ABCP BOARD EXAM 3 SCRIPT 2026
QUESTIONS AND SOLUTIONS
COMPREHENSIVE STUDY SHEET FULL
PRACTICE SET
◉ why conduct a cost-benefit analysis?
Answer: helps to quantify risks and risk tolerance to help determine
which risks are acceptable and at what level
◉ Risk factors are against physical assets, but also what?
Answer: information assets and financial assets (revenues lost for
duration of incident, costs to recover, fines/penalties, etc.)
◉ Mitigating controls does what to the threat?
Answer: reduces the effect
◉ What is a threat? How is risk calculated?
Answer: event/situation that would cause financial or operational
impact to an organization
the risk is calculated based on how likely the event is to occur
,◉ What are some ways to qualify and prioritize exposures/risks
identified?
Answer: 1. Identify alternative risk analysis methodologies
- qualitative/quantitative
- advantages/disadvantages
- reliability factors
- formulas
2. classify according to relevant criteria such as
- risks under organizations control
- risks beyond orgs control
- risks w prior warning
- risks w no warning
3. evaluate the impact of risks and exposures based on essential
factors
- availability of personnel /technology ect
◉ What is the formula for Annualized Loss Exposure (ALE) Risk?
Answer: ALE Risk = Frequency x Exposure
for example, frequency = 10x a year and exposure is loss of $1000
for department a and $200 for department b
,Risk = (10*1000) + (10*200)
ALE = $12,000
◉ What are the 3 main categories of protection for mitigating risks?
Answer: 1. Physical protection
- identify the requirements necessary to restrict access to all
pertinent levels (building, room)
2. Logical protection
- information backup and protection
- evaluate information security
3. Location of assets
- location relative to sources of risk
- personnel procedures
◉ What is the calculation for cost of prevention?
Answer: cost of prevention = probability of harm X the magnitude of
harm
◉ Once risks are identified, controls are in place, what is the next
step?
Answer: to evaluate the effectiveness of the controls
, ◉ What are examples of controls?
Answer: preventative controls (passwords, firewalls, smoke
detectors), reactive controls (hot sites)
preventative controls inhibit exposures while reactive controls
compensate for the impact of exposures
◉ identify controls, set up controls, evaluate effectiveness of the, and
then what?
Answer: document and present risk assessment to senior
management for approval
◉ what should you present to senior management when presenting
the risk assessment
Answer: - existing satisfactory controls
- recommendations for new controls
- recommendations for control improvements
- considerations for appropriate areas to transfer risk
- documentation of areas where management accepts risk
◉ What are the primary objectives of conducting a risk evaluation?
Answer: To understand the organization's exposure to loss and
evaluate the effectiveness of controls and safeguards
QUESTIONS AND SOLUTIONS
COMPREHENSIVE STUDY SHEET FULL
PRACTICE SET
◉ why conduct a cost-benefit analysis?
Answer: helps to quantify risks and risk tolerance to help determine
which risks are acceptable and at what level
◉ Risk factors are against physical assets, but also what?
Answer: information assets and financial assets (revenues lost for
duration of incident, costs to recover, fines/penalties, etc.)
◉ Mitigating controls does what to the threat?
Answer: reduces the effect
◉ What is a threat? How is risk calculated?
Answer: event/situation that would cause financial or operational
impact to an organization
the risk is calculated based on how likely the event is to occur
,◉ What are some ways to qualify and prioritize exposures/risks
identified?
Answer: 1. Identify alternative risk analysis methodologies
- qualitative/quantitative
- advantages/disadvantages
- reliability factors
- formulas
2. classify according to relevant criteria such as
- risks under organizations control
- risks beyond orgs control
- risks w prior warning
- risks w no warning
3. evaluate the impact of risks and exposures based on essential
factors
- availability of personnel /technology ect
◉ What is the formula for Annualized Loss Exposure (ALE) Risk?
Answer: ALE Risk = Frequency x Exposure
for example, frequency = 10x a year and exposure is loss of $1000
for department a and $200 for department b
,Risk = (10*1000) + (10*200)
ALE = $12,000
◉ What are the 3 main categories of protection for mitigating risks?
Answer: 1. Physical protection
- identify the requirements necessary to restrict access to all
pertinent levels (building, room)
2. Logical protection
- information backup and protection
- evaluate information security
3. Location of assets
- location relative to sources of risk
- personnel procedures
◉ What is the calculation for cost of prevention?
Answer: cost of prevention = probability of harm X the magnitude of
harm
◉ Once risks are identified, controls are in place, what is the next
step?
Answer: to evaluate the effectiveness of the controls
, ◉ What are examples of controls?
Answer: preventative controls (passwords, firewalls, smoke
detectors), reactive controls (hot sites)
preventative controls inhibit exposures while reactive controls
compensate for the impact of exposures
◉ identify controls, set up controls, evaluate effectiveness of the, and
then what?
Answer: document and present risk assessment to senior
management for approval
◉ what should you present to senior management when presenting
the risk assessment
Answer: - existing satisfactory controls
- recommendations for new controls
- recommendations for control improvements
- considerations for appropriate areas to transfer risk
- documentation of areas where management accepts risk
◉ What are the primary objectives of conducting a risk evaluation?
Answer: To understand the organization's exposure to loss and
evaluate the effectiveness of controls and safeguards
