Information Security Risk Management Flashcards

Question

The PRIMARY objective of a vulnerability assessment is to: A.reduce risk to the business. B.ensure compliance with security policies. C.provide assurance to management. D.measure efficiency of services provided.

Answer 1

C is the correct answer. Justification It is necessary to identify vulnerabilities in order to mitigate them. Actual reduction of risk is accomplished through deployment of controls and is a business decision based on a cost-benefit analysis. A security policy may mandate a vulnerability assessment program, but such a program is not established primarily to comply with policy. A vulnerability assessment identifies vulnerabilities so that they may be considered for mitigation. By giving management a complete picture of the vulnerabilities that exist, a vulnerability assessment program allows management to prioritize those vulnerabilities deemed to pose the greatest risk. Vulnerability assessment is not concerned with efficiency of services.

Answer 2

A is the correct answer. Justification A locally managed file server is the least likely to conform to organizational security policies because it is generally subject to less oversight and monitoring. Data warehouses are subject to scrutiny, good change control practices and monitoring. Web server clusters are located in data centers or warehouses and are subject to good management. Centrally managed switches are part of a data center or warehouse.

Answer 3

D is the correct answer. Justification Legal and regulatory considerations are evaluated in the same manner as other forms of risk. Externally facing systems or applications are not necessarily high-impact systems. The prioritization of a vulnerability assessment needs to be made on the basis of impact. Although the impact associated with the loss of any resource subject to a performance contract is clearly quantifiable, it may not necessarily be a critical resource. If the loss of a contract system poses a significant impact to the enterprise, additional measures such as business interruption insurance will be in place. Maintaining business operations is always the priority. If a system is covered by business interruption insurance, it is a clear indication that management deems it to be a critical system.

Answer 4

C is the correct answer. Justification Password cracking by exploiting a password change option may not be easy unless the perpetrator obtains a valid password in advance. Hence, attackers prefer to look for weaknesses in validation checks in the application control layer. Weak or nonexistent transaction monitoring controls can be a target for exploitation; however, controls with nonexistent or inadequate validation checks are an easier target for attackers. Many attackers exploit weaknesses existing in the application layer. A weak validation check-in entry screen may be vulnerable to structured query language (SQL) injection attacks. Hence, validation control is a key feature in application controls. Control of open ports may be handled by network administration, which is separate from the application control layer. Hence, it is unlikely that attackers exploiting application weaknesses will look for open ports.

Answer 5

A is the correct answer. Justification Exploitation of a vulnerability is likely to generate an increase in the number of security events. Absent a change in vulnerability, an increase in the number of threat actors targeting the enterprise would not explain an increase in security events. An increase in the number of security events that appear on reports suggests that detective controls are likely working properly, since failure of the control would result in an absence of events in the report. Exceptions approved by management may result in a higher number of security events on reports if notice of the exceptions is not provided to information security to allow updates to monitoring. However, exceptions are typically communicated to the information security manager, so this is an unlikely explanation for the increase.

Answer 6

B is the correct answer. Justification Security assessments, such as vulnerability scans, can help give an extensive and thorough risk and vulnerability overview but will not be able to test or demonstrate the final consequence of having several vulnerabilities linked together. A penetration test is normally the only security assessment that can link vulnerabilities together by exploiting them sequentially. This gives a good measurement and prioritization of risk. Penetration testing can give risk a new perspective and prioritization based on the result of a sequence of security problems. Code reviews are very time-consuming and unlikely to occur on different parts of a system at the same time, making the discovery of linked system vulnerabilities unlikely. Audits are unlikely to assess aggregate risk from linked system vulnerabilities.

Answer 7

C is the correct answer. Justification Ensuring that all operating system patches are up to date is a good practice, in general, but it will not necessarily address the reported vulnerability in the firewall software. Blocking inbound traffic may not be practical or effective from a business perspective. The best source of information is the firewall manufacturer because the manufacturer may have a patch to fix the vulnerability or a workaround solution. Commissioning a penetration test will take too much time and will not necessarily provide a solution for corrective actions.

Answer 8

C is the correct answer. Justification Due to the nature of statistical anomaly-based intrusion detection system (stat IDS) operations (i.e., they must constantly attempt to match patterns of activity to the baseline parameters), a stat IDS requires much more overhead and processing than signature-based versions. However, this is not the most important reason. Due to the nature of a stat IDS—based on statistics and comparing data with baseline parameters— this type of IDS may not detect minor changes to system variables and may generate many false positives. However, this is not the most important reason. A stat IDS collects data from normal traffic and establishes a baseline. It then periodically samples the network activity based on statistical methods and compares samples to the baseline. When the activity is outside the baseline parameter (clipping level), the IDS notifies the administrator. The baseline variables can include a host’s memory or central processing unit usage, network packet types and packet quantities. If actions of the users or the systems on the network vary widely with periods of low activity and periods of frantic packet exchange, a stat IDS may not be suitable, as the dramatic swing from one level to another almost certainly will generate false alarms. This weakness will have the largest impact on the operation of the IT systems. Because the stat IDS can monitor multiple system variables, it can detect new types of variables by tracing for abnormal activity of any kind.

Answer 9

D is the correct answer. Justification While penetration testing aims to uncover vulnerabilities, it is not realistic to expect the identification of all vulnerabilities due to the evolving nature of cyberthreats. Penetration testing is not intended for assigning blame or responsibility for weaknesses, but rather for improving security measures. Absolute protection against all cyberthreats is an unattainable goal, and penetration testing focuses on assessing and improving defenses rather than providing guarantees. The primary objective of penetration testing is to assess the effectiveness of security controls and measures in place by simulating real-world attack scenarios.

Answer 10

A is the correct answer. Justification The authentication process is broken because, although the session is valid, the application should reauthenticate when the input parameters are changed. The review provided valid employee IDs, and valid input was processed. The problem here is the lack of reauthentication when the input parameters are changed. Cross-site scripting is not the problem in this case because the attack is not transferred to any other user’s browser to obtain the output. Structured query language (SQL) injection is not a problem because input is provided as a valid employee ID and no SQL queries are injected to provide the output.

Answer 11

D is the correct answer. Justification Firewalls can be perfectly configured, but if the keys make it to the other side, they will not prevent the document from being decrypted. Even easy encryption algorithms require adequate resources to break, whereas encryption keys can be easily used. The application front door controls may be bypassed by accessing data directly. Key management is the weakest link in encryption. If keys are in the wrong hands, documents can be read regardless of where they are on the network.

Answer 12

C is the correct answer. Justification Sever patching is not affected by the presence of middleware. System backups are not affected. The major risk associated with middleware in a client-server environment is that data integrity may be adversely affected if middleware should fail or become corrupted. Hijacked end-user sessions can occur but they can be detected by implementing security checks in the middleware.

Answer 13

B is the correct answer. Justification System monitoring for traffic on network ports would not be able to detect all instances of back doors and is time-consuming and would take much effort. Security code reviews for the entire application is the best measure and will involve reviewing the entire source code to detect all instances of back doors. Reverse engineering the application binaries may not provide any definite clues. Back doors will not surface by running the application on high-privileged accounts because back doors are usually hidden accounts in the applications.

Answer 14

B is the correct answer. Justification System administrators may be involved, but they will act at the guidance of the system owner. The first person to be notified when an exploit is found should be the system owner, who will determine the best mitigation strategy. Data owners can be notified later in the process if the vulnerability may compromise data. The incident response manager should be notified if an incident related to the vulnerability is confirmed.

Answer 15

B is the correct answer. Justification A demonstration of the test system will reduce the spontaneity of the test. The most important action is to clearly define the goals and objectives of the test. Technical staff should not be briefed as that would reduce the spontaneity of the test. Assuming that adequate backup procedures are in place, special backups should not be necessary.

Answer 16

D is the correct answer. Justification Zero-day vulnerabilities by definition are not previously known and, therefore, are undetectable. Malicious software and spyware are normally addressed through antivirus and antispyware policies. Security design flaws require a deeper level of analysis. A network vulnerability assessment intends to identify known vulnerabilities based on common misconfigurations and missing updates.

Answer 17

B is the correct answer. Justification A business impact analysis does not identify vulnerabilities. Security gap analysis is a process that measures all security controls in place against control objectives, which will identify gaps. System performance metrics may indicate security weaknesses, but that is not their primary purpose. Incident response processes exist for cases in which security weaknesses are exploited.

Answer 18

B is the correct answer. Justification Cross-site request forgery (XSRF) is related to an authentication mechanism, not to redirection. XSRF exploits inadequate authentication mechanisms in web applications that rely only on elements such as cookies when performing a transaction. It is a type of website attack in which unauthorized commands are transmitted from a trusted user. A non-legitimate license key is related to intellectual property rights, not to XSRF vulnerability. Merely hosting multiple applications on the same server is not the root cause of this vulnerability.

Answer 19

A is the correct answer. Justification External vulnerability sources are the most cost-effective method of identifying these vulnerabilities. The cost involved in periodic vulnerability assessments would be much higher. Intrusion prevention software would not identify new vendor vulnerabilities. Honeypots may or may not identify vulnerabilities and may create their own security risk.

Answer 20

C is the correct answer. Justification Workflow diagrams document processes. Having a visual representation of how a risk management process works today versus how it would work in a desired state may be useful as part of proposing or implementing changes, but comparing the two states is not the same as knowing what tasks must be completed to move from the current state to the proposed future state, which is what is needed to determine the level of effort. Gantt charts are used to schedule activities (tasks) needed to complete a project. A fully constructed schedule includes all tasks that must be completed and times they will take, but building a schedule deals with prioritization and issues that go beyond what is needed to determine the level of effort. A gap analysis documents the tasks that must be completed to move from the current state to the desired state, and the level of effort may readily be determined. A gap analysis is required for various components of the strategy previously discussed, such as maturity levels, each control objective, and each risk and impact objective. Return on investment, computed in its simplest form by dividing net income by the total investment over the period being considered, is a measure of operating performance and efficiency. It does not measure levels of effort.

Answer 21

B is the correct answer. Justification Estimated productivity losses are better suited to quantitative analysis but without threats being considered would not produce useful results. Listing all reasonable scenarios that could occur, along with threats and impacts, would best frame the range of risk and facilitate a more informed discussion and decision. Value of information assets would be part of a quantitative analysis requiring threat to be considered as well. Vulnerability assessments would be better analyzed as a part of a quantitative analysis when threat is considered.

Answer 22

B is the correct answer. Justification Achieving balance between risk and organizational goals is not always practical. The best strategy for risk management is to reduce risk to an acceptable level, taking into account the enterprise’s appetite for risk and the fact that it is not possible to eliminate all risk. Policy development must consider organizational risk and business objectives but is not a strategy. It may be prudent to ensure that management understands and accepts risk that it is not willing to mitigate, but that is a practice and is not sufficient to be considered a strategy.

Answer 23

C is the correct answer. Justification The risk that the new technology will not support business needs is primarily a responsibility of the business manager rather than the information security manager. The availability of support is a concern, but it is primarily a responsibility of the IT operations manager. The greatest security risk is that the new technology may bypass existing security or impair the operation of existing systems. The security manager should examine the new system for these issues. The downtime required to implement the new technology is primarily a business and IT department factor.

Answer 24

A is the correct answer. Justification Risk analysis results are the most useful and complete source of information for determining the amount of resources to devote to mitigating exposures. Audit report findings may not address all risk and do not address annual loss frequency. Penetration test results provide only a limited view of exposures. The IT budget is not tied to the exposures faced by the enterprise.

Answer 25

A is the correct answer. Justification Risk should be addressed as early in the development of a new application system as possible. The projected risk associated with a new system may make it unfeasible. In some cases, identified risk could be mitigated through design changes. If needed changes are not identified until design has already commenced, such changes become more expensive. For this reason, beginning risk assessment during the design phase is not the best solution. The development phase is too late in the system development life cycle (SDLC) for effective risk mitigation. Waiting to assess risk until testing can result in having to start over on the project.

