Which of the following should be determined FIRST when a new security vulnerability is made public?

• A.Whether the affected technology is Internet-facing
• B.What mitigating controls are currently in place
• C.How pervasive the vulnerability is within the organization
• D.Whether the affected technology is used within the organization

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of GHT project. You are performing cost and benefit analysis of control. You come across the result that costs of specific controls exceed the benefits of mitigating a given risk. What is the BEST action would you choose in this scenario?

• A.The enterprise may apply the appropriate control anyway.
• B.The enterprise should adopt corrective control.
• C.The enterprise may choose to accept the risk rather than incur the cost of mitigation.
• D.The enterprise should exploit the risk.

Correct Answer: C

Explanation/Reference:
Explanation:
If the costs of specific controls or countermeasures (control overhead) exceed the benefits of mitigating a given risk the enterprise may choose to accept the risk rather than incur the cost of mitigation. This is done according to the principle of proportionality described in:
Generally accepted security systems principles (GASSP)

Generally accepted information security principles (GAISP)

Incorrect Answers:
A: When the cost of specific controls exceeds the benefits of mitigating a given risk, then controls are not applied, rather risk is being accepted.
B: As the cost of control exceeds the benefits of mitigating a given risk, hence no control should be applied.
Corrective control is a type of control and hence it should not be adopted.
D: The risk is being exploited when there is an opportunity, i.e., the risk is positive. But here in this case, negative risk exists as it needs mitigation. So, exploitation cannot be done.

Comment: *

Name: *

Email: *

Verification: *

An IT operations team implements disaster recovery controls based on decisions from application owners regarding the level of resiliency needed. Who is the risk owner in this scenario?

• A.Disaster recovery team lead
• B.IT operations manager
• C.Business resilience manager
• D.Application owner

Comment: *

Name: *

Email: *

Verification: *

Which of the following is MOST important for a risk practitioner to ensure once a risk action plan has been completed?

• A.The requirements have been achieved.
• B.The risk register has been updated.
• C.The risk owner has validated outcomes.
• D.The control objectives are mapped to risk objectives.

Comment: *

Name: *

Email: *

Verification: *

You have identified several risks in your project. You have opted for risk mitigation in order to respond to identified risk. Which of the following ensures that risk mitigation method that you have chosen is effective?

• A.Reduction in the frequency of a threat
• B.Minimization of inherent risk
• C.Reduction in the impact of a threat
• D.Minimization of residual risk

Comment: *

Name: *

Email: *

Verification: *