Risk Management 2

A gaming software start-up company does not employ penetration testing of its software. This is an example of:

• High tolerance of risk

• Noncompliance

• Irresponsibility

• Outsourcing

The categories of risk treatment are:

• Risk avoidance, risk transfer, risk mitigation, and risk acceptance

• Risk avoidance, risk transfer, and risk mitigation

• Risk avoidance, risk reduction, risk transfer, risk mitigation, and risk acceptance

• Risk avoidance, risk treatment, risk mitigation, and risk acceptance

• The protective measure reduces threat impact by more than 90 percent.

• The asset was required for realization of $500,000 in monthly revenue.

• The protective measure reduced threat probability by more than 90 percent.

A security steering committee empowered to make risk treatment decisions has chosen to accept a specific risk. What is the best course of action?

• Refer the risk to a qualified external security audit firm.

• Perform additional risk analysis to identify residual risk.

• Reopen the risk item for reconsideration after one year.

• Mark the risk item as permanently closed

The responsibilities of a control owner include all of the following, except

• Review the control.

• Audit the control.

• Document the control.

• Maintain records for the control.

Accountability for the outcome of accepted risk is known as:

• Risk acceptance

• Risk transfer

• Risk treatment

• Risk ownership

A risk committee has formally decided that a specific risk is to be mitigated through the enactment of a specific type of control. What has the committee done?

• Risk acceptance

• Risk treatment

• Redefined risk tolerance

• Redefined risk appetite

A risk committee has formally decided to mitigate a specific risk. Where should this decision be documented?

• Risk register

• Meeting minutes

• Risk charter

• Key risk indicator

A risk manager is contemplating risk treatment options for a particularly large risk that exceeds the organization’s stated risk tolerance. How should risk treatment proceed?

• The risk should be divided into smaller risks.

• The risk manager is empowered to make the risk treatment decision.

• The risk manager should escalate the decision to executive management.

• The risk should be put on hold.

A cybersecurity leader is recording a decision to accept a particular risk. What, if anything, should the cybersecurity leader do in regard to this accepted risk?

• Queue the accepted risk to be redeliberated in one year.

• Consider the risk to be accepted in perpetuity.

• Convert the accepted risk to a residual risk.

• Perform a risk analysis to confirm risk acceptance.