Answer 26

A is the correct answer. Justification It is likely to be more effective to control the enterprise’s vulnerabilities to third-party risk by limiting organizational exposure than to control the third party’s actions. It is essential to know the risk but it does not manage the risk. Defining contractual responsibilities of third parties is important but it will not directly manage risk. Audits may indicate the threats posed by third parties but will not ensure that the risk is managed.

Answer 27

D is the correct answer. Justification User assessments are most likely focused on their convenience and ease of use rather than effectiveness of the program. Comparing results with industry standards is a meaningless gauge; however, comparing results to program objectives would be very useful. Assigning ownership of risk is a good first step in improving accountability and, therefore, probably effectiveness. Effective risk management requires participation, support and acceptance by all applicable members of the enterprise, beginning with the executive levels. Personnel must understand their responsibilities and be trained on how to fulfill their roles.

Answer 28

D is the correct answer. Justification While it is generally preferable to be as compliant as reasonably possible, the extent and level of regulatory compliance is a management decision, not a mandate. All risk should be prioritized, and regulation may not be the highest priority. Regulatory compliance is not just an operational issue; it is primarily a management issue. Many regulations exist that must be considered. Priority should be given to those with the greatest impact, just as other risk is considered with priority given to feasibility, level of enforcement, possible sanctions and costs of compliance.

Answer 29

C is the correct answer. Justification Determining how much productivity could be lost and how much it would cost is a step in the potential risk estimation process. Knowing the impact if confidential information is disclosed is also a step in the estimation of potential risk. Calculating the value of the information or asset is the first step in a risk analysis process to determine the impact to the enterprise, which is the ultimate goal. Measuring the probability of occurrence for each threat identified is a step in performing a threat analysis and, therefore, a partial answer.

Answer 30

D is the correct answer. Justification Exposure can be determined within a range. Impact can be determined within a range. Vulnerability can be determined within a range. The likelihood of a threat encountering a susceptible vulnerability can only be estimated statistically.

Answer 31

C is the correct answer. Justification Providing equal coverage for all asset types when assessing risk may not be relevant, depending on the significance the asset type has to the enterprise (e.g., the automobile fleet is not likely to have as much significance as the data center). Benchmarking other enterprises when assessing risk is of relatively little value. The likelihood of loss and the monetary value of those losses are the most essential elements to consider in assessing risk. Past threats and losses may be instructive of potential future events but are not the most essential considerations when assessing risk.

Answer 32

B is the correct answer. Justification Controls are evaluated after assets are identified as part of the risk assessment process. Asset identification must be completed prior to risk assessment because it is the basis of the risk assessment. Threats are identified after assets are identified as part of the risk assessment process. The risk register is a catalog of risk categories or an inventory of risks identified and is not part of the risk assessment process.

Answer 33

C is the correct answer. Justification Assets must be inventoried before ownership of the assets can be established. Assets must be inventoried before risk to the assets can be evaluated. Assets must be inventoried before any of the other choices can be performed. Assets must be inventoried before they can be categorized.

Answer 34

B is the correct answer. Justification Preparing a security budget should follow risk assessment to determine activities that need to be undertaken to address areas of concern. Risk assessment, analysis, evaluation and impact analysis will be the starting point for driving management’s attention to information security and for highlighting its importance with respect to business practices. Developing an information security policy is based on and follows risk assessment. Benchmarking information will only be relevant after a risk assessment has been performed for comparison purposes.

Answer 35

C is the correct answer. Justification Identifying risk and assigning roles and responsibilities for mitigation are elements of the register. Identifying threats and probabilities are two elements that are defined in the risk matrix, as differentiated from the broader scope of content in, and purpose for, the risk register. A risk register is more than a simple list—it should be used as a tool to ensure comprehensive documentation, periodic review and formal update of all risk elements in the enterprise’s IT and related organizations. While the annual loss expectancy should be included in the register, this quantification is only a single element in the overall risk analysis program.

Answer 36

B is the correct answer. Justification Developing an operational plan for achieving compliance with the legislation is incorrect because it is not the first step. Identifying the relevant systems and processes is the best first step. Restricting the collection of personal information comes later. Identifying privacy legislation in other countries would not add much value.

Answer 37

D is the correct answer. Justification Performing a risk assessment does not ensure mitigation as part of the business process. Maintaining a risk register may be good for identifying issues but it does not mitigate risk. Centralizing risk management under a steering committee is less effective than integrating it into each business process. The primary objective of the risk management process is that risk is identified, assessed, communicated and addressed. This objective is most effectively achieved by embedding risk management activities in business processes (e.g., change management, incident response, new product design, sales campaign, etc.).

Answer 38

D is the correct answer. Justification Regulatory requirements drive business requirements. An expert advisory may not be aligned with business needs. A risk assessment is the main driver for selecting technologies. A risk assessment helps identify control gaps in the IT infrastructure and prioritize mitigation plans, which will help drive selection of security solutions.

Answer 39

A is the correct answer. Justification If the compartmentalization of the vulnerability results in the enterprise having no exposure, then there is no risk. Prevention is a more prudent approach to dealing with major threats than even the most capable incident response. Compensating controls are a less desirable approach to addressing a major threat than preventive remediation of its corresponding vulnerability. Distance is an inadequate barrier to compromise in the context of information systems.

Answer 40

C is the correct answer. Justification Determining root causes in problem management may be more difficult in highly integrated systems because of the many interconnected functions, but that is not the primary risk concern. Incident management may be affected by the added complexity of highly integrated systems when attempting to quickly isolate and ascertain the source of a problem along a chain of tightly coupled functions; however, that is not the primary issue. Highly integrated systems are more susceptible to cascading risk where the failure or compromise of any one element could cause a domino effect of failures. Setting service delivery objectives will be constrained by the extent of the integration because most elements require the same level of functionality. This is due to a lower service level of any component reducing functionality of all dependent elements; however, this is not the primary consideration.

Answer 41

D is the correct answer. Justification Skilled interviewers may help in conducting risk assessments; however, interview skills alone may not resolve this type of problem. Past risk assessments may not be relevant to the current state of the enterprise. Classification of information assets is a part of an information security program conducted in the business area. It does not affect how an information security risk assessment is currently conducted. Including relevant stakeholders is an ideal way to move beyond a risk assessment based on assumptions, as they can provide essential insight that would otherwise be missed.

Answer 42

C is the correct answer. Justification Although the lack of logging for user ad hoc reporting is not necessarily good, it does not represent as serious a security weakness as the failure to install security patches. Routing network traffic through a single switch is not unusual. The fact that operating system security patches have not been applied is a serious weakness. Database security defaulting to the enterprise resource planning system’s settings is not significant.

Answer 43

D is the correct answer. Justification There may be some minor cost benefits to performing risk assessments on a consistent basis, but that is not the main benefit. An assessment deals with a review of a process, not a person’s claim of the process being in place. An attestation is a claim without the supporting evidence. External audits do not require risk assessments, although it is encouraged. Tracking trends in evolving risk is of significant benefit to managing risk and ensuring that appropriate controls are in place.

Answer 44

B is the correct answer. Justification Because guidelines are generally not mandatory, their lack of enforcement is not a primary concern. The lack of effective oversight is likely to result in inconsistent change management activities, which can present a serious security risk. Systems that are developed by third-party vendors are becoming common and do not represent an increase in security risk as much as poor change management. Poor capacity management may not necessarily represent a major security risk.

Answer 45

A is the correct answer. Justification Studies show that training or calibrating the assessor improves accuracy and reduces the subjectivity of risk assessments. A standardized approach is less effective in preventing overestimation of risk. Assessor impartiality is important but does not compensate for the tendency to overestimate risk. Multiple methods of analysis may help accuracy but training risk assessors is the most effective.

Answer 46

A is the correct answer. Justification As business objectives and methods change, the nature and relevance of threats change as well. Omissions in earlier assessments do not, by themselves, justify regular reassessment. Use of various methodologies is not a business reason for repeating risk assessments at regular intervals. Risk assessments may help raise business awareness, but there are better ways of raising security awareness than by performing a risk assessment.

Answer 47

D is the correct answer. Justification Presumably the carrier would not charge if connectivity were lost, and this would not be useful in calculating impact. The value of data is not affected by lost connectivity and would not help calculate impact. Compensation of affected business users is not based on connectivity and would be useless in calculating impact. Financial losses incurred by the business units would be a major factor in calculating the impact of lost connectivity.

Answer 48

D is the correct answer. Justification A list of appropriate controls for reducing risk follows the assessment. Documented threats are a part of the input for a risk assessment. Evaluation of the consequences follows the assessment. An inventory of risk is the output of a risk assessment.

Answer 49

C is the correct answer. Justification Transferring the risk is of limited benefit if the cost of the control is more than the potential cost of the risk manifesting. Treating the risk is of limited benefit if the cost of the control is more than the cost of the risk being exploited. When the cost of the control is more than the cost of the risk, the risk should be accepted. If the value of the activity is greater than the potential cost of compromise, then terminating the activity would not be the appropriate advice.

Answer 50

B is the correct answer. Justification The issue should not be escalated before understanding the risk of noncompliance. A risk assessment is warranted to determine whether a risk acceptance should be granted and to demonstrate to the department the danger of deviating from the established policy. Isolating the system would not support the needs of the business. Any waiver should be granted only after performing a risk assessment.

Answer 51

B is the correct answer. Justification Tracking risk in a register is important, but it is not solely based on the classification of the asset. Unless assets are identified and classified, it will not be possible to assess the risk associated with each asset. Cybersecurity training should be risk-based. However, user training is typically based on a scenario, such as phishing. While addressing compliance risk is valid, the key benefit goes beyond compliance because classification assists the enterprise in protecting the assets through incident response. If the incident response plan is lacking, the enterprise would consider additional policy statements to protect higher priority assets. Incident response plans are often safety nets for limiting damage when a control fails or does not exist.

Answer 52

A is the correct answer. Justification If departments are reaching different risk ratings for the same outcomes, common risk measurement criteria that can be used across the enterprise are needed. Risk appetite and risk tolerance inform the acceptance of risk but do not affect the risk ratings. Quantitative risk assessments produces numeric results, but subjectivity in inputs may continue to yield varying risk ratings among departments unless common criteria are applied. Peer review of risk assessments between departments may be hampered by differing expertise among staff members in different job functions. Also, the results of risk assessments generally should not be shared more broadly than is necessary to meet business goals.

Answer 53

B is the correct answer. Justification The effect of the theft of customer data could lead to a permanent decline in customer confidence, which does not lend itself to measurement by quantitative techniques. The loss of electrical power for a short duration is more easily measurable than the other choices and can be quantified into monetary amounts that can be assessed with quantitative techniques. The risk of website defacement by hackers is nearly impossible to quantify but could lead to a permanent decline in customer confidence, which does not lend itself to measurement by quantitative techniques. Loss of a majority of the software development team would be impossible to quantify.

Answer 54

C is the correct answer. Justification While meeting with stakeholders to decide how to comply is appropriate and important, this action comes after assessing whether existing controls meet the regulation and will depend on whether there is an existing control gap. While analyzing key risk in the compliance process is appropriate and important, this action comes after assessing whether existing controls meet the regulation and will depend on whether existing controls are adequate. If the enterprise is in compliance through existing controls, the need to perform other work related to the regulation is not a priority. While updating the existing security/privacy policy is appropriate and important, this action is appropriate only if the assessment indicates a requirement to change the existing security/privacy policy.

Answer 55

C is the correct answer. Justification The residual risk may or may not be considered appropriate depending on the level of acceptable risk and the tolerance for variation to that level. If mitigation is too expensive, management should consider other treatment options and not simply choose not to address it. Risk tolerance is the acceptable level of variation that management is willing to allow for any particular risk as the enterprise pursues its objectives. Even if a risk occurs infrequently, the information security manager should address the risk if the magnitude is substantial.

