Reading...
Play button
Play button
Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
10 Cards in this Set
- Front
- Back
|
Which of the following is not a compensating measure for access violations?
A. Backups B. Business continuity planning C. Insurance D. Security awareness |
Security awareness
|
|
|
Risk analysis is MOST useful when applied during which phase of the system development process?
A. Project identification B. Requirements definition C. System construction D. Implementation planning |
Project identification
|
|
|
Which one of the following is not one of the outcomes of a vulnerability analysis?
A. Quantative loss assessment B. Qualitative loss assessment C. Formal approval of BCP scope and initiation document D. Defining critical support areas |
Formal approval of BCP scope and initiation document
|
|
|
Which of the following is not a part of risk analysis?
A. Identify risks B. Quantify the impact of potential threats C. Provide an economic balance between the impact of the risk and the cost of the associated countermeasures D. Choose the best countermeasure |
Choose the best countermeasure
|
|
|
A new worm has been released on the Internet. After investigation, you have not been able to determine if you are at risk of
exposure. Management is concerned as they have heard that a number of their counterparts are being affected by the worm. How could you determine if you are at risk? A. Evaluate evolving environment. B. Contact your anti-virus vendor. C. Discuss threat with a peer in another organization. D. Wait for notification from an anti-virus vendor. |
Contact your anti-virus vendor.
|
|
|
When conducting a risk assessment, which one of the following is NOT an acceptable social engineering practice?
A. Shoulder surfing B. Misrepresentation C. Subversion D. Dumpster diving |
Subversion
|
|
|
Which one of the following risk analysis terms characterizes the absence or weakness of a risk-reducing safegaurd?
A. Threat B. Probability C. Vulnerability D. Loss expectancy |
Vulnerability
|
|
|
Risk is commonly expressed as a function of the
A. Systems vulnerabilities and the cost to mitigate. B. Types of countermeasures needed and the system's vulnerabilities. C. Likelihood that the harm will occur and its potential impact. D. Computer system-related assets and their costs. |
Likelihood that the harm will occur and its potential impact.
|
|
|
How should a risk be handled when the cost of the countermeasures outweighs the cost of the risk?
A. Reject the risk B. Perform another risk analysis C. Accept the risk D. Reduce the risk |
Accept the risk
|
|
|
Which of the following is an advantage of a qualitative over quantitative risk analysis?
A. It prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities. B. It provides specific quantifiable measurements of the magnitude of the impacts C. It makes cost-benefit analysis of recommended controls easier |
It prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities.
|
