Security and Risk Management in a Digital Environment
1. Which one of the following properly defines risk?
A. Threat × Mitigation
B. Vulnerability × Controls
C. Controls − Residual risk
D. Threat × Vulnerability
2. Which one of the following properly defines total
risk?
A. Threat − Mitigation
B. Threat × Vulnerability × Asset value
C. Vulnerability − Controls
D. Vulnerability × Controls
3. The best bet is to reduce risk to a level that can be
accepted.
A. True
B. False
4. Which of the following are accurate pairings of
threat categories? (Select two.)
A. External and internal
B. Natural and supernatural
C. Intentional and accidental

D. Computer and user

5. A loss of client confidence or public trust is an
example of a loss of _______.
6. A _______ is used to reduce a vulnerability.
7. As long as a company is profitable, it does not
need to consider survivability.
A. True
B. False
8. What is the primary goal of an information security
program?
A. To eliminate losses related to employee
actions
B. To eliminate losses related to risk
C. To reduce losses related to residual risk
D. To reduce losses related to loss of
confidentiality, integrity, and availability
9. The _______ is an industry-recognized standard
list of common vulnerabilities.
10. Which of the following is a goal of risk
management?
A. To identify the correct cost balance between
risk and controls
B. To eliminate risk by implementing controls
C. To eliminate the loss associated with risk
D. To calculate value associated with residual risk
11. If the benefits outweigh the cost, a control is
implemented. Costs and benefits are identified by
completing a _______.
12. A company decides to reduce losses of a threat by purchasing insurance, which is known as risk
_______.
13. What can be done to manage risk? (Select three.)
A. Accept it
B. Transfer it
C. Avoid it
D. Migrate it
14. After controls to minimize risk in the environment
have been applied, what is the remaining risk
called?
A. Remaining risk
B. Mitigated risk
C. Managed risk
D. Residual risk
15. Who is ultimately responsible for losses resulting
from residual risk?
A. End users
B. Technical staff
C. Senior managers
D. Security personnel