Module 22 CSEC

What is the primary goal of risk management?

• To eliminate all risks

• To reduce and maintain risk at an acceptable level

• To increase risk for competitive advantage

• To ignore potential risks

Which of the following is NOT a benefit of risk management?

• Focuses on potential risk impact areas

• Increases the effect of risk on revenue

• Improves the risk handling process

• Identifies suitable controls for security

What does risk management involve?

• Ignoring risks

• Identifying, assessing, and responding to risks

• Increasing risks for growth

• Avoiding all risks

Where does risk management have a prominent place?

• In the marketing department

• Throughout the system security life-cycle

• Only in financial sectors

• In personal life management

Who is responsible for designing the steps required for handling future risks in risk management?

• Chief Information Officer (CIO)

• System and Information Owners

• Senior Management

• IT Security Practitioners

Which role is responsible for IT planning, budgeting, and performance based on a risk management program?

• Business and Functional Managers

• Chief Information Officer (CIO)

• IT Security Program Managers

• Security Awareness Trainers

Who is responsible for implementing appropriate security controls to maintain confidentiality, integrity, and availability of an information system?

• IT Security Practitioners

• System and Information Owners

• Senior Management

• Business and Functional Managers

Which role is responsible for making trade-off decisions in the risk management process?

• IT Security Program Managers

• Business and Functional Managers

• Security Awareness Trainers

• Chief Information Officer (CIO)

Who is responsible for developing and providing appropriate training in the risk management process?

• IT Security Practitioners

• Security Awareness Trainers

• System and Information Owners

• Chief Information Officer (CIO)

What is a Key Risk Indicator (KRI)?

• A metric showing the risk appetite probability for an organization

• A tool for financial forecasting

• A measure of employee performance

• A type of insurance policy