelerate completion of critical paths.
address areas with most significance.
A risk analysis should:
- include a benchmark of similar companies in its scope.
- assume an equal degree of protection for all assets.
- address the potential size and likelihood of loss.
- give more weight to the likelihood vs. the size of the loss.
address the potential size and likelihood of loss.
The recovery point objective (RPO) requires which of the following?
Disaster declaration
Before-image restoration
System restoration
After-image processing
Before-image restoration
Based on the information provided, which of the following situations presents the GREATEST information security risk for an organization with multiple, but small, domestic processing locations?
Systems operation procedures are not enforced
Change management procedures are poor
Systems development is outsourced
Systems capacity management is not performed
Change management procedures are poor
Which of the following BEST describes the scope of risk analysis?
Key financial systems
Organizational activities
Key systems and infrastructure
Systems subject to regulatory compliance
Organizational activities
The decision as to whether a risk has been reduced to an acceptable level should be determined by:
organizational requirements.
information systems requirements.
information security requirements.
international standards.
organizational requirements.
Which of the following is the PRIMARY reason for implementing a risk management program?
Allows the organization to eliminate risk
Is a necessary part of management’s due diligence
Satisfies audit and regulatory requirements
Assists in incrementing the return on investment (ROI)
Is a necessary part of management’s due diligence
Which of the following groups would be in the BEST position to perform a risk analysis for a business?
External auditors
A peer group within a similar business
Process owners
A specialized management consultant
Process owners
A successful risk management program should lead to:
optimization of risk reduction efforts against cost.
containment of losses to an annual budgeted amount.
identification and removal of all man-made threats.
elimination or transference of all organizational risks.
optimization of risk reduction efforts against cost.
Which of the following risks would BEST be assessed using quantitative risk assessment techniques?
Customer data stolen
An electrical power outage
A web site defaced by hackers
Loss of the software development team
An electrical power outage
The impact of losing frame relay network connectivity for 18-24 hours should be calculated using the:
hourly billing rate charged by the carrier.
value of the data transmitted over the network.
aggregate compensation of all affected business users.
financial losses incurred by affected business units.
financial losses incurred by affected business units.
Which of the following is the MOST usable deliverable of an information security risk analysis?
Business impact analysis (BIA) report
List of action items to mitigate risk
Assignment of risks to process owners
Quantification of organizational risk
List of action items to mitigate risk
Ongoing tracking of remediation efforts to mitigate identified risks can BEST be accomplished through the use of which of the following?
Tree diagrams
Venn diagrams
Heat charts
Bar charts
Heat charts
Who would be in the BEST position to determine the recovery point objective (RPO) for business applications?
Business continuity coordinator
Chief operations officer (COO)
Information security manager
Internal audit
Chief operations officer (COO)
Which two components PRIMARILY must be assessed in an effective risk analysis?
Visibility and duration
Likelihood and impact
Probability and frequency
Financial impact and duration
Likelihood and impact
Information security managers should use risk assessment techniques to:
justify selection of risk mitigation strategies.
maximize the return on investment (ROI).
provide documentation for auditors and regulators.
quantify risks that would otherwise be subjective.
justify selection of risk mitigation strategies.
In assessing risk, it is MOST essential to:
provide equal coverage for all asset types.
use benchmarking data from similar organizations.
consider both monetary value and likelihood of loss.
focus primarily on threats and recent business losses.
consider both monetary value and likelihood of loss.
When the computer incident response team (CIRT) finds clear evidence that a hacker has penetrated the corporate network and modified customer information, an information security manager should FIRST notify:
the information security steering committee.
customers who may be impacted.
data owners who may be impacted.
regulatory agencies overseeing privacy.
data owners who may be impacted.
Data owners are PRIMARILY responsible for establishing risk mitigation methods to address which of the following areas?
Platform security
Entitlement changes
Intrusion detection
Antivirus controls
Entitlement changes
The PRIMARY goal of a corporate risk management program is to ensure that an organization’s:
IT assets in key business functions are protected.
business risks are addressed by preventive controls.
stated objectives are achievable.
IT facilities and systems are always available.
stated objectives are achievable.
It is important to classify and determine relative sensitivity of assets to ensure that:
cost of protection is in proportion to sensitivity.
highly sensitive assets are protected.
cost of controls is minimized.
countermeasures are proportional to risk.
countermeasures are proportional to risk.
The service level agreement (SLA) for an outsourced IT function does not reflect an adequate level of protection. In this situation an information security manager should:
ensure the provider is made liable for losses.
recommend not renewing the contract upon expiration.
recommend the immediate termination of the contract.
determine the current level of security.
determine the current level of security.
An information security manager has been assigned to implement more restrictive preventive controls. By doing so, the net effect will be to PRIMARILY reduce the:
threat.
loss.
vulnerability.
probability.
vulnerability.
When performing a quantitative risk analysis, which of the following is MOST important to estimate the potential loss?
Evaluate productivity losses
Assess the impact of confidential data disclosure
Calculate the value of the information or asset
Measure the probability of occurrence of each threat
Calculate the value of the information or asset
Before conducting a formal risk assessment of an organization’s information resources, an information security manager should FIRST:
map the major threats to business objectives.
review available sources of risk information.
identify the value of the critical assets.
determine the financial impact if threats materialize
map the major threats to business objectives.
The valuation of IT assets should be performed by:
an IT security manager.
an independent security consultant.
the chief financial officer (CFO).
the information owner
the information owner
