Which of the following relations correctly describes residual risk?

Residual Risk = Threats x Vulnerability x Asset Value x Control Gap

Residual Risk = Threats x Vulnerability x Asset Gap x Control Gap

Residual Risk = Threats x Exploit x Asset Value x Control Gap

Residual Risk = Threats x Vulnerability x Asset Value x Control Gap

What is the objective of the Security Accreditation Decision task?

To determine whether the agency-level risk is acceptable or not.

To make an accreditation decision

To accredit the information system

You are the project manager for your organization. You are working with your key stakeholders in the qualitative risk analysis process. You understand that there is certain bias towards the risk events in the project that you need to address, manage, and ideally reduce. What solution does the PMBOK recommend to reduce the influence of bias during qualitative risk analysis?

Establish the definitions of the levels of probability and impact

Isolate the stakeholders by project phases to determine their risk bias

Involve all stakeholders to vote on the probability and impact of the risk events

Provide iterations of risk analysis for true reflection of a risk probability and impact

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the international information security standards? Each correct answer represents a complete solution.Choose all that apply.

Organization of information security

You are the project manager of the HJK Project for your organization. You and the project team have created risk responses for many of the risk events in the project. Where should you document the proposed responses and the current status of all identified risks?

Stakeholder management strategy

What approach can a project manager use to improve the project's performance during qualitative risk analysis?

Create a risk breakdown structure and delegate the risk analysis to the appropriate project team members.

Focus on near-term risks first.

Analyze as many risks as possible regardless of who initiated the risk event.

Which of the following is used in the practice of Information Assurance (IA) to define assurance requirements?

Classic information security model

Mary is the project manager of the HGH Project for her company. She and her project team have agreed that if the vendor is late by more than ten days they will cancel the order and hire the NBG Company to fulfill the order. The NBG Company can guarantee orders within three days, but the costs of their products are significantly more expensive than the current vendor. What type of a response strategy is this?

Internal risk management strategy

Which of the following individuals is responsible for monitoring the information system environment for factors that can negatively impact the security of the system and its accreditation?

Chief Information Security Officer

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?

Project contractual relationship with the vendor

Nancy is the project manager of the NHH project. She and the project team have identified a significant risk in the project during the qualitative risk analysis process. Bob is familiar with the technology that the risk is affecting and proposes to Nancy a solution to the risk event. Nancy tells Bob that she has noted his response, but the risk really needs to pass through the quantitative risk analysis process before creating responses. Bob disagrees and ensures Nancy that his response is most appropriate for the identified risk. Who is correct in this scenario?

Bob is correct. Not all risk events have to pass the quantitative risk analysis process to develop effective risk responses.

Bob is correct. Bob is familiar with the technology and the risk event so his response should be implemented.

Nancy is correct. Because Nancy is the project manager she can determine the correct procedures for risk analysis and risk responses. In addition, she has noted the risk response that Bob recommends.

Nancy is correct. All risks of significant probability and impact should pass the quantitative risk analysis process before risk responses are created.

Bob is correct. Not all risk events have to pass the quantitative risk analysis process to develop effective risk responses.

The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase?Each correct answer represents a complete solution. Choose all that apply.

Continue to review and refine the SSAA

The only output of the perform qualitative risk analysis are risk register updates. When the project manager updates the risk register he will need to include several pieces of information including all of the following except for which one?

Trends in qualitative risk analysis

Watchlist of low-priority risks

Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team is participating in risk reassessment in this project. What should Billy tell management if he's following the best practices for risk management?

At every status meeting the project team project risk management is an agenda item.

Project risk management happens at every milestone.

Project risk management has been concluded with the project planning.

Project risk management is scheduled for every month in the 18-month project.

ISC CAP Practice Test 5 - Free Online Exam Prep & Questions

Question 1 / 40

Which of the following formulas was developed by FIPS 199 for categorization of an information type?

SC information type = {(confidentiality, controls), (integrity, controls), (authentication, controls)}

SC information type = {(confidentiality, impact), (integrity, impact), (availability, impact)}

SC information type = {(confidentiality, risk), (integrity, risk), (availability, risk)}

SC information type = {(Authentication, impact), (integrity, impact), (availability, impact)}

Comment (0)

ISC CAP Practice Test 5

Question

ISC CAP Practice Tests

Practice Tests