CISSP

Welcome to your Chapter 1 Security and Risk Management

Which term describes the method of identifying vulnerabilities and threats and assessing the possible damage to determine where to implement security safeguards?

Add description here!

A. Information management

B. Risk analysis

C. Countermeasure selection

D. Classification controls

Proper security management dictates separation of duties for all the following reasons except which one?

A. It reduces the possibility of fraud.

B. It reduces dependency on individual workers.

C. It reduces the need for personnel.

D. It provides integrity.

As a potential CISSP, you need to know common Request for Comments (RFCs) and National Institute of Standards and Technology (NIST) standards. One such RFC is 2196. This Internet Engineering Task Force (IETF) document provides basic guidance on security in a networked environment. What is the title of this document?

A. “Ethics and the Internet”

B. “Site Security Handbook”

C. “Cracking and Hacking TCP/IP”

D. “Security Policies and Procedures”

Mr. Hunting, your former college math teacher, hears that you are studying for your CISSP exam and asks if you know the formula for total risk. What is the correct response?

A. Annual Loss Expectancy (ALE) ∗ Vulnerability = Total Risk

B. Threat ∗ Vulnerability ∗ Asset Value (AV) = Total Risk

C. Residual Risk (RR)/AV ∗ Vulnerability = Total Risk

D. AV/RR = Total Risk

What document gives detailed instructions on how to perform specific operations, providing a step-by-step guide?

A. Guidelines

B. Policies

C. Procedures

D. Standards

Your CEO has hinted that security audits may be implemented next year. As a result, your director has become serious about performing some form of risk assessment. You are delegated the task of determining which type of risk assessment to perform. The director wants to learn more about the type of risk assessment that involves a team of internal business managers and technical staff. He does not want the assessment to place dollar amounts on identified risks. He wants the group to assign one of 26 common controls to each threat as it is identified. Which type of risk assessment does your manager want?

A. Delphi

B. Delegated

C. Quantitative

D. Facilitated Risk Assessment Process (FRAP)

You have just won a contract for a small software development firm, which has asked you to perform a risk analysis. The firm provided you information on previous incidents and has a list of the known environmental threats in the geographic area. The firm’s president believes that risk is something that can be eliminated. As a Information Security Professional, how should you respond to this statement?

A. Although it can be prohibitively expensive, risk can be eliminated.

B. Risk can be reduced, but cannot be eliminated.

C. A qualitative risk analysis can eliminate risk.

D. A quantitative risk assessment can eliminate risk.