Unit 7 - Assessing Cybersecurity Risk

Risk management is the process of identifying, assessing, and handling threats.

• TRUE

• FALSE

Which of the following is NOT involved in the risk analysis process?

• Examining risks

• Identifying vulnerabilities

• Determining threats

• Identifying only technical vulnerabilities and threats

Which of the following is the first step in the risk analysis process?

• Taking stock of the system

• Mitigating risk

• Assessing probability of a risk

• Drafting a report of potential risks

Select all of the choices which should be considered when identifying potential threats.

• Malicious behavior

• Mitigation strategies currently in place

• Natural disasters

• System failure

Which of the following is a weakness which can be exploited by a threat to breach security and harm the system?

• Risk

• Vulnerability

• Threat

• Disaster

Which of following is an example of a technical control which could be put in place to minimize or eliminate the probability of a threat?

• Environmental mechanisms

• Administrative procedures

• Security policies

• Intrusion detection

Which of the following correctly defines a preventative control?

• A control which attempts to anticipate and stop an attack

• A control which deletes information

• A control which discovers an attack

• A control which creates predictive algorithms

All risks have the same likelihood of occurrence. (T or F)

• TRUE

• FALSE

Risk CANNOT be classified as which of the following categories?

• High

• Medium

• Low

• Avoidable

Which of the following best describes the method in which risk is calculated by multiplying the threat likelihood value by the impact value and then categorizing the risks as high, medium or low based on the value?

• Threat likelihood panel

• Risk-Level Matrix

• Vulnerability level

• Preventative control value