CSIA Science Worksheet – The risk treatment option of applying

Question 1         

The risk treatment option of applying controls to reduce risk is known as:

Risk Modification or Mitigation

Risk Retention or Acceptance

Risk Avoidance or Elimination

Risk Sharing or Transfer

Question 2         

The risk treatment option of deliberately operating without applying one of the other treatment options available is known as

Risk Retention or Acceptance

Risk Avoidance or Elimination

Risk Modification or Mitigation

Risk Sharing or Transfer

Question 3         

A security policy must be so written that it can be understood by

The CEO

Its Target Audience

The Security Team

The CISO

Question 4         

These are created by various third-party organizations and are designed to provide a framework to assist organizations in building their information security program

Policies

Standards

Procedures

Laws

Question 5         

Residual risk is defined as

 

Risk that remains after controls are implemented

Risk from a 3rd party vendor

Risk that is harmless

The total risk that exists

Question 6         

Compliance is the act of conforming to:

Laws

All stated requirements

Contracts

Policies

Question 7         

The risk treatment option of reassigning accountability for a risk to another entity or organization is known as

Risk Sharing or Transfer

Risk Retention or Acceptance

Risk Modification or Mitigation

Risk Avoidance or Elimination

Question 8         

These exist to guide the processes of identifying, treating, and monitoring information security risks in an organization.

Security Operations Centers

Security Policies

Risk Management Frameworks

Threat Intelligence Feeds

Question 9         

Controls are implemented to:

Develop Processes

Change Policies

Mitigate Risks

Provide Data

Question 10       

__________ is a central repository where risks and risk treatments are stored and regularly reviewed.

Quantitative Assessment

Risk Registry

Qualitative Assessment

Risk Treatment Plan

Question 11       

If you were CISO of a company that primarily does business with the U.S. government and had to design an information security program which framework would be most appropriate?

HITRUST Common Security Framework (CSF)

NIST 800 series

ISO 27001

PCI DSS

Question 12       

What financial tool would a CISO use to ensure that the cost of security controls cannot exceed the value of the information or assets being protected?

Return on Investment (ROI)

Net Present Value (NPV)

Internal Rate of Return (IRR)

Cost Benefit Analysis (CBA)

Question 13       

Which of the following articles has the least impact on the development of an organization’s information security policies, standards, and procedures?

Best practices

 

Standards

Regulations

Laws

Question 14       

Governance, Risk, and _______ are the 3 things that account for nearly half of a CISO’s time.

Vendor Management

Compliance

Training

Audits

Question 15       

If a risk would cause $800,000 in damages and $200,000 in clean-up costs and the likelihood of the risk manifesting is 5%, what would be the Annual Loss Expectation?

$1 million

$800,000

$200,000

$50,000

Question 16       

The maturity of an organization influences governance which influences the governance of the information security program. What size company would be more likely to have a higher level of maturity?

Small

None of the listed choices are correct.

Large

Medium

Question 17       

How would you demonstrate an organization’s commitment to adhere to legal and regulatory requirements?

Implementing controls to mitigate risk.

Audit findings.

A properly written security policy.

Develop appropriate security procedures.

Question 18       

In the case of business leadership choosing an alternate risk treatment than what the CISO recommended, what position does the CISO take?

The CISO should support the decision and ensure the risk treatment is implemented.

The CISO should conduct another risk analysis to ensure the risk treatment recommended is the most appropriate.

The CISO should refuse to implement the alternate risk treatment

The CISO should shift from being an advisor to advocate for the recommended risk treatment.