Answer 56

A is the correct answer. Justification There are many regulatory requirements with varying degrees of enforcement and possible sanctions. These should be assessed and treated as any other risk. Policies addressing compliance with regulatory requirements are not by themselves sufficient to deal with regulatory requirements. Mandatory compliance with all regulatory mandates without determining the risk and potential impact may not be cost-effective. Insurance for regulatory noncompliance may not be available.

Answer 57

C is the correct answer. Justification A penetration test may identify the vulnerability but not potential threats or the remedy. A security baseline review may identify the vulnerability but not the remedy. A risk assessment will identify the business impact of the vulnerability being exploited and the remedial options. A business impact analysis will identify the impact of the loss of the mail server and requirements for restoration.

Answer 58

C is the correct answer. Justification People do make mistakes, but mistakes built into a risk management program might well be repeated any number of times in an ongoing program. Therefore, this is not a rationale for risk management as a regular program or activity. Technology is subject to obsolescence over time, but periodic assessment would likely be adequate if it were the primary rationale for risk management. Controls usually degrade over time and are subject to failure, and the threat landscape changes constantly. Therefore, it is important that risk management be performed as an ongoing program or activity in order to capture the implications of these changes and ensure that the enterprise continues to make risk-treatment decisions consistent with its objectives and risk appetite. Standards do change, and an enterprise that has identified conforming to a particular standard may be obligated to adjust its technology and processes to remain compliant. However, risk management addresses broader concerns than adherence to standards.

Answer 59

D is the correct answer. Justification Conducting a risk assessment once a year is insufficient if important changes take place. Conducting a risk assessment every three to six months for critical processes is not typical and may not be necessary, or it may not address important changes in a timely manner. Performing risk assessments on a continuous basis is generally financially not feasible; it is more cost-effective to conduct risk assessments annually or whenever there is a significant change. Risk is constantly changing. Conducting a risk assessment annually or whenever there is a significant change offers the best alternative because it takes into consideration a reasonable time frame and allows flexibility to address significant change.

Answer 60

D is the correct answer. Justification A gap analysis is not most appropriate for evaluating a business impact analysis. A gap analysis is not most appropriate for developing a business balanced scorecard. A gap analysis is not most appropriate for demonstrating the relationship between controls. A gap analysis is most useful in addressing the differences between the current state and future state.

Answer 61

B is the correct answer. Justification A background check should be a standard requirement for the service provider. An internal risk assessment should be performed to identify the risk and determine needed controls. Audit objectives should be determined from the risk assessment results. Security assessment does not cover the operational risk.

Answer 62

C is the correct answer. Justification Project management risk results from the failure to plan and manage the resources required for achieving tactical project goals, leading to budget overruns, time overruns or both. Health and safety risk is associated with threats to the personal health and safety of staff, customers, and members of the public. Processing and behavioral risk is associated with problems with service or product delivery caused by failure of internal controls, information systems, employee integrity, errors, and mistakes, or through weaknesses in operating procedures. Criminal and illicit acts risk refer to loss or damage caused by fraud, theft, willful neglect, gross negligence, vandalism, sabotage, or extortion.

Answer 63

A is the correct answer. Justification It is most important to perform a risk assessment to determine the exposure if additional controls are not deployed. The exposure level needs to be redetermined and compared with the residual risk before this decision can be made. Additional countermeasures may be deployed after determining possible losses to avoid overprotecting or underprotecting the asset. Risk transfer is an action that may be taken after reviewing the results of the risk assessment of the current situation.

Answer 64

B is the correct answer. Justification Mitigation should be based on likelihood, potential impact and cost benefit. High risk volatility means that the risk is higher during one period and lower in another. The appropriate response is to assess risk at its highest level and due to unpredictability, raise the priority of treatment. Volatility must be considered in terms of maximum risk potential. A second risk assessment would not be useful as a volatility assessment and it would be unnecessary.

Answer 65

C is the correct answer. Justification Impact is distinct and separate from risk and is not a central element of risk. Impact is related to the loss of the value that the asset provides but is not relevant to the question. The extent of the potential impact in the event of compromise coupled with the likelihood of occurrence will largely determine the extent of mitigation measures. Knowing the impact will not determine the extent to which an asset is exposed to a threat.

Answer 66

D is the correct answer. Justification While regulatory requirements may be a major consideration, there may be other areas of greater threat and impact to the enterprise. Watching the recovery time objective (RTO) requirement is very important from a business continuity perspective, but it only illustrates a part of the information security framework. Regulatory compliance may also touch upon RTO initiatives. It is difficult to set up a single formula so that the most profitable business line always has the most critical information security initiatives in the enterprise. Security activities should focus on the areas where threat, likelihood and impact are the greatest.

Answer 67

C is the correct answer. Justification A flexible security budget is essential for implementing risk management. However, without identifying new risk, other procedures will only be useful for a limited period. A sound risk baseline is essential for implementing risk management. However, without identifying new risk, other procedures will only be useful for a limited period. All of these procedures are essential for implementing risk management. However, without identifying new risk, other procedures will only be useful for a limited period. Accurate risk reporting is essential for implementing risk management. However, without identifying new risk, other procedures will only be useful for a limited period.

Answer 68

B is the correct answer. Justification Visibility and duration are not the primary elements of a risk analysis. Likelihood and impact are the primary elements that are determined in a risk analysis. Probability is the same as likelihood, and frequency is considered when determining annual loss expectancy, but it is a secondary analysis element. Financial impact is one of the primary considerations, but duration is a secondary element of the analysis.

Answer 69

A is the correct answer. Justification While not all organizational activities will pose an unacceptable risk, the practice of risk management is still applied to determine which risk requires treatment. Risk assessment is part of the risk management function. Risk assessment does not precede inclusion of the activity in the risk management program. Whether a risk level is acceptable can be determined only when the risk is known. Potential impact can be evaluated only when the risk is known and the value of the asset is determined.

Answer 70

A is the correct answer. Justification The best protection is to identify the vulnerable systems and apply compensating controls until a patch is installed. Minimizing the use of vulnerable systems could be a compensating control but would not be the first course of action. Communicating the vulnerability to system users would not be of much benefit. Updating the signatures database of the intrusion detection system (IDS) would not address the timing of when the IDS signature list would be updated to accommodate the vulnerabilities that are not yet publicly known. Therefore, this approach should not always be considered as the first option.

Answer 71

D is the correct answer. Justification Risk analysis indirectly supports the security expenditure but justifying the security expenditure is not its primary purpose. Helping businesses prioritize the assets to be protected is an indirect benefit of risk analysis but not its primary purpose. Informing executive management of residual risk value is not directly relevant. Risk analysis explores the degree to which an asset needs protecting so remediation can be managed effectively.

Answer 72

A is the correct answer. Justification Unless the exploitation of vulnerability by a threat has consequences, there is no risk to the enterprise. A threat poses no risk absent corresponding vulnerability. Vulnerability poses no risk absent a corresponding threat. Probability is a function of threat and vulnerability, but even a guaranteed event poses no risk to the enterprise unless there are consequences.

Answer 73

D is the correct answer. Justification A defined information security architecture is helpful but by itself is not a strong indicator of effective governance. Compliance with international standards is not an indication of effective governance. Periodic external audits may serve to provide an opinion on effective governance. A dynamic risk management program is a key component, and an indicator, of effective governance.

Answer 74

D is the correct answer. Justification Assessment would not be relevant in the programming phase. Risk should be considered in the specification phase, when the controls are designed, but this evaluation would still be based on the assessment carried out in the feasibility study. Assessment would not be relevant in the user testing phase. Risk should be addressed as early as possible in the development cycle. The feasibility study should include risk assessment so that the cost of controls can be estimated before the project proceeds.

Answer 75

B is the correct answer. Justification Management may advise holding off until a competitor implements the technology; however, the enterprise would then lose out on any potential revenue presented by the opportunity. This decision is best made once potential risk is assessed. When considering using unproven, emerging technologies, it is best to start small. A pilot project will be best suited for this purpose because risk can be assessed in a controlled manner as the business explores the viability of the technology and potential further deployment on a larger scale. Even when the solution is built in a service vendor’s technical environment, the service requestor must own the risk stemming from the technical solution. Therefore, the enterprise will want to assess the potential risk first. It is not common practice to buy insurance in anticipation of failures may be caused by unproven technology.

Answer 76

B is the correct answer. Justification Risk changes at various stages of the life cycle. If the assessment occurs only at the beginning and end of the process, important issues will be missed. A risk assessment should be conducted throughout the entire life cycle of a new or changed process. This allows an understanding of how implementation of an early control will affect control needs later. The timing of assessments should occur at each stage of the life cycle regardless of the process. Laws and regulations are not relevant to when risk should be assessed.

Answer 77

A is the correct answer. Justification Risk evaluation provides management with the extent that the risk meets the acceptability criteria and options for response. Response to risk may come in the form of acceptance, transfer (sharing), mitigation or avoidance. Mitigation is only one possible response to risk. Risk evaluation is the final stage of an assessment activity. Control objectives align with the risk management strategy, which determines risk response.

Answer 78

D is the correct answer. Justification Reviewing new laws and regulations may or may not be identified as a mitigating measure based on the risk determined by the assessment. Updating operational procedures may or may not be identified as a mitigating measure based on the risk determined by the assessment. Validating staff qualifications may or may not be identified as a mitigating measure based on the risk determined by the assessment. A risk assessment should be conducted to determine new risk introduced by the outsourced processes.

Answer 79

A is the correct answer. Justification A significant control failure indicates that either the control was poorly designed or the risk was not properly identified and classified. Depending on the nature and extent of unremediated risk, reassessment may be warranted; however, in some cases the process of change management while addressing the risk will have provided adequate understanding of the risk and adequacy of treatment. Updating an operating system under change management will include an incremental assessment of any new risk and full reassessment is not likely to be needed. Emergency changes usually require that the change management process be completed subsequently and any specific new risk addressed, making it unlikely that a full risk reassessment is required.

Answer 80

C is the correct answer. Justification In general, ease of scaling is the benefit of a cloud solution. Scaling is flexible with cloud computing technology at a predictable cost. Identification of the origination point of a transaction may be a separate issue from cloud technology. Therefore, it is unnecessary to raise this concern for a cloud computing solution. Cloud computing involves the interaction with a third party, as does any other outsourcing arrangement. Therefore, a cloud computing solution has a chance of introducing new risk that is not currently recognized by the enterprise’s risk profile. It is essential for the review risk profile to cover new risk scenarios. The enterprise may come under attack regardless of the introduction of a cloud computing solution. If proper security management for cloud computing is in place, the chance of being compromised may be lower.

Answer 81

A is the correct answer. Justification An uncontrolled technical device owned by an employee usually contains fewer controls and protective security measures than an enterprise device and, therefore, might be infected with malware. Connecting this type of device to the enterprise’s network is a major risk as malware will infiltrate the enterprise, bypassing firewalls. Employees need to be educated on the proper use of personal technical devices, and an acceptable use or Bring Your Own Device (BYOD) policy should be in place. The loss of the device would present an issue; however, this would be secondary to a potential malware infection. Messaging among staff using personal devices would not be as big of a concern as the release of malware into the network. It is unlikely that network performance slows down as the result of personal devices connecting to the enterprise network.

Answer 82

A is the correct answer. Justification Previous audit reports will provide insight into trends and identified vulnerabilities that will greatly assist in a risk assessment. Current user access lists help with conducting the assessment, but the previous audit report may outline completed remediation actions. Access approval procedures help with conducting the assessment, but the previous audit report may outline completed remediation actions. Authentication log files help with conducting the assessment, but the previous audit report may outline completed remediation actions.

Answer 83

A is the correct answer. Justification When used for information risk, the annual loss expectancy (ALE) is based on at least some subjective information. Information security does not possess sufficient historic data to complete actuarial tables and provide highly refined predictions of the occurrence of events (e.g., accident data for the automotive industry). Time and training requirements are less important factors than the subjectivity that is inherent to ALE when assessing IT risk. Some international standards do recognize ALE, and even if this were not the case, it would not be a primary concern in most instances.

