CNET251 - Ch 7 Treating Risk

An example of using the transference risk treatment strategy would be to outsource the security of an asset to another organization.

• True

• False

Asset valuation is the process of assigning financial value or worth to each information asset.

• True

• False

When is the acceptance risk treatment strategy NOT an acceptable approach?

• The cost of protecting an asset is more than the asset is worth

• The asset consists of employee and / or customer information

• The asset is considered expendable

• The asset has relatively little risk

Which risk treatment strategy approach can also be referred to as an avoidance strategy?

• Termination

• Acceptance

• Defense

• Transferal

Operational feasibility, which refers to user acceptance and support, as well as management acceptance and support, is also known as which of the following?

• organizational feasibility

• behavioral feasibility

• technical feasibility

• political feasibility

Which risk treatment strategy focuses on planning and preparation to reduce the damage caused by a realized incident or disaster?

• Mitigation

• Termination

• Transference

• Acceptance

Which risk management technique relies on a group evaluating, rating, and ranking assets?

• Delphi technique

• OCTAVE methods

• Microsoft's technique

• FAIR

Which of the following is NOT one of the three types of plans included in a mitigation risk treatment strategy?

• Incident response (IR) plan

• Disaster recovery (DR) plan

• Business continuity (BC) plan

• Risk control plan (RC)

What is the easiest way to calculate the cost-benefit analysis (CBA)?

• CBA = ALE(postcontrol) - ALE(precontrol) + ACS

• CBA = ALE(postcontrol) - ALE(precontrol) - ACS

• CBA = ACS(precontrol) - ALE(postcontrol) + ALE(precontrol)

• CBA = ALE(precontrol) - ALE(postcontrol) - ACS

Which of the following can be calculated using the values from an ARO multiplied by the values from an SLE?

• cost benefit analysis

• asset valuation

• annualized loss expectancy

• operational feasibility