Test Flash Cards 1

Question 1

What is Enterprise Security Risk Management (ESRM)?

Answer 1

ESRM is a strategic approach to security management that ties an organization’s security practice to its overall strategy using globally accepted and established risk management principles.

Question 2

What is an asset owner?

Answer 2

The person directly responsible for successful operation of the asset. In ESRM, the asset owner is assigned responsibility for the risk to an asset.

Question 3

What are four ways to manage risk?

Answer 3

1. Eliminate
2. Reduce
3. Transfer
4. Accept

Question 4

What are the deciding factors between a qualitative or quantitative approach to a risk assessment?

Answer 4

The reliability and validity of the available data
The nature of the risk factors and if they are quantifiable
The target audience for the outputs

Question 5

What is risk tolerance?

Answer 5

The amount of uncertainty an organization is prepared to accept in total or more narrowly within a certain business unity, a particular risk category, or for a specific initiative.

Question 6

What four steps are included in the risk assessment process?

Answer 6

Asset identification, valuation, and characterization
Risk identification
Risk analysis
Risk evaluation

Question 7

What is terrorism?

Answer 7

Ac act of violence designed to achieve a political end

Question 8

What is a cost-benefit analysis

Answer 8

A method for evaluating and comparing the value and cost of risk treatment options

Question 9

What six things should be considered when assessing consequences?

Answer 9

1. Human cost
2. Financial cost
3. Image
4. Human rights impacts
5. Indirect impacts
6. Environmental impacts

Question 10

What are five benefits of liaison?

Answer 10

1. Leverage the resources of others
2. Share best practices and lessons learned
3. Collaborate on specific cases or incidents
4. More effectively address common issues
5. Share information, equipment, and facilities

Question 11

What is cost-effectiveness?

Answer 11

Producing good results for the money spent

Question 12

What is security awareness?

Answer 12

Consciousness of an existing security program, its relevance, and the effect of one’s behavior on reducing security risks

Question 13

What is a goal of a security awareness program?

Answer 13

To promote compliance wiht security policies and procedures, as well as provide timely communications and training to guide individual and organizational attitudes and behaviors

Question 14

What typically drives the decision to use a security consultant?

Answer 14

A specific problem, need, challenge, or goal

Question 15

What is a chief security officer?

Answer 15

A senior executive level function responsible for providing comprehensive integrated risk strategies to help protect an organization from a wide spectrum of threats

Question 16

ABC Corporation has a management style where managers and supervisors guide their employees toward achieving organizations objectives. The workers enjoy a higher workplace morale and are happy they work with management toward success. This style of management is known as
1. Autocratic
2. Laisse-Faire
3. Democratic
4. Employee driven

Answer 16

3. Democratic

Question 17

The Vision Statement is

Answer 17

A strategic vision describes management’s aspirations for the company’s future and the course and direction charted to achieve them
portrays a firm’s aspirations for it’s future

Question 18

The Mission Statement is

Answer 18

A statement of the companys long-term purpose that explains the overall reason the company exists
Describes the scope and purpose of its present business

Question 19

The Value Statement

Answer 19

Core beliefs, traits, and behavioral norms that the firm’s personnel are expected to display in conducting business and pursuing the strategic vision and mission

Question 20

A specific description of where the business will be in the long-term, that conveys a general understanding of the business, its culture, and its future goals. This concept is BEST referred to as:
1. A Mission Statement
2. A Vision Statement
3. A Strategic Plan
4. An Organizational Strategy

Answer 20

2. A Vision Statement

Question 21

This communicates business functionality and operational methods. It specifies a business types of products or services, level of quality, and other tangible aspects of the business and its plans. This is BEST referred to as:
1. A Mission Statement
2. A Vision Statement
3. A Strategic Plan
4. An Organizational Strategy

Answer 21

1. A Mission Statement

Question 22

Which of the following statements, BEST describes ISO industry standards
1. ISO is governmental organization
2. ISO standards address: training, employee competencies, products, processes, service & amp; quality control
3. ISO regulates, legislates, and enforces compliance to standards
4. ISO standards often become recognized as industry best practices and become market requirements

Answer 22

4. ISO standards often become recognized as industry best practices and become market requirements

Question 23

The Plan-Do-Check-Act (PDCA) cycle has a step where, one examines the solutions devised to address the problems. The point is to check whether the solutions are producing outcomes that are consistent with the plan. This step is referred to as which part of the cycle?
1. Plan
2. Do
3. Check
4. Act

Answer 23

3. Check

Question 24

The Plah-Do-Check-Act (PDCA) cycle has a step which looks at the planning analysis, then devises a solution, prioritizes the next steps, and develops a detailed action plan. This step is referred to as which part of the cycle?
1. Plan
2. Do
3. Check
4. Act

Answer 24

2. Do

Question 25

Enterprise Security Risk Management (ESRM) is

Answer 25

A strategic approach to security management that ties an organization's security practice to its overall strategy using globally accepted and established risk management principles. Connects all key elements of security risk with the organizations' assets, informing decision making by asset owners. Is scalable and dynamic, suitable for adoption by private or public sector organizations of any scope or size

Question 26

ESRM has three primary components

Answer 26

1. Context or ESRM - which includes organizational aspects that security professionals must understand to successfully adopt ESRM 2. The ESRM Cycle - is ESRMh's actual process of security risk management that emphasizes the importance of understanding assets 3. The foundation of ESRM, which includes organizational concepts that support the ESRM approach and maximize its impact

Question 27

The ESRMM has four processes -

Answer 27

1. Identify and prioritize assets 2. Identify and prioritize risks 3. Mitigate prioritized risks 4. Continuous improvement

Question 28

In ESRM, who owns the risk decisions for identified assets? 1. The security manager 2. The supervisors and managers 3. The asset owner 4. The employees and non-employees

Answer 28

3. Asset owner

Question 29

The process of assessing security-related risks from internal and external threats to an entity, its assets and personnel, is BEST described as a 1. Risk assessment 2. Vulnerability assessment 3. CARVER assessment 4. Security survey

Answer 29

1. Risk assessment

Question 30

ABC Inc. has a facility located near a river which in the past has been forced to cease operations due to a seasonal flood. A risk and vulnerability assessment revealed from historical investigation, on average, a flood occurs once every 20 years. Your assessment assigns a flood event probability rating of a .05. What type of measurement BEST describes this? 1. Hybrid 2. Qualitative 3. Quantitative 4. Subjective

Answer 30

3. Quantitative

Question 31

In the following formula, what does K equal? K= Cp+Ct+Cr+Ci-I 1. Return on Ivestment (ROI) 2. Cost of Loss (COL) 3. Avoided Cost of Loss (ACOL) 4. Incident Frequency Factor (IFF)

Answer 31

2. Cost of Loss

Question 32

A security weakness or practice that may facilitate or allow a threat to occur, defines which of the following? 1. Loss 2. Vulnerability 3. Risk 4. Criticality

Answer 32

2. Vulnerability

Question 33

Insurance coverage on an asset is considered the most common form of what type of risk management? 1. Risk Spreading 2. Risk Reduction 3. Risk Transfer 4. Risk Acceptance

Answer 33

3. Risk transfer

Question 34

ABC Inc decided to reduce the risk of theft by spreading valuable assets to various locations, while applying target hardening strategies and countermeasures. However, a risk of theft remains. This is referred to as which of the following? 1. Risk spreading 2. Residual risk 3. Reidual threat 4. Residual impact

Answer 34

2. Residual risk