Search Header Logo
DSM1244(5) ESRM LIFECYCLE

DSM1244(5) ESRM LIFECYCLE

Assessment

Presentation

•

Social Studies

•

Professional Development

•

Practice Problem

•

Medium

Created by

Nur Fatima Aisya Jamil

Used 15+ times

FREE Resource

23 Slides • 43 Questions

1

media

2

Reorder

Reorder the following ESRM cycle

identify assets

identify risks

mitigate risks

improve

1
2
3
4

3

media

4

media

5

media

6

Multiple Choice

According to ISO, which is the most valued asset?

1

physical

2

human

3

information

4

reputation

7

Multiple Choice

Which best defines asset?

1

anything with tangible and intangible value

2

potential exposure and impact of risk

3

incident monitoring and response

4

security convergence

8

Reorder

Reorder the following asset identification and prioritisation.

Find all assets

Identify asset owner

Find stakeholders involved

Understand impact and asset's importance

1
2
3
4

9

Multiple Choice

The first step in the ESRM cycle is to identify assets.

1

True

2

False

10

Multiple Choice

Risk managers must be casual in asset discovery and investigation.

1

True

2

False

11

Multiple Choice

Risk managers cannot understand risks before understanding the assets that need protection.

1

True

2

False

12

Multiple Choice

Relationships built in company does not help in asset investigation.

1

True

2

False

13

Multiple Choice

An asset can only be owned by one person.

1

True

2

False

14

Multiple Choice

Stakeholders does not mean asset owner.

1

True

2

False

15

Multiple Choice

A building is a physical asset.

1

True

2

False

16

Multiple Choice

If an asset is compromised, the impact will cascade to business operations because assets are interdependent.

1

True

2

False

17

media

18

Categorize

Options (6)

Human

Physical

Environmental

Information

Brand

Reputation

Organize these assets into the right categories

Tangible
Intangible

19

Categorize

Options (10)

Brand

Contract

Customer

Intellectual property

Technology

Building

Cash

Equipment

Vehicles

Land

Organize these assets into the right categories

Tangible
Intangible

20

media

21

Multiple Choice

All types of assets are equally important to all departments due to same exposure and impact.

1

True

2

False

22

Multiple Choice

Which does not refer to assets identification?

1

asset discovery

2

continual review

3

relationships with strategic partners

4

casual identification

23

media

24

Multiple Choice

Tangible assets are valued quantitatively.

1

True

2

False

25

Multiple Choice

Failure to deliver replacement equipment on time disrupts business operations.

1

True

2

False

26

Match

Match the following tangible asset valuation

based on purchase price

based on market price

difficulty in replacement

Cost method

Market value method

Complex tangible asset valuation

27

media

28

Multiple Choice

Valuing tangible assets are harder than intangible assets.

1

True

2

False

29

Multiple Choice

Intangible asset valuation is through economic substitution.

1

True

2

False

30

Multiple Choice

The outcome of the asset valuation process is a figure.

1

True

2

False

31

Multiple Choice

Which is not considered in valuing intangible assets?

1

Asset life

2

Stakeholder identification

3

influencing business function

4

Listed in financial reports

32

Match

Match the following intangible asset valuation

market price of similar asset

future income value

compiled cost such as development hours

Market method

Income method

Cost method

33

media

34

media

35

media

36

Multiple Choice

Which is not a risk prioritisation conflict?

1

Different risk tolerance level depending on risk owner

2

Risk owners have control over risk decision

3

Person with no authority accept risk

4

Personnel having legitimacy in risk

37

Multiple Choice

Which does NOT refer to risk identification?

1

most impact

2

no impact

3

urgent mitigation

4

within risk tolerance

38

Multiple Choice

Which does NOT refer to risk identification investigation?

1

security incident history

2

asset owner's concern

3

risk registers

4

conflicts in risk prioritisation

39

Multiple Choice

Risk assessment is only limited to security department.

1

True

2

False

40

Open Ended

Define risk triangle.

41

Multiple Choice

Some risk assessments are simple and straightforward.

1

True

2

False

42

Multiple Choice

All risks are visible and obvious.

1

True

2

False

43

media

44

media

45

media

46

Multiple Choice

Which is NOT a risk mitigation conflict?

1

Owners cutting security implementation

2

Different stakeholder opinions

3

Stakeholders understanding risk

4

Stakeholders deciding without authority

47

Multiple Choice

Which does NOT refer to risk mitigation?

1

risk treatment

2

identify risk

3

take actions against risk

4

lowering exposure and impact

48

media

49

Multiple Choice

Which is NOT a risk mitigation plan?

1

daily business operations

2

use locks and keys

3

install network firewalls

4

maintain access control

50

Multiple Choice

Only asset owner and risk stakeholder has final decision on treating security risk.

1

True

2

False

51

Multiple Choice

Conflicts are always avoidable.

1

True

2

False

52

media

53

Multiple Choice

Which does NOT refer to risk treatement?

1

risk avoidance

2

worsen the risk

3

remove risk source

4

changing likelihood of risk

54

media

55

Match

Match the following risk treatement options

MARA invests in small enterprises knowing they have high risk.

Operating store in high crime area.

Purchasing fire accident insurance.

EPF PJ building is is water resistant.

accept risk

stop risk

transfer risk

mitigate impact

56

media

57

media

58

media

59

Match

Match the following incident response process concepts

from harm incident

from risk identification

unforeseen threat in identification

from previous risk tolerance

reactive response

proactive response

previously unknown risk

residual risk

60

media

61

Match

Match the following root cause analysis concept

analyse reactive proactive incident

scanning environment for threats

explaining factors accident

reactive investigation

proactive investigation

incident investigation

62

Multiple Choice

Which does NOT refer to root cause analysis?

1

understanding risk

2

determine residual risk

3

determine security risk

4

risk mitigation

63

media

64

Multiple Choice

Which does not refer to root cause analysis?

1

follow up questions

2

prevention actions

3

uncovering residual risk

4

asset identification

65

media

66

Multiple Choice

Which does NOT refer to ongoing risk assessment?

1

asset

2

uncertainty

3

threat

4

impact

media

Show answer

Auto Play

Slide 1 / 66

SLIDE