Answer 84

D is the correct answer. Justification Aggregated risk can occur in homogenous systems in which one threat vector can compromise many systems whether integrated or not. Systemic risk is unrelated to the degree of integration. Operational risk is unrelated to the degree of integration. Tightly integrated systems are more susceptible to cascading risk because the failure of one element causes a sequence of failures.

Answer 85

C is the correct answer. Justification External parties, including auditors, do not have the necessary level of detailed knowledge of the inner workings of the business. Peer groups would not have a sufficiently detailed understanding of the business to be effective at analyzing a particular enterprise’s risk. Process owners have the most in-depth knowledge of risk and compensating controls within their environment. Management consultants are expected to have the necessary skills in risk analysis techniques but would still have to rely on a group with intimate knowledge of the business.

Answer 86

C is the correct answer. Justification Theft of software can be quantified into monetary amounts. Power outages can be quantified into monetary amounts more precisely than they can be assessed with qualitative techniques. A permanent decline in customer confidence does not lend itself well to measurement with quantitative techniques. Qualitative techniques are more effective in evaluating things such as customer loyalty and goodwill. Temporary loss of email can be easily quantified into monetary amounts.

Answer 87

C is the correct answer. Justification Enforcing existing standards is a good practice; however, standards need to be continuously examined in light of new technologies and the risk they present and business requirements. Standards should not be changed without an appropriate risk assessment. Resolving conflicts of this type should be based on a sound risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. A blanket decision should never be made without conducting such an analysis. It would not be the job of the security manager to research alternative technologies.

Answer 88

A is the correct answer. Justification Individuals in different cultures often have perspectives on what information is considered sensitive or confidential and how it should be handled that may be inconsistent with the enterprise’s requirements. Cultural norms are not usually an area of consideration in a security review or during an onsite inspection. Technical skills are common scope areas for a security review to ensure that the offshore provider meets acceptable standards. Controls design and operational effectiveness are common scope areas for a security review to ensure that the offshore provider meets acceptable standards. Information security policies are common scope areas for a security review to ensure that the offshore provider meets acceptable standards.

Answer 89

C is the correct answer. Justification The security standard may be changed once it is determined by analysis that the risk of doing so is acceptable. It is highly improbable that a business objective could be changed to accommodate a security standard. Conflicts between a security standard and a business objective should be resolved based on a risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. Risk acceptance is a process that derives from the risk analysis once the risk is determined to be acceptable.

Answer 90

B is the correct answer. Justification Value at risk (VAR) is an analysis tool, not an assessment tool and is quantitative rather than qualitative. VAR provides a quantitative value of the maximum probable loss in a given time period—typically at 95 or 99 percent certainty. While primarily used by financial enterprises, applicability to information security has been demonstrated. VAR calculations are typically complex and time-consuming.

Answer 91

D is the correct answer. Justification This is not the main reason for the information security manager to have technical knowledge, but it is helpful. The information security manager is not responsible for implementing IT security controls. Technical knowledge is not required for developing a conceptual information security architecture. The information security manager has to understand any risk related to IT systems that could affect the business objectives or affect the business strategy achievement in order to propose an appropriate level of controls.

Answer 92

B is the correct answer. Justification There is a possibility of internal fraud by a terminated employee, but this is a less severe threat than the interdependencies between HR systems and other business operations. Production systems will refer to the human resources (HR) database to check the identity of employees. If the reference to an employee attribute is lost during business transactions, it may affect business processes. (For instance, the financial ledger system may reject journal entries related to post-termination events pertaining to an employee, such as severance, tax adjustments, etc.) Thus, dependencies within the production systems need to be reviewed before this procedure is implemented. It is not common to generate a job assignment history of employees after termination. Therefore, the integrity of a record is not a priority. Justification of timeframe (e.g., 24 hours) in a procedure may be evaluated by business and security management and then mutually signed off on. Unless there are any specific issues, this will not be a major concern.

Answer 93

B is the correct answer. Justification The beginning of a security program is only one time a risk assessment should be performed. Risk assessment needs to be performed on a continuous basis because of organizational and technical changes. Risk assessment must take into account all significant changes in order to be effective. During development of the business case is another point when risk assessment should occur. Risk should be assessed during the change management process but that is only one point.

Answer 94

D is the correct answer. Justification Inherent risk may already be acceptable and require no remediation. Minimizing below the acceptable level is not the objective and usually raises costs. Elimination of business risk is not possible. Effective controls are naturally a clear objective of a risk management program with the primary goal of achieving acceptable risk across the enterprise. The goal of a risk management program is to ensure that acceptable risk levels are achieved and maintained.

Answer 95

A is the correct answer. Justification Decisions regarding security should always weigh the potential loss from a risk against the benefits derived from the change. It is a management decision to determine if the change in risk is worth the benefit. Redesigning the proposed change might not always be the best option because it might not meet the business needs. Implementing additional controls might be an option, but it would be done after the change in risk was known.

Answer 96

B is the correct answer. Justification For device access to be determined on the basis of approval status, an assessment process must be in place to grant approval. A stringent assessment process is critical to comply with corporate and regulatory requirements around policies, encryption, detection of jailbreaking or rooted devices, etc. Implementing a plan-do-check-act approach is part of the monitoring and enforcement process, but it is not a prerequisite. Having a review and approval process for applications in the enterprise’s application store applies only to devices granted approval to access the network.

Answer 97

C is the correct answer. Justification Management support is always important but is not relevant when performing a risk assessment except to the extent that a lack of support may present a risk. The annual loss expectancy calculations can be used in risk analysis subsequent to assets first being identified and properly valued. Identification and valuation of assets provides the essential basis for risk assessment efforts. Without knowing an asset exists and its value to the enterprise, the risk and impact cannot be determined. Understanding motives, means and opportunities is a part of risk identification, but they must be considered in the context of identified and valued assets.

Answer 98

A is the correct answer. Justification The objective of information risk management is to bring the information security residual risk to an acceptable level, so residual risk is evaluated first on the basis of existing controls and again after any new controls are designed or implemented. Identification and classification of information resources or assets that need protection is the first step of risk management and is followed by assessment of threats and vulnerabilities to determine probability. Probability is an input to calculating initial risk, so there is no basis for calculating residual risk at this stage. Knowledge of the threat environment and consequences of a compromise is inadequate to determine residual risk because it does not take into account vulnerability and exposures. The overall view of risk reflects an initial risk level that has not yet been reduced by application of controls. After elements of risk are combined to form an overall view of risk, the next step is to identify existing controls or design new controls to bring risk to an acceptable level.

Answer 99

D is the correct answer. Justification Although an important component in the development of any managed program, obtaining management acceptance and support ideally occurs well before the development of the program, in the plan and organize phase. Information security policies and standards are a component of the risk management program but do not belong to the initial stages of its development. Information security policies and standards are formed by the decisions made in the planning phase of the program and are developed based on the outcomes and business objectives established by the enterprise. Management and oversight of the risk management program is a monitoring control that is developed to ensure that the program is satisfying the outcomes and business objectives established by the business. This process is designed at the latter stages of development once the purpose of the program and the mechanics of its deployment have been established. This oversight process could be integrated with internal audit activities or other compliance program processes. An initial requirement is to determine the enterprise’s purpose for creating an information security risk management program, determine the desired outcomes and define objectives.

Answer 100

D is the correct answer. Justification Legal counsel is not the authority to determine the acceptable levels of information security risk for the enterprise. Security management is not the authority to determine the acceptable levels of information security risk for the enterprise. External auditors can point out areas of risk but are not the authority to determine the acceptable levels of information security risk for the enterprise. Senior management, represented in the steering committee, has ultimate responsibility for determining what levels of risk the enterprise is willing to accept.

Answer 101

D is the correct answer. Justification The contract review is important, but the risk assessment should provide guidance concerning whether the enterprise should engage with the third party. The audit review is important after the risk assessment is complete. Some items identified in the assessment will determine if any of the findings are material to the enterprise. Projected cost of services is important, but the risk assessment will guide the enterprise concerning whether it should engage with the third party. The risk assessment is essential because it provides guidance to the enterprise concerning whether it should engage with the third party. The risk assessment should address strategic, operational, compliance and other key risk relevant to the enterprise.

Answer 102

A is the correct answer. Justification One way to determine the return on security investment is to illustrate how information security supports the achievement of business objectives. Security metrics measure improvement and effectiveness within the security practice but do not necessarily tie to business objectives. Listing deliverables does not necessarily tie to business objectives. Creating process improvement models does not necessarily tie directly to business objectives.

Answer 103

B is the correct answer. Justification Qualitative analysis is a more appropriate approach for customer perceptions, which are difficult to express in a purely quantitative manner. Percentage estimates are a characteristic of quantitative risk analysis. Qualitative analysis is a more appropriate approach when there is a lack of specific details. Qualitative analysis is a more appropriate approach for subjective information.

Answer 104

B is the correct answer. Justification Threats and vulnerabilities are the measure of risk, but without knowing potential impact, the most cost-effective treatment options will not be clear. Probability of compromise coupled with the likely impact will be the most important considerations for selecting treatment options. Vulnerabilities and the cost to remediate without considering impact do not provide enough information to make the best treatment selection. Exposure of assets will modify the effective risk by affecting the likelihood that a vulnerability will be exploited; however, it is insufficient information to choose the best treatment option. Operational risk is only one part of overall risk.

Answer 105

B is the correct answer. Justification Threat is an element of risk only in combination with vulnerability. Risk is the combination of the probability of an event and its impact. Threat and exposure are insufficient to determine risk. Sensitivity is a measure of consequence but does not take into account probability.

Answer 106

C is the correct answer. Justification Even if the threat of compromise is high, the impact may be low; the best basis to determine where to implement the most protection is the risk to the specific element. While it may seem that availability is the most important, if the system is down, there is no access to the data. There are many cases in which the standard business processes can continue, even if the system is down, but stringent controls must be maintained around confidentiality and integrity of information. The level of control should be based on the risk to the specific element. The probability of compromise and the impact on the enterprise are combined to determine which element requires the greatest protection, with emphasis on impact. It is very unlikely that all elements of the confidentiality, integrity or availability triad require equal levels of protection.

Answer 107

A is the correct answer. Justification Risk assessment requires that the business assets that need to be protected be identified before identifying the threats. The second step in risk assessment is to establish whether the threats represent business risk by identifying the likelihood and effect of occurrence. Assessing the vulnerabilities that may affect the security of the asset follows identifying business assets and risk. Risk evaluation after analysis is used to determine whether controls address the risk to meet the criteria for acceptability.

Answer 108

B is the correct answer. Justification Risk tolerance is the acceptable deviation from acceptable risk and is not related to whether the risk is high or low. High risk tolerance (i.e., a high degree of variability in acceptable risk) addresses the issue of uncertainty in the risk assessment process itself. Risk tolerance is unrelated to impact. The degree of risk tolerance is not indicated by a business impact analysis.

Answer 109

C is the correct answer. Justification Annual loss expectancy is the quantification of loss exposure based on probability and frequency of outages with a known or estimated cost. It is part of a business impact analysis and may be calculated at the enterprise or system level, but it is based on projections rather than on observed data. The number of recorded or recognized incidents does not reveal impact or indicate organizational risk. An unplanned business interruption will be the best indication of organizational risk as it provides a quantifiable measure of how much business may be lost due to the inability to acquire, process and produce results that affect customers. The number of high-impact vulnerabilities provides an indication of weakness within the information network and/or systems but is not by itself an indicator of risk.

Answer 110

D is the correct answer. Justification Original cost may be significantly different from the current cost of replacing the asset. Net cash flow does not accurately reflect the true value of the asset. Net present value does not accurately reflect the true value of the asset. The value of a physical asset should be based on its replacement cost because this is the amount that would be needed to replace the asset if it were to become damaged or destroyed.

Answer 111

A is the correct answer. Justification Information security managers should use risk assessment techniques as one of the main bases to justify and implement a risk mitigation strategy as efficiently as possible. Risk assessment is only one part of determining return on investment. Providing documentation for auditors and regulators is a secondary aspect of using risk assessment techniques. If assessed risk is subjective, risk assessment techniques will not meaningfully quantify them.

