DSM1244(5) ESRM LIFECYCLE

Reorder

Reorder the following ESRM cycle

• identify assets

• identify risks

• mitigate risks

• improve

1

2

3

4

• 1
• 2
• 3
• 4

Multiple Choice

According to ISO, which is the most valued asset?

• physical

• human

• information

• reputation

Multiple Choice

Which best defines asset?

• anything with tangible and intangible value

• potential exposure and impact of risk

• incident monitoring and response

• security convergence

Reorder

Reorder the following asset identification and prioritisation.

• Find all assets

• Identify asset owner

• Find stakeholders involved

• Understand impact and asset's importance

1

2

3

4

• 1
• 2
• 3
• 4

Multiple Choice

The first step in the ESRM cycle is to identify assets.

• True

• False

Multiple Choice

Risk managers must be casual in asset discovery and investigation.

• True

• False

Multiple Choice

Risk managers cannot understand risks before understanding the assets that need protection.

• True

• False

Multiple Choice

Relationships built in company does not help in asset investigation.

• True

• False

Multiple Choice

An asset can only be owned by one person.

• True

• False

Multiple Choice

Stakeholders does not mean asset owner.

• True

• False

Multiple Choice

A building is a physical asset.

• True

• False

Multiple Choice

If an asset is compromised, the impact will cascade to business operations because assets are interdependent.

• True

• False

Categorize

Options (6)

Human

Physical

Environmental

Information

Brand

Reputation

Organize these assets into the right categories

Tangible

Intangible

Categorize

Options (10)

Brand

Contract

Customer

Intellectual property

Technology

Building

Cash

Equipment

Vehicles

Land

Organize these assets into the right categories

Tangible

Intangible

Multiple Choice

All types of assets are equally important to all departments due to same exposure and impact.

• True

• False

Multiple Choice

Which does not refer to assets identification?

• asset discovery

• continual review

• relationships with strategic partners

• casual identification

Multiple Choice

Tangible assets are valued quantitatively.

• True

• False

Multiple Choice

Failure to deliver replacement equipment on time disrupts business operations.

• True

• False

Match

Match the following tangible asset valuation

• based on purchase price

• based on market price

• difficulty in replacement

Cost method

Market value method

Complex tangible asset valuation

• Cost method

• Market value method

• Complex tangible asset valuation

Multiple Choice

Valuing tangible assets are harder than intangible assets.

• True

• False

Multiple Choice

Intangible asset valuation is through economic substitution.

• True

• False

Multiple Choice

The outcome of the asset valuation process is a figure.

• True

• False

Multiple Choice

Which is not considered in valuing intangible assets?

• Asset life

• Stakeholder identification

• influencing business function

• Listed in financial reports

Match

Match the following intangible asset valuation

• market price of similar asset

• future income value

• compiled cost such as development hours

Market method

Income method

Cost method

• Market method

• Income method

• Cost method

Multiple Choice

Which is not a risk prioritisation conflict?

• Different risk tolerance level depending on risk owner

• Risk owners have control over risk decision

• Person with no authority accept risk

• Personnel having legitimacy in risk

Multiple Choice

Which does NOT refer to risk identification?

• most impact

• no impact

• urgent mitigation

• within risk tolerance

Multiple Choice

Which does NOT refer to risk identification investigation?

• security incident history

• asset owner's concern

• risk registers

• conflicts in risk prioritisation

Multiple Choice

Risk assessment is only limited to security department.

• True

• False

Open Ended

Define risk triangle.

Multiple Choice

Some risk assessments are simple and straightforward.

• True

• False

Multiple Choice

All risks are visible and obvious.

• True

• False

Multiple Choice

Which is NOT a risk mitigation conflict?

• Owners cutting security implementation

• Different stakeholder opinions

• Stakeholders understanding risk

• Stakeholders deciding without authority

Multiple Choice

Which does NOT refer to risk mitigation?

• risk treatment

• identify risk

• take actions against risk

• lowering exposure and impact

Multiple Choice

Which is NOT a risk mitigation plan?

• daily business operations

• use locks and keys

• install network firewalls

• maintain access control

Multiple Choice

Only asset owner and risk stakeholder has final decision on treating security risk.

• True

• False

Multiple Choice

Conflicts are always avoidable.

• True

• False

Multiple Choice

Which does NOT refer to risk treatement?

• risk avoidance

• worsen the risk

• remove risk source

• changing likelihood of risk

Match

Match the following risk treatement options

• MARA invests in small enterprises knowing they have high risk.

• Operating store in high crime area.

• Purchasing fire accident insurance.

• EPF PJ building is is water resistant.

accept risk

stop risk

transfer risk

mitigate impact

• accept risk

• stop risk

• transfer risk

• mitigate impact

Match

Match the following incident response process concepts

• from harm incident

• from risk identification

• unforeseen threat in identification

• from previous risk tolerance

reactive response

proactive response

previously unknown risk

residual risk

• reactive response

• proactive response

• previously unknown risk

• residual risk

Match

Match the following root cause analysis concept

• analyse reactive proactive incident

• scanning environment for threats

• explaining factors accident

reactive investigation

proactive investigation

incident investigation

• reactive investigation

• proactive investigation

• incident investigation

Multiple Choice

Which does NOT refer to root cause analysis?

• understanding risk

• determine residual risk

• determine security risk

• risk mitigation

Multiple Choice

Which does not refer to root cause analysis?

• follow up questions

• prevention actions

• uncovering residual risk

• asset identification

Multiple Choice

Which does NOT refer to ongoing risk assessment?

• asset

• uncertainty

• threat

• impact