CYBR 5300 CH 5 Exam Questions with Correct Answers

CYBR 5300 CH 5 Exam Questions with Correct Answers 57. Risk _________ is the application of security mechanisms to reduce the risks to an organization's data and information systems. a. management b. control c. identification d. security - Answer-*b. control 58. The first phase of risk management is _________. a. risk identification b. design c. risk control d. risk evaluation - Answer-*a. risk identification 59. Risk _________ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility. a. benefit b. appetite c. acceptance d. avoidance - Answer-*b. appetite 60. _________ addresses are sometimes called electronic serial numbers or hardware addresses. a. HTTP b. IP c. DHCP d. MAC - Answer-*d. MAC 61. A(n) _________ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment. a. IP b. FCO c. CTO d. HTTP - Answer-*b. FCO 62. A(n) _________ is a formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it. a. security clearance scheme b. data recovery scheme c. risk management scheme d. data classification scheme - Answer-*d. data classification scheme 63. Federal agencies such as the NSA, FBI, and CIA use specialty classification schemes. For materials that are not considered "National Security Information," __________ data is the lowest-level classification. a. sensitive b. confidential c. unclassified d. public - Answer-*c. unclassified 64. A _________ assigns a status level to employees to designate the maximum level of classified data they may access. a. security clearance scheme b. data recovery scheme c. risk management scheme d. data classification scheme - Answer-*a. security clearance scheme 65. Management of classified data includes its storage and _________. a. distribution b. portability c. destruction d. All of the above - Answer-*d. All of the above 66. Some people search trash and recycling bins—a practice known as _________—to retrieve information that could embarrass a company or compromise information security. a. shoulder surfing b. dumpster diving c. pretexting d. corporate espionage - Answer-*b. dumpster diving 67. In a(n) __________, assets or threats can be prioritized by identifying criteria with differing levels of importance, assigning a score for each of the criteria, and then summing and ranking those scores. a. threat assessment b. risk management program c. weighted factor analysis d. data classification scheme - Answer-*c. weighted factor analysis 68. The calculation of the likelihood of an attack coupled with the attack frequency to determine the expected number of losses within a specified time range is called the __________. a. loss frequency b. annualized loss expectancy c. likelihood d. benefit of loss - Answer-*a. loss frequency 69. _________ equals the probability of a successful attack multiplied by the expected loss from a successful attack plus an element of uncertainty. a. Loss magnitude b. Risk c. Loss frequency d. Loss - Answer-*b. Risk