CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISM—Certified Information Security Manager - Part 48
1. When performing a quantitative risk analysis, which of the following is MOST important to estimate the potential loss?
A) Evaluate productivity losses
B) Assess the impact of confidential data disclosure
C) Calculate the value of the information or asset
D) Measure the probability of occurrence of each threat
2. Before conducting a formal risk assessment of an organization's information resources, an information security manager should FIRST:
A) map the major threats to business objectives.
B) review available sources of risk information.
C) identify the value of the critical assets.
D) determine the financial impact if threats materialize.
3. The valuation of IT assets should be performed by:
A) an IT security manager.
B) an independent security consultant.
C) the chief financial officer (CFO).
D) the information owner.
4. The PRIMARY objective of a risk management program is to:
A) minimize inherent risk.
B) eliminate business risk.
C) implement effective controls.
D) minimize residual risk.
5. After completing a full IT risk assessment, who can BEST decide which mitigating controls should be implemented?
A) Senior management
B) Business manager
C) IT audit manager
D) Information security officer (ISO)
A) Evaluate productivity losses
B) Assess the impact of confidential data disclosure
C) Calculate the value of the information or asset
D) Measure the probability of occurrence of each threat
2. Before conducting a formal risk assessment of an organization's information resources, an information security manager should FIRST:
A) map the major threats to business objectives.
B) review available sources of risk information.
C) identify the value of the critical assets.
D) determine the financial impact if threats materialize.
3. The valuation of IT assets should be performed by:
A) an IT security manager.
B) an independent security consultant.
C) the chief financial officer (CFO).
D) the information owner.
4. The PRIMARY objective of a risk management program is to:
A) minimize inherent risk.
B) eliminate business risk.
C) implement effective controls.
D) minimize residual risk.
5. After completing a full IT risk assessment, who can BEST decide which mitigating controls should be implemented?
A) Senior management
B) Business manager
C) IT audit manager
D) Information security officer (ISO)
1. Right Answer: C
Explanation: Calculating the value of the information or asset is the first step in a risk analysis process to determine the impact to the organization, which is the ultimate goal.Determining how much productivity could be lost and how much it would cost is a step in the estimation of potential risk process. Knowing the impact if confidential information is disclosed is also a step in the estimation of potential risk. Measuring the probability of occurrence for each threat identified is a step in performing a threat analysis and therefore a partial answer.
2. Right Answer: A
Explanation: Risk mapping or a macro assessment of the major threats to the organization is a simple first step before performing a risk assessment. Compiling all available sources of risk information is part of the risk assessment. Choices C and D are also components of the risk assessment process, which are performed subsequent to the threats-business mapping.
3. Right Answer: D
Explanation: Information asset owners are in the best position to evaluate the value added by the IT asset under review within a business process, thanks to their deep knowledge of the business processes and of the functional IT requirements. An IT security manager is an expert of the IT risk assessment methodology and IT asset valuation mechanisms. However, the manager could not have a deep understanding of all the business processes of the firm. An IT security subject matter expert will take part of the process to identify threats and vulnerabilities and will collaborate with the business information asset owner to define the risk profile of the asset. A chief financial officer (CFO) will have an overall costs picture but not detailed enough to evaluate the value of each IT asset.
4. Right Answer: D
Explanation: The goal of a risk management program is to ensure that residual risk remains within manageable levels. Management of risk does not always require the removal of inherent risk nor is this always possible. A possible benefit of good risk management is to reduce insurance premiums, but this is not its primary intention.Effective controls are naturally a clear objective of a risk management program, but with the choices given, choice C is an incomplete answer.
5. Right Answer: B
Explanation: The business manager will be in the best position, based on the risk assessment and mitigation proposals. to decide which controls should/could be implemented, in line with the business strategy and with budget. Senior management will have to ensure that the business manager has a clear understanding of the risk assessed but in no case will be in a position to decide on specific controls. The IT audit manager will take part in the process to identify threats and vulnerabilities, and to make recommendations for mitigations. The information security officer (ISO) could make some decisions regarding implementation of controls. However, the business manager will have a broader business view and full control over the budget and, therefore, will be in a better position to make strategic decisions.
Explanation: Calculating the value of the information or asset is the first step in a risk analysis process to determine the impact to the organization, which is the ultimate goal.Determining how much productivity could be lost and how much it would cost is a step in the estimation of potential risk process. Knowing the impact if confidential information is disclosed is also a step in the estimation of potential risk. Measuring the probability of occurrence for each threat identified is a step in performing a threat analysis and therefore a partial answer.
2. Right Answer: A
Explanation: Risk mapping or a macro assessment of the major threats to the organization is a simple first step before performing a risk assessment. Compiling all available sources of risk information is part of the risk assessment. Choices C and D are also components of the risk assessment process, which are performed subsequent to the threats-business mapping.
3. Right Answer: D
Explanation: Information asset owners are in the best position to evaluate the value added by the IT asset under review within a business process, thanks to their deep knowledge of the business processes and of the functional IT requirements. An IT security manager is an expert of the IT risk assessment methodology and IT asset valuation mechanisms. However, the manager could not have a deep understanding of all the business processes of the firm. An IT security subject matter expert will take part of the process to identify threats and vulnerabilities and will collaborate with the business information asset owner to define the risk profile of the asset. A chief financial officer (CFO) will have an overall costs picture but not detailed enough to evaluate the value of each IT asset.
4. Right Answer: D
Explanation: The goal of a risk management program is to ensure that residual risk remains within manageable levels. Management of risk does not always require the removal of inherent risk nor is this always possible. A possible benefit of good risk management is to reduce insurance premiums, but this is not its primary intention.Effective controls are naturally a clear objective of a risk management program, but with the choices given, choice C is an incomplete answer.
5. Right Answer: B
Explanation: The business manager will be in the best position, based on the risk assessment and mitigation proposals. to decide which controls should/could be implemented, in line with the business strategy and with budget. Senior management will have to ensure that the business manager has a clear understanding of the risk assessed but in no case will be in a position to decide on specific controls. The IT audit manager will take part in the process to identify threats and vulnerabilities, and to make recommendations for mitigations. The information security officer (ISO) could make some decisions regarding implementation of controls. However, the business manager will have a broader business view and full control over the budget and, therefore, will be in a better position to make strategic decisions.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment