InfoSec Chapter 6 - Risk Management

Only the InfoSec and IT communities have a role to play in the management of risks to information assets.

• True

• False

The evaluation and reaction to risk to the entire organization is known as which of the following?

• RM framework

• RM process

• Enterprise Risk Management (ERM)

• A. risk management policy

Which of the following is the first stage of the RM framework?

• Framework design

• Framework monitoring and review

• Continuous improvement

• Executive governance and support

What name is given to the relative executives who work together with the support of the CISO in developing and enabling the RM framework and its resulting process?

• governance group

• RM framework team

• risk management policy developers

• risk tolerance team

Which of the following framework implementation methods is considered the boldest method?

• desk check

• pilot test

• phased approach

• direct cutover

An evaluation of the threats to information assets?

• threat assessment

• risk analysis

• data classification scheme

• risk identification

In some corporate models, information assets can be categorized into which of the following groups?

• People, planning, technology

• Planning, performing, tasking

• Preparedness, planning, and technology

• People, process, and technology

Which term below defines the identification and assessment of risks for each vulnerability identified by an organization?

• Risk determination

• Risk analysis

• Risk identification

• Risk management

The overall rating, or numerical value, of the probability that a specific vulnerability will be exploited is known as which of the following?

• risk

• risk determination

• likelihood

• qualitative assessment

Which of the following terms best describes the state of having limited or imperfect knowledge of a situation, making it less likely the organization can successfully anticipate future events or outcomes?

• uncertainty

• risk determination

• likelihood

• risk appetite