Answer 112

C is the correct answer. Justification One-time passwords are more secure than static passwords, but alone, they are not the most secure method. A virtual private network is an encryption connection from a device to a network; it is not an authentication method. Multifactor authentication is the most secure way to authenticate users when remote access to production system is required. Multifactor authentication uses three common factors: something you know (e.g., passwords), something you have (e.g., tokens, smart cards) and something you are (e.g., biometric methods such as fingerprints or retina scans). A complex password includes two out of three common factors used for multifactor authentication. Requiring complex passwords is a good practice, but it is not the most secure method.

Answer 113

C is the correct answer. Justification Surveying management typically provides a widely varying perspective on acceptable risk. The amount spent on security is an indicator but does not quantify acceptable levels of risk. The amount of business interruption insurance carried and the cost specifies a directly quantifiable level of risk that the enterprise will accept, and at what cost. The history of incidents will show what risk was not addressed and elicit comments about acceptability but will not indicate what the enterprise is willing to spend on mitigation.

Answer 114

D is the correct answer. Justification A cost-benefit analysis does not define budget constraints; the board of directors or senior management of the enterprise will do that based on a variety of factors. The purpose of the analysis is not to show that due diligence was performed, but to establish a result that will show the cost of the control and the reduction in risk. A cost-benefit analysis does not help verify that the cost of a control is within the security budget; it may, however, help identify controls that require additional expenses that exceed the established security budget. Senior management can weigh the cost of the risk against the cost of the control and show that the control will reduce that risk by some measure.

Answer 115

B is the correct answer. Justification Examples of containment defenses are awareness, training and physical security defenses. Detection defenses include logging, monitoring, measuring, auditing, detecting viruses and intrusion. Examples of reaction defenses are incident response, policy and procedure change, and control enhancement. Examples of recovery defenses are backups and restorations, failover and remote sites, and business continuity plans and disaster recovery plans.

Answer 116

D is the correct answer. Justification Incident history can provide only an approximation of the enterprise’s efforts to mitigate further occurrences after consequences have been determined. Incident history may also indicate a lack of risk awareness. Controls deployment can provide a rough qualitative estimation of risk appetite as long as technologies are tested and effectiveness is determined. Requirements set in policies and standards can only serve as a qualitative approximation of risk appetite. The cost of a business interruption can be accurately determined. The comparison of this expense (added to any deductible) with the total cost of premiums paid for a specific amount of insurance can serve as an accurate indicator of how much the enterprise will spend to protect against a defined loss.

Answer 117

A is the correct answer. Justification Exposure is the quantified potential for loss that may occur due to an adverse event, calculated as the product of probability and magnitude (impact). Because probability is itself a function of threat and vulnerability, exposure takes into account all three of the other factors and, if known, is the most important consideration. A threat is anything (e.g., object, substance, human) that is capable of acting against an asset in a manner that can result in harm. Threats may cause harm only if they correspond to vulnerability, so the probability of an event can be calculated only when both are known. Vulnerability is a weakness in the design, implementation, operation or internal control that could expose the system to adverse threats from threat events. Vulnerability may lead to harm only when acted on by a corresponding threat, so the probability of an event can be calculated if both are known. Magnitude (or impact) measures the potential severity of loss from a realized event/scenario. Whether such an event will be realized depends on its probability (likelihood), which requires assessment of both threat and vulnerability.

Answer 118

B is the correct answer. Justification Cost to remediate is a major factor relative to the value of the applicable assets (i.e., is remediation appropriate for this asset versus another risk treatment option?). It is ineffective as a means of prioritization across different assets, because it does not take into account their business value. The balance between impact and frequency captures the adjusted probability of loss to the enterprise associated with each risk. It provides an immediate and relevant basis for prioritization of treatment, with high-impact and high-frequency risk ranking highest on the list. Breadth of scope is not necessarily equivalent to impact. Prioritizing a risk that affects a broad range of relatively unimportant systems over a risk that impacts a single critical system would not be beneficial to the enterprise. Effort is a subset of overall cost representing time and expertise. Unto itself, cost is not a suitable basis for prioritization.

Answer 119

D is the correct answer. Justification Internet firewalls are only one kind of control and do not constitute a comprehensive approach to reducing risk in cybersecurity. In the absence of controls that mitigate risk, cybersecurity risk will remain the same regardless of awareness efforts. Risk assessments may be used to guide risk response, but on their own, they do not treat inherent risk. A risk prior to mitigation is called inherent risk. The risk that remains after countermeasures and controls have been implemented is residual risk. Controls are most often used to treat the risk after the risk is analyzed.

Answer 120

D is the correct answer. Justification Combining homogeneous elements does not in itself reduce risk; it may actually increase risk. Aggregation does not affect the methodology used for risk acceptance. Risk reporting is not a primary consideration of risk aggregation. Individual risk with minimal impact may constitute a significant overall risk if each risk can be exploited from the same threat vector. The threat vector is the method used to exploit the target.

Answer 121

D is the correct answer. Justification The board of directors determines the risk appetite and tolerance, so there would be no tolerance in excess of the appetite if the board took this position. The purpose of determining levels of risk appetite and tolerance is to have clear thresholds for accepting risk without mitigation or transfer. Risk avoidance is the best choice for responding to a risk only when it exceeds both the appetite and the tolerance, despite all efforts at mitigation or transfer. Risk that exceeds organizational appetite but lies within tolerable levels is not risk the enterprise wants to accept. When there is concern that the impact has been underestimated, senior management may prefer to mitigate the risk to acceptable levels rather than unintentionally accept risk whose impact ends up exceeding the tolerance.

Answer 122

C is the correct answer. Justification Transfer of the risk is a step that might be taken after initial validation occurs. Acquiring insurance is a step taken after initial validation occurs. After residual risk has been determined, the next step should be to validate that the risk is acceptable (or not) and within the enterprise’s risk tolerance. Formally documenting and accepting the residual risk is a step taken after initial validation occurs.

Answer 123

A is the correct answer. Justification A cost-benefit analysis will reveal whether a control is worth the cost to implement. Incident metrics are useful, but a low-impact event is unlikely to help with decision-making. Gap analysis is a part of the risk assessment and analysis process, not a part of the risk treatment process Vulnerability scan results are a part of the risk monitoring process, not a part of the risk treatment process.

Answer 124

A is the correct answer. Justification Control baselines are designed to mitigate risk and will depend on the enterprise’s risk appetite. The viability and existence of threats will have a direct bearing on control baselines, but only to the extent that they can exploit vulnerabilities and create a risk of potential impact. In some cases, the effectiveness may modify the control objectives if it is not feasible to mitigate the risk, but generally that will not change the objectives. Vulnerability assessments are conducted against a control baseline.

Answer 125

B is the correct answer. Justification Risk assessment includes identification and analysis to determine the likelihood and potential consequences of a compromise, which is not when risk is to be considered for acceptance or required mitigation. If after risk evaluation a risk is unacceptable, acceptability is determined following risk mitigation efforts. Risk identification is the assessment process that identifies viable risk through developing a series of potential risk scenarios. Monitoring is unrelated to risk acceptance.

Answer 126

A is the correct answer. Justification Role-based access control is a preventive control that provides access according to business needs; therefore, it reduces unnecessary access rights and enforces accountability. Audit trail monitoring is an after-the-fact detective control. Privacy policy is not relevant to this risk. Defense in depth primarily focuses on external threats and control layering.

Answer 127

B is the correct answer. Justification Risk transfer involves transferring the risk to another entity such as an insurance company. By implementing security controls, the company is trying to decrease risk to an acceptable level, thereby mitigating risk. Risk acceptance involves accepting the risk in the system and doing nothing further. Risk avoidance stops the activity causing the risk.

Answer 128

A is the correct answer. Justification In a cost-benefit analysis, the annual cost of safeguards is compared with the expected cost of loss. This comparison can then be used to justify a specific control measure. Penetration testing may indicate the extent of a weakness but, by itself, will not establish the cost-benefit of a control. Frequent risk assessment programs will certainly establish what risk exists but will not determine the cost of controls. Annual loss expectancy is a measure that will contribute to the potential cost associated with the risk but does not address the benefit of a control.

Answer 129

B is the correct answer. Justification The impact of a successful exploit will not change. Reducing exposure reduces the likelihood of a vulnerability being exploited. The vulnerabilities of the asset will not change because exposure is reduced. The recovery time is not affected by a reduction in exposure.

Answer 130

C is the correct answer. Justification Annual loss expectancy could help measure the benefit but would not address the costs. The potential reduction in the frequency of incidents could help measure the benefit but would not address cost. The total cost of ownership would be the most relevant piece of information to determine both the total cost and the benefit. The approved budget for the project is not relevant to the cost-benefit analysis.

Answer 131

C is the correct answer. Justification Implementing countermeasures may not be possible likely would not be the most cost-effective approach to security management. Eliminating the risk may not be possible. Risk is typically transferred to insurance companies when the probability of an incident is low but the impact is high. Examples include hurricanes, tornadoes and earthquakes. Accepting the risk would leave the enterprise vulnerable to a catastrophic disaster that might cripple or ruin the enterprise. It would be more cost-effective to pay recurring insurance costs than to be affected by a disaster from which the enterprise could not financially recover.

Answer 132

A is the correct answer. Justification It is appropriate to reduce control strength if it exceeds mitigation requirements set by acceptable risk levels. An inability to determine risk is not a justification for reducing control strength. Excessive control cost is not a reason to reduce strength, although it suggests that a redesign of the control is needed. Control effectiveness does not change the control strength requirement.

Answer 133

B is the correct answer. Justification The assignment of sensitivity and criticality takes place with the information assets that have already been included in the information security program. The assigned class of sensitivity and criticality of the information resource determines the level of access controls to be put in place. Classification is unrelated to the costs of the information resource. The overall security budget is not directly related to classification.

Answer 134

A is the correct answer. Justification A review of access control lists is a detective control that will enable an information security manager to ensure that authorized persons are entering in compliance with corporate policy. Visitors accompanied by a guard will also provide assurance but that may not be cost-effective. A visitor registry is the next most cost-effective control but not as secure. A biometric coupled with a personal identification number will strengthen access control; however, compliance assurance logs will still have to be reviewed to ensure only authorized access.

Answer 135

A is the correct answer. Justification Acceptance of risk should be regularly reviewed to ensure that the rationale for the initial risk acceptance is still valid within the current business context. The rationale for initial risk acceptance may no longer be valid due to changes, and risk therefore cannot be accepted permanently. Even risk that has been accepted should be monitored for changing conditions that could alter the original decision. Risk is an inherent part of business and avoiding it to improve the risk profile would be misleading and dangerous. Even risk that has been accepted should be maintained in the risk log and monitored for changing conditions that could alter the original decision.

Answer 136

A is the correct answer. Justification Deciding what level of risk is acceptable to an enterprise is fundamentally a function of management. At its discretion, organizational management may decide to accept risk. The target risk level for a control is ultimately subject to management discretion. Failure to comply with regulatory requirements has consequences, but those consequences are considered in the context of organizational risk. In some cases, the cost of failure to comply may be lower than the cost of compliance; in this case, management may decide to accept the risk. Inherent risk is the risk that exists before controls are applied. The results of an internal audit are used to determine the actual level of residual risk, but whether this level is acceptable is fundamentally a function of management.

Answer 137

C is the correct answer. Justification Personal information is not defined in the question as the data that were lost. If insurance is available, it is unlikely to compensate for all potential impact. When mobile equipment is lost or stolen, the information contained on the equipment matters most in determining the impact of the loss. The more sensitive the information, the greater the liability. If staff carries mobile equipment for business purposes, an enterprise must develop a clear policy as to what information should be kept on the equipment and for what purpose. Cost of equipment would be a less important issue.

