CYBER SECURITY FINAL EXAM Questions with Correct Solutions
Question:
1. Risk Mangement
Answer:
the practice of identifying, evaluating and prioritizing risk followed by the application of
resources to minimize, monitor and control probability of the risk and/ or their business
impacts.
Question:
2. Cybersecurity Risk Management
Answer:
is a set of policies, processes, and controls to protect the organization's information assets
from security incidents.
Question:
3. Who leads Cybersecurity Risk Management?
Answer:
CIO CISO other IS managers
Question:
4. Risk Assessment
Answer:
1. Identify and analyze potential risk that may negatively impact an organization or its
stakeholders
2. make judgment on the acceptance or tolerability of the risks.
Question:
5. Framework for Risk Assessment
Answer:
Risk identification: vulnerability Risk estimation: level or severity Risk evaluation: business
impact
Question:
6. Risk Assessment Formula
Answer:
Cybersecurity risk=f(vulnerability, severity, impact)
,Question:
7. vulnerability
Answer:
is the likelihood of a cybersecurity incident
Question:
8. Severity
Answer:
the level of risk associated with the incident
Question:
9. Impact
Answer:
the business loss caused by the incident
Question:
10. National Cyber Incident Scoring System (NCISS)
Answer:
is designed to provide a repeatable and consistent mechanism for estimating the risk of an
incident.
Question:
11. Risk Treatment Strategies
Answer:
Risk Reduction (Defense and Mitigation) Risk transference Risk acceptance Risk termination
Question:
12. Defense (avoidance)
Answer:
attempts to prevent the exploitation of the vulnerability.
Question:
13. Mitigation
Answer:
is the treatment approach that focuses on planning and preparation to reduce the impact or
potential consequences of an incident or disaster.
, Question:
14. Common Defense Methods?
Answer:
Application of policy (e.g., ISP) Application of SETA programs Implementation of technology
Question:
15. 4 Mitigation Plans
Answer:
Business continuity (BC) plan Disaster recovery (DR) plan Incident response (IR) plan Crisis
Management (CM) plan
Question:
16. Business Continuity Plan
Answer:
a set of policies, tools and procedures, or plan, to enable an organization to continue the
delivery of goods and/or services at pre-defined acceptable levels following a disruptive
incident
Question:
17. Disasters Recovery
Answer:
a set of policies, tools and procedures to enable the recovery or continuation of vital
technology infrastructure and systems following a natural or human-induced disaster.
Question:
18. Incident Response
Answer:
is a set of policies, tools and procedures to dictate an organization's reactions to a
cybersecurity incident such as attack.
Question:
19. Crisis Management
Answer:
a set of policies, tools and procedures by which an organization deals with a disruptive and
unexpected event that threatens the organization or its stakeholders.
Question:
20. Transference
Question:
1. Risk Mangement
Answer:
the practice of identifying, evaluating and prioritizing risk followed by the application of
resources to minimize, monitor and control probability of the risk and/ or their business
impacts.
Question:
2. Cybersecurity Risk Management
Answer:
is a set of policies, processes, and controls to protect the organization's information assets
from security incidents.
Question:
3. Who leads Cybersecurity Risk Management?
Answer:
CIO CISO other IS managers
Question:
4. Risk Assessment
Answer:
1. Identify and analyze potential risk that may negatively impact an organization or its
stakeholders
2. make judgment on the acceptance or tolerability of the risks.
Question:
5. Framework for Risk Assessment
Answer:
Risk identification: vulnerability Risk estimation: level or severity Risk evaluation: business
impact
Question:
6. Risk Assessment Formula
Answer:
Cybersecurity risk=f(vulnerability, severity, impact)
,Question:
7. vulnerability
Answer:
is the likelihood of a cybersecurity incident
Question:
8. Severity
Answer:
the level of risk associated with the incident
Question:
9. Impact
Answer:
the business loss caused by the incident
Question:
10. National Cyber Incident Scoring System (NCISS)
Answer:
is designed to provide a repeatable and consistent mechanism for estimating the risk of an
incident.
Question:
11. Risk Treatment Strategies
Answer:
Risk Reduction (Defense and Mitigation) Risk transference Risk acceptance Risk termination
Question:
12. Defense (avoidance)
Answer:
attempts to prevent the exploitation of the vulnerability.
Question:
13. Mitigation
Answer:
is the treatment approach that focuses on planning and preparation to reduce the impact or
potential consequences of an incident or disaster.
, Question:
14. Common Defense Methods?
Answer:
Application of policy (e.g., ISP) Application of SETA programs Implementation of technology
Question:
15. 4 Mitigation Plans
Answer:
Business continuity (BC) plan Disaster recovery (DR) plan Incident response (IR) plan Crisis
Management (CM) plan
Question:
16. Business Continuity Plan
Answer:
a set of policies, tools and procedures, or plan, to enable an organization to continue the
delivery of goods and/or services at pre-defined acceptable levels following a disruptive
incident
Question:
17. Disasters Recovery
Answer:
a set of policies, tools and procedures to enable the recovery or continuation of vital
technology infrastructure and systems following a natural or human-induced disaster.
Question:
18. Incident Response
Answer:
is a set of policies, tools and procedures to dictate an organization's reactions to a
cybersecurity incident such as attack.
Question:
19. Crisis Management
Answer:
a set of policies, tools and procedures by which an organization deals with a disruptive and
unexpected event that threatens the organization or its stakeholders.
Question:
20. Transference
