COSC 4361 Chapter 7

1. Risks can be avoided by countering the threats facing an asset or by eliminating the exposure of an asset.

• True
• False

2. The defense risk control strategy may be accomplished by outsourcing to other organizations.

• True
• False

3. The criterion most commonly used when evaluating a strategy to implement InfoSec controls and safeguards is economic feasibility.

• True
• False

4. Unlike other risk management frameworks, FAIR relies on the qualitative assessment of many risk components using scales with value ranges.

• True
• False

5. The ISO 27005 Standard for InfoSec Risk Management includes a five-stage management methodology; among them are risk treatment and risk communication.

• True
• False

6. The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards is the protect risk control strategy, also known as the avoidance strategy.

• True
• False - defense

7. A benchmark is derived by comparing measured actual performance against established standards for the measured category.

• True
• False - baseline

8. A benchmark is derived by comparing measured actual performance against established standards for the measured category.

• True
• False

9. The risk control strategy that attempts to shift risk to other assets, other processes, or other organizations is known as the defense risk control strategy.

• True
• False - transference

10. An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources, which include hardware, software, networking, and personnel is known as operational feasibility.

• True
• False - technical