Answer 138

C is the correct answer. Justification File backup procedures ensure the availability of information in alignment with data retention requirements but do nothing to prevent leakage. Database integrity checks verify the allocation and structural integrity of all the objects in the specified database but do nothing to prevent leakage. An acceptable use policy establishes an agreement between users and the enterprise and defines for all parties the ranges of use that are approved before gaining access to a network or the Internet. Incident response procedures provide detailed steps that help an enterprise minimize the impact of an adverse event but do not directly address data leakage.

Answer 139

C is the correct answer. Justification Even if the risk is residual, if it exceeds the risk appetite, then it is acceptable only if it falls within the risk tolerance. The residual risk may or may not be considered appropriate depending on the level of acceptable risk and the tolerance for variation to that level. If mitigation is too expensive compared to the benefit, the information security manager should consider other treatment options. Just knowing the expense is not enough. Risk tolerance is the acceptable level of variation that management is willing to allow for any particular risk as the enterprise pursues its objectives. Low frequency alone does not warrant ignoring a risk.

Answer 140

B is the correct answer. Justification Reducing risk to zero is impossible, and the attempt would be cost-prohibitive. An effective risk management program reduces the risk to an acceptable level; this is achieved by reducing the probability of a loss event through preventive measures and by reducing the impact of a loss event through corrective measures. Tying risk to a percentage of revenue is inadvisable because there is no direct correlation between the two. Reducing the probability of risk occurrence may not always be possible, as in the case of natural disasters.

Answer 141

D is the correct answer. Justification The effects of a potential event can be shared by procuring insurance, but the risk is not mitigated. Acceptance of risk is a decision by the enterprise to assume the impact of the effects of an event. Risk is never fully eliminated, unless the activity that causes the risk is stopped or avoided. Insurance is a method of offsetting the financial loss that might be incurred as a result of an adverse event. Some, but not all, of the potential costs are transferred to the insurance company.

Answer 142

B is the correct answer. Justification Risk management is not intended to remove every identified risk because it may not be cost-effective. The goal of risk management is to ensure that all residual risk is maintained at a level acceptable to the business. Risk management is not intended to implement controls for every threat because not all threats pose a risk, and it would not be cost-effective. Control risk is the risk that a control may not be effective; it is a component of the program but it is unlikely to be reduced to zero.

Answer 143

C is the correct answer. Justification Reducing risk to a level too small to measure is impractical and is often cost-prohibitive. Depending on the risk preference of an enterprise, it may or may not choose to pursue risk mitigation to the point at which the benefit equals or exceeds the expense. Risk should be reduced to a level that an enterprise is willing to accept. To tie risk to a specific rate of return ignores the qualitative aspects of risk that must also be considered.

Answer 144

A is the correct answer. Justification Residual risk is the remaining risk after management has implemented a risk response. Because residual risk will always be too high, the only practical solution is to mitigate the financial impact by purchasing insurance. Purchasing insurance is also known as risk transfer. The enterprise has determined the residual risk will always be too high and chosen to transfer the risk, so there is no need to attempt further mitigation. The enterprise has determined the residual risk will always be too high and chosen to transfer the risk, so there is no need to attempt further mitigation. The enterprise has determined the residual risk will always be too high and chosen to transfer the risk, so there is no need to attempt further mitigation.

Answer 145

D is the correct answer. Justification Reducing cost in the short term is rarely the purpose of risk response. Reducing the overall impact of loss associated with risk is only one approach that an enterprise may take; a level of risk that is already acceptable should generally be allowed regardless of whether it might be further reduced. Lowering vulnerability is only one approach that an enterprise may take to respond to risk. Risk response rarely seeks to reduce threat in the aggregate and is generally unable to minimize it. Enterprises respond to risk in ways that control impact by keeping it within acceptable (or tolerable) levels.

Answer 146

C is the correct answer. Justification Management should address ambiguous regulations by requesting clarification from the issuer or the legal department. Management decisions on compliance should be based on a cost-benefit analysis. Management may decide it is less expensive to deal with possible sanctions than to attempt to comply. The fact that the regulations are inconsistent with the organizational strategy is not a major factor in deciding not to comply.

Answer 147

B is the correct answer. Justification Some vulnerabilities may not have significant impact and may not require mitigation. The treatment should consider the degree of exposure and potential impact and the costs of various treatment options. Compensating controls are considered only when there is a viable threat and impact, and only if the primary control is inadequate. Management approval may not be required in all cases.

Answer 148

B is the correct answer. Justification Having knowledge of the enterprise's risk appetite is not the sole requirement for gaining senior management support. Understanding risk appetite in key security control areas helps redirect resources from risk at or below acceptable levels to risk above the appetite. The result is improved control effectiveness at no additional cost. This answer does not address the value of understanding risk appetite. The risk environment and control effectiveness do change, but continuous monitoring applies more to rapidly changing controls and to areas of greatest risk. Risk appetite changes are usually more stable. Knowledge of risk appetite does help to facilitate communication with management but is only one small element of effective communication with senior management.

Answer 149

C is the correct answer. Justification A chief risk officer is usually helpful in identifying many types of risk faced by an enterprise, but remediation is a function of many organizational units, and unless their activities are integrated, there is the possibility of duplicated efforts or gaps in protection. Risk assessments are helpful in exposing risk but by themselves do not serve to mitigate the identified risk. Integrating the risk mitigation of the typical enterprise’s many risk management and assurance functions will best ensure that there are no gaps in protection efforts and a minimum of duplicated efforts, which is likely to result in the best coverage at the lowest cost. Defining acceptable risk levels can provide guidance to the enterprise about the required levels of mitigation required but does not prevent duplication of efforts or gaps in protection.

Answer 150

A is the correct answer. Justification Logon banners would appear every time the user logged on, and the user would be required to read and agree to terms before using the resources. Because the message would be conveyed in writing and would appear consistently, it could be easily enforceable in any enterprise. Security-related email messages are frequently considered spam by network users and would not, by themselves, ensure that the user agreed to comply with security requirements. The existence of an Intranet website would not force users to access it and read the information. Circulating the information security policy alone would not confirm that an individual user read, understood and agreed to comply with its requirements unless it was associated with a formal acknowledgment, such as a user’s signature of acceptance.

Answer 151

D is the correct answer. Justification A well-defined organizational structure could be an enabler for an effective security strategy, but it is not the most important factor. A lack of internal IT security awareness could be part of the threat landscape, but it is not as important as the risk appetite and tolerance. Enterprise security culture may have an impact on the information security strategy; however, enterprise risk appetite still has the biggest impact. The security strategy is primarily led by an established enterprise risk appetite and levels.

Answer 152

A is the correct answer. Justification Organizational requirements should determine when a risk has been reduced to an acceptable level. The acceptability of a risk is ultimately a management decision, which may or may not be consistent with information systems requirements. The acceptability of a risk is ultimately a management decision, which may or may not be consistent with information security requirements. Because each enterprise is unique, international standards may not represent the best solution for specific enterprises and are primarily a guideline.

Answer 153

B is the correct answer. Justification The proportion of unremediated risk may be an indicator, but there are many other factors unrelated to acceptable risk such as treatment feasibility, availability of controls, etc. The amount of business insurance coverage carried and the cost provide a directly quantifiable indication of the level of risk the enterprise will accept and at what cost. The percentage of the IT budget allocated to security is an indicator but does not quantify acceptable levels of risk. Classifying assets will indicate which assets are more important than others but does not quantify the acceptability of risk.

Answer 154

C is the correct answer. Justification The safeguards need to match the risk level. You can never be certain of having sufficient safeguards because threats are always evolving. While countermeasures could be too complicated to deploy, this is not the most compelling reason. An enterprise may decide to live with specific risk because it would cost more to protect the enterprise than to incur the potential loss. It is unlikely that a global financial institution would not be exposed to such attacks, and the likelihood could not be predicted.

Answer 155

B is the correct answer. Justification Unless a detailed assessment of the finding is completed, spending resources on strengthening the existing controls will not be an appropriate step. Control decisions are driven by risk. Risk should be carefully reassessed and analyzed to correct potential misjudgment in the original assessment. A control objective is a statement of the desired result or purpose to be achieved by implementing control procedures in a particular process. Changes to control objectives should be made after risk has been reassessed. Security baselines set by appropriate standards are the minimum security requirements for different trust domains across the enterprise. Baselines may need to be strengthened after risk has been reassessed.

Answer 156

D is the correct answer. Justification A risk assessment performed before system development will not find vulnerabilities introduced during development. Performing a risk assessment at system deployment is generally not cost-effective and can miss a key risk. If performed prior to business case development, a risk assessment will not discover risk introduced during the system development life cycle (SDLC). Performing risk assessments at each stage of the SDLC is the most cost-effective method because it ensures that vulnerabilities are discovered as soon as possible.

Answer 157

B is the correct answer. Justification Redundant power supplies would not prevent an individual from powering down a device. Protective switch covers would reduce the possibility of an individual accidentally pressing the power button on a device, thereby turning off the device. Shutdown alarms would take effect after the fact. Biometric readers would be used to control access to the systems.

Answer 158

A is the correct answer. Justification An information security manager should report the risk of the new system to the business unit and recommend controls to mitigate the risk. Then the business can make the appropriate risk-based decision. The decision to proceed with the acquisition or not would be outside the scope of the information security manager. An information security manager may design the controls and the proposal but may not be able to enforce implementation. This is usually the responsibility of the system owner/business function head. A security manager may engage a third party to reassess the risk to confirm earlier assessments but subsequently must report the possible changes in risk levels to decision makers.

Answer 159

D is the correct answer. Justification Delegating responsibility solely to the IT teams of the merging organizations may result in fragmented efforts and inconsistencies in addressing security risk. The chief information security officer (CISO) should provide leadership and coordination to ensure a cohesive approach to security across the merged entity. While legal counsel and external auditors can provide valuable guidance on regulatory compliance and risk management, they may not have the technical expertise required to address specific security challenges related to IT infrastructure integration. While the CEO should be kept informed of significant security concerns, escalating the issue to the CEO may not be necessary at this stage unless there are broader strategic implications, or the risk poses an imminent threat to the organization. The CISO should first work with relevant stakeholders, including both IT teams, to assess and address the identified risk before considering escalation to senior leadership. The CISO should be responsible for owning and assessing the risk related to data confidentiality and access controls, as it falls within their domain of expertise and responsibility. Collaborating with the IT teams of both organizations is crucial because the merger involves integrating the IT infrastructures of both entities. By working together, they can assess the existing security measures, identify gaps or conflicts, and develop a unified approach to mitigate the risk effectively.

Answer 160

C is the correct answer. Justification Risk tolerance is the acceptable level of deviation from acceptable risk and is not directly affected by control objectives. Criticality is the importance to the business and is one of the considerations when control objectives are set in addition to potential impact, exposure, cost and feasibility of possible controls. However, criticality plays a lesser role in relationships between risk and control. Criticality is more a need for the business than a control to reduce risk for the environment. Risk appetite is the amount of risk, on a broad level, that an entity is willing to accept in pursuit of its mission. Control objectives are set so that controls can be designed on that basis. Sensitivity is the potential impact of unauthorized disclosure, which is one of the considerations in control objectives but is not a control itself. Sensitivity creates risk, which is weighed against the controls put in place to reduce that risk, but sensitivity is an identification marker or classification of data for a control and does not define acceptable risk.

Answer 161

A is the correct answer. Justification The application owner should be informed about any potential risk to make appropriate decisions. The users' manager is responsible for access to the application; however, the application owner is the primary contact in this case. Security would not be immediately informed of this risk unless determined by the application owner. The database administrator is responsible for revoking access if determined by the application owner.

Answer 162

C is the correct answer. Justification This is not the best approach, as the business manager is likely to be focused on getting the business done as opposed to managing the risk posed to the enterprise. The typical information security manager is focused on risk and may overestimate risk by considering worst-case scenarios rather than the most probable events. Executive management will be in the best position to consider the big picture and the trade-offs between security and functionality for the entire enterprise. There is no indication that the assessments are inadequate or defective in some way; therefore, repeating the exercise is not warranted.

