Module 5 - Risk Management - Q&A

Question 1

Which of the following could be considered the potential for harm to organizations, people, and information processing assets?
A. Likelihood
B. Impact
C. Vulnerabilities
D. Risk

Answer 1

D. Risk is the potential for harm to organizations, people, and information processing assets.

Question 2

Which of the following would be an example of an intangible asset?
A. Facility
B. Consumer confidence
C. Customer database
D. Computer system

Answer 2

B. Consumer confidence is an intangible asset, because it can’t be easily measured or physically touched.

Question 3

A \_\_\_\_\_\_\_\_\_\_ is a weakness inherent in an asset.
A. vulnerability
B. threat
C. risk
D. threat agent

Answer 3

A. A vulnerability is a weakness inherent to an asset.

Question 4

A disgruntled employee decides to steal data from an unprotected computer system within the company. Which of the following terms describes the employee as a risk element?
A. Threat
B. Threat agent
C. Vulnerability
D. Risk

Answer 4

B. In this scenario, the employee is a threat agent, because she is initiating a threat against an asset. The vulnerability here is that the system is unprotected.

Question 5

Which of the following is a negative event that can exploit a vulnerability?
A. Risk
B. Impact
C. Threat
D. Threat agent

Answer 5

C. A threat is a negative event that can exploit a vulnerability.

Question 6

The level of certainty that a negative event will occur and successfully affect the organization is called the \_\_\_\_\_\_\_\_\_\_.
A. likelihood
B. impact
C. risk
D. threat

Answer 6

A. Likelihood is the level of certainty that a negative event will occur and detrimentally affect the organization.

Question 7

Which of the following terms describes the level of harm that can result from a threat exploiting a vulnerability in an asset?
A. Threat
B. Likelihood
C. Impact
D. Damage

Answer 7

C. Impact describes the level of harm that can result from a threat exploiting a vulnerability in an asset.

Question 8

Which two factors, always paired together, are necessary for there to be risk for a given circumstance? (Choose two.)
A. Threat
B. Vulnerability
C. Threat agent
D. Asset

Answer 8

A, B. Threats and vulnerabilities are paired together, and without either, there can be no risk for a given circumstance.

Question 9

Your company is formulating its responses to the risks it has identified within the organization. Management has decided that for a particular risk, they will outsource certain processes and functions to a third-party provider to reduce the effect of the risk on your organization. Which of the following risk response options is your company using in this case?
A. Risk acceptance
B. Risk transference
C. Risk avoidance
D. Risk mitigation

Answer 9

B. Risk transference involves sharing risk with another party to reduce the effect the risk will have on your organization.

Question 10

Your company implements security controls to mitigate a particular risk scenario. Six months later, it reevaluates the risk and discovers that the controls it implemented are ineffective. What did the company fail to do that might have corrected this problem earlier?
A. Transfer risk
B. Accept risk
C. Avoid risk
D. Monitor risk

Answer 10

D. The company should have been monitoring the risk to determine whether the controls implemented to reduce it are effective.