Answer 163

C is the correct answer. Justification A risk owner is assigned for risk that exceeds the organization’s set risk appetite and risk tolerance levels. Considerations regarding risk appetite and risk tolerance do not influence the assignment of a specific owner to a risk. Asset ownership and custody shows relevance of the risk to the individual’s job functions. The level of impact associated with the potential risk of asset loss does not influence the selection of a risk owner, but it does influence the risk rating. A risk owner should be an individual whose job function is relevant to the risk and who has the authority to make decisions about the risk. Managing and reporting risk are among the risk owner’s main responsibilities, but associated skills are not the main criteria for why an individual is selected as the risk owner.

Answer 164

B is the correct answer. Justification Data loss prevention software ensures data is classified and confidential information cannot be leaked to unauthorized parties. It deals with data in transit and not data stored; therefore, it cannot protect the confidentiality of data in storage. Full-disk encryption ensures that data stored in a laptop cannot be accessed by third parties even if they remove the hard disk and attempt to install it in another computer. A workstation firewall can prevent malicious network connections to a device. It cannot protect the confidentiality of stored data. Antivirus software can protect a laptop against viruses by scanning operating system files. It does not protect data stored on hard disks from being accessed by malicious third parties.

Answer 165

D is the correct answer. Justification While the bring-your-own-device (BYOD) and acceptable use policies define the employees’ responsibilities concerning the device, the policy-based directive is not sufficient to minimize the risk of unauthorized access and data breaches. While cyber insurance can provide financial protection in the event of a data breach or other security incident, it does not address the underlying risk or prevent it from occurring. Delegating control ownership to the IT department alone may overlook the broader organizational implications of implementing a BYOD policy. While the IT department plays a crucial role in implementing technical controls and managing IT infrastructure, managing the risk associated with BYOD requires a multidisciplinary approach involving collaboration across different departments, including risk management, legal, HR, and compliance. Additionally, effective risk management requires involvement and oversight from senior leadership to ensure that risk is adequately addressed and aligned with organizational objectives. Implementing a BYOD policy introduces new risk related to unauthorized access and data breaches, which requires a comprehensive risk assessment and management approach. Collaborating with the chief risk officer (CRO) ensures that the risk associated with BYOD is evaluated holistically and in alignment with the organization’s overall risk management strategy.

Answer 166

B is the correct answer. Justification An external audit report is an attestation that an organization is conforming to certain requirements, but it does not address roles and responsibilities of third parties. A service level agreement clearly states which party is responsible for each aspect of a service and states the penalties/incentives for performance. A security policy is essential as it shows management’s intention with regard to outsourcing; however, it does not address roles and responsibilities. A memorandum of understanding is only a letter of intent; it does not address roles and responsibilities.

Answer 167

D is the correct answer. Justification In this case, the business process manager does not have the technical expertise to effectively implement, assess, monitor, manage, design, and modify (when needed) access control mechanisms. An information security manager can be consulted by the control owner for the given control implementation, design, and modification but typically does not perform routine control effectiveness activities. The board of directors can be risk owners of strategic risk, but they typically are not control owners. A control owner is responsible for ensuring that the control is implemented and is operating effectively and efficiently. Only technically capable personnel, such as an IT system manager, can best implement, assess, monitor, manage, design, and modify (when needed) access control mechanisms.

Answer 168

D is the correct answer. Justification The risk owner’s primary role is not to assess and evaluate risk, although risk owners may be involved during the risk assessment process. The risk owner’s main responsibilities are more closely related to decision-making about the management of the risk. The owner of a risk should also own any associated controls and be held accountable for ensuring the monitoring of their effectiveness. A risk owner’s main duty is not to oversee and measure the associated controls if there are individual control owners. The control owner is responsible for oversight and measurement of the controls to make sure they are effective. Control owners are responsible for adequacy of the control environment. Risk appetite and tolerance levels are determined and approved by executive management and not necessarily by risk owners. Risk owners must ensure that these levels are determined in order to select the most appropriate risk response. The risk owner is accountable for properly managing any given risk to an acceptable level. Therefore, the risk owner decides on which risk response options are selected, which controls are selected, and which resources are assigned. The risk owner also monitors risk and makes sure that it remains at an acceptable level.

Answer 169

B is the correct answer. Justification Introducing security at later stages can cause projects to exceed budgets and can create issues with project schedules and delivery dates, but these outcomes are generally avoided if security issues are assessed in feasibility. Project feasibility can be directly impacted by information security requirements and is the primary reason to introduce information security requirements at this stage. The cost of security must be factored into any business case that will support project feasibility, and sometimes the cost of doing something securely exceeds the benefits that the project is anticipated to produce. Project approval is a business decision that may be influenced by information security considerations, but they are not essential. Considering information security during the first stage will not ensure proper project classification.

Answer 170

C is the correct answer. Justification The information security manager’s role is to ensure that adequate safeguards are in place before the launch of the customer relationship management (CRM) system and to continually monitor the operation of the controls. The information security manager acts as the subject matter expert for all related issues. The risk and compliance function is the second line of defense; the manager’s role is to ensure that the business process owner is aware of the risk that exists before initial controls are put in place, that the residual risk is known after controls are put in place, and that the residual risk does not exceed the risk appetite set by the governing body of the organization. The business process owner is the first line of defense and primarily owns all the risk and controls affecting CRM system. The IT research team’s role is to develop feasible solutions; its members would not be appropriate owners of the risk associated with business solution implementations.

Answer 171

D is the correct answer. Justification Designating the responsibility solely to the research and development (R&D) department may lead to siloed decision-making and overlook other important aspects of risk management, such as security and compliance. Effective risk management requires involvement from multiple departments to ensure that all relevant risk is addressed. While outsourcing the development of artificial intelligence (AI) models to a specialized vendor may alleviate some resource burdens, it does not absolve the company from ultimate responsibility for the performance and security of AI algorithms. Effective risk management entails active involvement and oversight by internal stakeholders. While investing in training programs for software developers is important, effective risk management requires a holistic approach involving multiple departments. Allocating resources exclusively to R&D may neglect other critical aspects of risk management, such as compliance considerations. The implementation of a comprehensive review process for generated code snippets, involving both automated tools and manual reviews by experienced developers, ensures that the code produced by generative AI models meets coding standards and is free from potential security vulnerabilities, thus demonstrating effective risk and control ownership.

Answer 172

C is the correct answer. Justification Constraints must be determined to understand the limits of the review, but this is not the next step Approach must be defined after scope and constraints. Scope is defined after objectives are determined. Results are last after scope, constraints and approach.

Answer 173

D is the correct answer. Justification Control owners are not accountable for updating risk management policies. While control owners may monitor control performance, they are typically not responsible for monitoring and reporting on risk management processes. Approving risk treatment decisions is typically performed by other stakeholders within the risk management process, such as risk managers, risk analysts or executive management. Control owners are responsible for implementing and maintaining specific controls designed to mitigate identified risk. This includes ensuring that controls are effectively designed, implemented, and operated. It also includes overseeing their effectiveness and making necessary adjustments.

Answer 174

C is the correct answer. Justification While the head data scientist plays a pivotal role in the startup, especially concerning the effective use of data, risk evaluation and remediation decisions are more suited to the owner of the health data. The IT security manager of the healthcare organization would be involved in securing the IT infrastructure and providing control options, but the responsibility of decision-making on control options should primarily rest with the data owner. The owner of the sensitive health data used for this project is responsible for making the decisions on the controls used to remediate the associated risk. While the legal representative oversees the legalities of the collaboration, the main responsibility for control decision-making rests with the data owner.

Answer 175

B is the correct answer. Justification The head of IT may consult with the risk owner on exception approvals, but they would not approve the exception. The risk owner is accountable for the loss due to risk and, therefore, would be the proper person to approve exceptions to the control. The control owner is responsible for ensuring that the control is effective in managing risk at an acceptable level but may not be accountable for loss due to risk. The risk manager helps the business and IT in identifying and assessing risk and deciding risk response options but may not be accountable for loss due to risk.

Answer 176

A is the correct answer. Justification The establishment of a dedicated blockchain governance committee involving representatives from various departments ensures that different stakeholders are involved in decision-making processes related to blockchain adoption, thus promoting effective risk management and control ownership. Transferring the responsibility solely to the IT department might lead to siloed thinking and to overlooking important aspects such as legal, compliance, and operational risk associated with blockchain implementation. This approach does not promote effective risk and control ownership. While outsourcing blockchain infrastructure management to a third-party vendor may alleviate some operational risk, it doesn’t absolve the financial institution from ultimate responsibility for security and compliance. Effective risk management entails active involvement and oversight by internal stakeholders. While investing in blockchain training programs for IT staff is important, effective risk management requires a holistic approach involving multiple departments. Allocating resources exclusively to IT may neglect other critical aspects of blockchain governance, such as legal and compliance considerations.

Answer 177

C is the correct answer. Justification Application development and maintenance staff may not be accountable for loss due to breaches of application security. They are responsible for supporting and closing the issues. The risk manager is responsible for guiding risk owners in making risk-related decisions but despite having expertise in application testing may not be accountable for loss due to risk. A risk owner is a senior individual with the authority and budget necessary to work with the business function that owns the application and assumes accountability for loss due to risk that might impact IT services provided by the application. An independent expert is an external person and cannot be accountable for loss to the business.

Answer 178

C is the correct answer. Justification Identifying new risk is part of the risk owner’s and risk practitioner’s responsibilities. Control ownership does not play a role in the early identification of new risk. Effective assessment of controls depends on the control owner’s capabilities and the effectiveness of the control assessment tools and techniques. Having the same person as the control owner and the risk owner can improve assessment efficiency but not assessment effectiveness. Risk owners need regular feedback and conduct ongoing evaluation of control results from control owners to make risk-related decisions. If the risk owner also owns the controls, the feedback loop is shorter, and deficiencies can be addressed more quickly. Accurate reporting of risk changes depends on effective risk reporting channels, reporting techniques, and target audience requirements. Accurate reporting is not impacted by control ownership.

Answer 179

C is the correct answer. Justification Although this choice may not be possible, the information security manager can discuss and understand the reason for insisting on an unencrypted report and try to convince the regulatory authority. If the information security manager chooses to ignore the regulatory authority’s request (which may not be possible in many parts of the world), it is necessary that a comparative risk assessment be conducted. The information security manager should first assess the risk in sending the report to the regulatory authority without encryption. The information security manager can consider alternate communication channels that will address the risk and provide for the exception. The information security policy states that confidential information must be encrypted when sent to external entities. The information security manager’s role is to find a way within the policy to complete the task. The best way to do this is to initiate an exception.

Answer 180

B is the correct answer. Justification Information risk assessments mostly focus on an enterprise’s future risk. Although the risk assessment compares current controls against future and current risk, risk assessments cannot be conducted continuously. Key risk indicators (KRIs) focus on the current risk and serve as an early warning of a potential risk. Reporting KRIs to senior management would help them make decisions on current risk, such as adjusting or replacing the controls that are mitigating them. KRIs continuously alert senior management to make management risk decisions. Internal and external loss data show past information risk but not current risk. Risk scenario analysis data are based on future possibilities and do not accurately show the current state of risk.

Answer 181

C is the correct answer. Justification The extent of risk mitigation is a business decision, so any action taken to address or reduce risk must be based on input from the business. The extent of risk mitigation is based on policy, which is defined with input from the business. If a lack of compliance with standards creates a significant risk, the information security manager should assess possible consequences and advise appropriate managers to determine whether it is acceptable risk. It is generally useful to determine whether standards reflect the intent of policy, but the main purpose of policies is to address risk that might not be included in standards.

Answer 182

A is the correct answer. Justification The information security manager must consider the business requirements of the control and assess the risk of noncompliance. Information security cannot ignore issues related to operational efficiency. The business can decide to accept the risk. Changing the information security policies may not reduce the risk. Conducting an awareness session may be a good idea, but it may not resolve the issue in this situation.

Answer 183

D is the correct answer. Justification Identification of incidents is only one part of effective risk management. If impact is not limited to acceptable levels, the program is not effective. Merely identifying incidents through a risk assessment is insufficient to limit impact. While compliance is important, it is only one aspect of risk management. If impact is not limited to acceptable levels, the program is not effective. Demonstrating that a program is compliant is not a measure of the effectiveness of limiting impact. Identifying unmitigated vulnerabilities is insufficient without knowledge of potential threats, impacts and control measures to determine the potential effectiveness of the risk management program. The goal of risk management is to limit impact and minimize business disruptions. Each instance of a security incident that causes significant financial loss or business disruption is an indication of inadequate risk management.

Answer 184

C is the correct answer. Justification Network scanning only looks for open ports and services at the network level and not at a systems level. Password management is focused on enforcing the password policy for minimum password criteria. Ethical hacking is supervised hacking done to identify potential threats to a system or network. This helps to identify if unauthorized access or malicious attacks are possible. Application database monitoring focuses primarily on performance of the specific application and would not provide insight into the entire enterprise.

Answer 185

A is the correct answer. Justification The link of the risk to business objectives is the most important element that would be considered by senior management. Information security program metrics should be provided in the context of impact to business objectives. Risk tolerance is a baseline established by senior management, but the business objectives provide scope to risk management activities. Control objectives are an input for assessing risk.

Answer 186

A is the correct answer. Justification Quality assurance uses metrics as indicators to identify systemic problems in processes that may result in unacceptable levels of output quality. Because this monitoring is intended to be effectively continuous as a matter of statistical sampling, integrating information security with quality assurance helps to ensure that risk is addressed as a standard part of production processing. Procurement approves initial acquisitions, but it has no involvement in implementation or production monitoring. Compliance focuses on legal and regulatory requirements, which represent a subset of overall risk. The involvement of the project management office is typically limited to planning and implementation.

Answer 187

A is the correct answer. Justification Change management is the overall process to assess and control risk introduced by changes. It is involved in the greatest range of the system life cycle. Release management is the specific process to manage risk of production system deployment. Incident management is not directly relevant to life cycle stages. Configuration management is the specific process to manage risk associated with systems configuration, but change management addresses a broader range of risk.

Answer 188

B is the correct answer. Justification The elimination of risk is not possible. The key reason for performing risk management is that it is an essential part of management’s due diligence. Satisfying audit and regulatory requirements is of secondary importance. A risk management program may or may not increase the return on investment.

Answer 189

D is the correct answer. Justification The time and cost of performing a risk assessment is not an indicator of its effectiveness in discovering new risk. The scope and severity of new risk discovered is a useful indicator, but it is not as good a measure of effectiveness as the risk that is not uncovered and leads to a security incident. The potential impact of defined risk is a secondary measure that may be useful in determining the extent of remedial actions to consider. Incidents that result from unidentified risk are the best indicators of how well the risk assessment served to discover risk, thereby indicating effectiveness.

Answer 190

A is the correct answer. Justification By assessing threats and vulnerabilities during the change management process, changes in risk can be determined and a risk assessment can be updated incrementally. This keeps the risk assessment current without the need to complete a full reassessment. Information security should have notification processes in place to ensure awareness of changes that might impact security other than threat and vulnerability assessments. Policies should rarely require adjustment in response to changes in threats or vulnerabilities. While including an effective threat and vulnerability assessment may assist in maintaining compliance, it is not the primary reason for the change management process.

Answer 191

B is the correct answer. Justification The existing control (antivirus management console) is working effectively to identify the gaps, and it is alerting the relevant people. Given that not much is known about the enterprise acquiring the vendor, a risk reassessment is required to identify and manage any supply chain risk. Acquisition is considered a major change that would require risk reassessment. The reported incident would have been managed in keeping with the enterprise’s incident management process. The existing control (email filter) is working effectively to identify the gaps and alerting the relevant people.

Answer 192

B is the correct answer. Justification The assessment criteria are not relevant to defining risk management strategies. The risk management strategy must be designed to achieve organizational objectives and to provide adequate controls to limit risk to be consistent with the risk appetite. IT architecture complexity may pose a challenge to the risk assessment process but should not affect the risk management strategy directly. Disaster recovery plans are an element of the risk management strategy but are addressed by organizational objectives and risk appetite.

Answer 193

C is the correct answer. Justification Lead indicators analyze the existing level of compliance and predict future compliance levels based on the findings. This helps in decision-making, but predictions may change. Predictive analysis helps in determining lead indicators. Lag indicators provide information about the performance of controls after control execution. Noncompliance of controls indicates elevation in risk levels. Timely reporting of noncompliance helps risk owners in decision-making. Incident reports help in reporting noncompliance but they are useful only after risk has materialized.

Answer 194

B is the correct answer. Justification While customer awareness helps mitigate risk, this is insufficient on its own to control fraud risk. Implementing monitoring techniques, which will detect and deal with potential fraud cases, is the most effective way to deal with this risk. If the bank outsources its processing, the bank still retains liability. While it is an unlikely possibility to make the customer liable for losses, the bank needs to be proactive in managing risk.

Answer 195

A is the correct answer. Justification Assessing the risk of noncompliance will provide the information needed to determine the most effective remediation requirements. If awareness is adequate, training may not help and increased compliance enforcement may be indicated. A report may be warranted but will not directly address the issue that is normally a part of the information security manager’s responsibilities. Increased enforcement is not warranted if the problem is a lack of effective communication about security policy.

Answer 196

B is the correct answer. Justification A change affecting a security policy is not handled by an IT change process. Changes in the IT infrastructure may have an impact on existing risk. An information security manager must ensure that the proposed changes do not adversely affect the security posture. Rollback to a current state may cause a security risk event and is normally part of change management, but it is not the primary reason that security is involved in the review. The person who initiates a change has no effect on the person who reviews and authorizes an actual change.

Answer 197

D is the correct answer. Justification Vulnerability management is a component of risk management. However, a risk management program that does not reduce significant adverse impacts is not effective. Penetration testing, which is a technique for vulnerability assessment, measures the feasibility of systems compromise and evaluates any related consequences. However, unless significant adverse impact to the enterprise is reduced, a risk management program is ineffective. Gap analysis determines the gap between controls and controls objectives. However, unless identified gaps are addressed in ways that result in reduced impact to the enterprise, the risk management program is ineffective. Effective risk management serves to reduce the incidence of significant adverse impacts on an enterprise either by addressing threats, mitigating exposure, or reducing vulnerability or impact.

Answer 198

C is the correct answer. Justification Risk treatment is an element of the risk management process. Elements such as risk identification, risk communication and acceptance also need to be considered. Classification of assets is important but is an element of the risk management process and is not sufficient to ensure continuous improvement. A maturity model such as the capability maturity model (CMM) can be used to classify an enterprise as initial, repeatable, defined, managed or optimized. As a result, an enterprise can easily know where it falls and then start working to reach the optimized state. There are many benefits from integrating assurance functions. However, this is not a holistic approach because the best of assurance functions will be reactive if risk management does not cascade through the entire enterprise. Measures must be taken to ensure that all staff members, rather than only the assurance functions, are risk conscious.

Answer 199

D is the correct answer. Justification Key risk indicators (KRIs) usually signal developing risk but do not indicate what the actual risk is. This option is not a most essential attribute since KRIs are neither accurate nor reliable. KRIs typically do not provide quantitative metrics about risk. KRIs will not indicate that any particular action is required other than to investigate further. The most essential attribute is that a KRI should be predictive and indicate that a risk is developing or changing to show that investigation is needed to determine the nature and extent of a risk.

Answer 200

A is the correct answer. Justification Managers (i.e., risk manager, information security manager) need to be informed of this finding so they can take corrective actions related to missed critical and high vulnerabilities and inform senior management of the risk. Requesting a full vulnerability scan of the system may uncover problems with the scanning software, weaknesses in team processes and procedures, and misunderstandings in roles and responsibilities. However, management needs to be aware of the issue and determine the next steps. A meeting with the team leader may not be sufficient to address the risk as the problem may be with the manager, staff training, processes or other causes. Informing the system owner should occur, but it would not be the first step.

Answer 201

D is the correct answer. Justification Many applications that appear to be functionally similar may be remarkably dissimilar at the code implementation level. Even a newer version of the same software may have been entirely rewritten, and any software developed in-house is necessarily unique to the environment. Recompiling a legacy application is possible only when source code is available. It may not function properly if underlying libraries or coding standards have changed. Reverse engineering a legacy application is likely to cost significantly more than a vulnerability assessment and deriving the functionalities of the application is not the goal. Identifying vulnerabilities will allow an enterprise to determine what compensating controls may be needed to continue operating a legacy application where replacement is not an option. Vulnerability assessments are not necessarily comprehensive in all cases, but they are generally effective when planned properly.

Answer 202

C is the correct answer. Justification The security manager should assess the risk, but senior management should be immediately advised. It may be prudent to initiate an awareness campaign after sounding the alarm if awareness training is not current. Information about possible significant new risk from credible sources should be provided to management along with advice on steps that need to be taken to counter the threat. Monitoring activities should be increased after notifying management.

Answer 203

A is the correct answer. Justification Significant changes in employee turnover indicate that something of consequence is impacting the workforce, which deserves the attention of the information security manager. If many senior developers are leaving the research and development group, for instance, it may indicate that a competitor is attempting to obtain the enterprise’s development plans or proprietary technology. An increase in the number of packets being dropped may indicate a change in the threat environment, but there is no impact unless legitimate traffic is being impacted. Therefore, the number of packets dropped is not an effective key risk indicator (KRI). An increase in the number of viruses detected may indicate a change in the threat environment, but the increase in detected viruses also indicates that the threat is adequately countered by existing controls. Changes in reporting relationships come about as a result of intentional business decisions, so the reporting relationship of IT is not a KRI.

Answer 204

A is the correct answer. Justification Before any other action is taken, the security manager should ensure that the noncompliance identified by monitoring is not a false positive. The escalation to management should not occur until more is known about the situation, and even then only if it is outside the security manager’s scope to address the issue. Updating the risk register is one possible response to validated noncompliance. Key risk indicator threshold changes would occur only if subsequent investigation found them to be necessary.

Answer 205

B is the correct answer. Justification High flexibility and adaptability are commendable attributes but do not provide a consistent baseline for determination of significant deviations. Effective key risk indicators are the result of deviation from baselines. Consistent methodologies and practices establish baselines that represent the best attribute as they provide a stable point of reference for reporting progress. Robustness and resilience are commendable attributes, but they do not provide a consistent baseline for determination of significant deviations. The cost-benefit ratio is not a risk indicator.

Answer 206

C is the correct answer. Justification The fact that overall risk has been quantified does not necessarily indicate the existence of a successful risk management practice. Eliminating inherent risk is virtually impossible. A successful risk management practice reduces residual risk to acceptable levels. Although the tying of control risk to business may improve accountability, it is not as desirable as achieving acceptable residual risk levels.

Answer 207

D is the correct answer. Justification Changes in the effectiveness of security controls will require a review of the controls, not necessarily the standards. Changes in the roles and responsibilities of department heads will not require a change to security standards, which will be captured during risk review. Standards set the requirements for procedures, so a change in procedures is not likely to affect the standard. Security policies need to be reviewed regularly in order to ensure they appropriately address the enterprise’s security objectives. A review of a security standard is prompted by changes in external and internal risk factors that are captured during risk assessment.

Answer 208

B is the correct answer. Justification The business impact analysis report is a useful report primarily for future incident response and business continuity purposes but does not mitigate current risk. List of action items to mitigate risk is the most useful in presenting direct, actionable items to address organizational risk. Assigning risk is useful but does not by itself result in risk mitigation activities. Quantification of risk does not directly result in risk mitigation activities.

Answer 209

C is the correct answer. Justification Tree diagrams are useful for decision analysis. Venn diagrams show the connection between sets but are not useful in indicating status. Heat maps, sometimes referred to as stoplight charts, quickly and clearly show the current status of remediation efforts. Bar charts show relative size but are a less direct presentation approach to tracking status of remediation efforts.

Information Security Risk Management Flashcards

(233 cards)