Question 1

In which of the following phases does the SSAA maintenance take place?

Accepted Answer

A)  Phase 3 
B)  Phase 2 
C)  Phase 1 
D)  Phase 4 
A)  Phase 3 
B)  Phase 2 
C)  Phase 1 
D)  Phase 4

Question 2

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

Accepted Answer

A)  Safeguard 
B)  Single Loss Expectancy (SL
E)  
C)  Exposure Factor (EF) 
D)  Annualized Rate of Occurrence (ARO) 
A)  Safeguard 
B)  Single Loss Expectancy (SL
E)  
C)  Exposure Factor (EF) 
D)  Annualized Rate of Occurrence (ARO)

Question 3

You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed. How often should you and the project team do risk identification?

Accepted Answer

A)  At least once per month 
B)  Identify risks is an iterative process. 
C)  It depends on how many risks are initially identified. 
D)  Several times until the project moves into execution 
A)  At least once per month 
B)  Identify risks is an iterative process. 
C)  It depends on how many risks are initially identified. 
D)  Several times until the project moves into execution

Question 4

Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?

Accepted Answer

A)  The custodian implements the information classification scheme after the initial assignment by the operations manager. 
B)  The data custodian implements the information classification scheme after the initial assignment by the data owner. 
C)  The data owner implements the information classification scheme after the initial assignment by the custodian. 
D)  The custodian makes the initial information classification assignments, and the operations manager implements the scheme. 
A)  The custodian implements the information classification scheme after the initial assignment by the operations manager. 
B)  The data custodian implements the information classification scheme after the initial assignment by the data owner. 
C)  The data owner implements the information classification scheme after the initial assignment by the custodian. 
D)  The custodian makes the initial information classification assignments, and the operations manager implements the scheme.

Question 5

What approach can a project manager use to improve the project's performance during qualitative risk analysis?

Accepted Answer

A)  Create a risk breakdown structure and delegate the risk analysis to the appropriate project team members. 
B)  Focus on high-priority risks. 
C)  Focus on near-term risks first. 
D)  Analyze as many risks as possible regardless of who initiated the risk event. 
A)  Create a risk breakdown structure and delegate the risk analysis to the appropriate project team members. 
B)  Focus on high-priority risks. 
C)  Focus on near-term risks first. 
D)  Analyze as many risks as possible regardless of who initiated the risk event.

Question 6

Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

Accepted Answer

A)  They can be removed completely by taking proper actions. 
B)  They can be analyzed and measured by the risk analysis process. 
C)  They can be mitigated by reviewing and taking responsible actions based on possible risks. 
D)  They are considered an indicator of threats coupled with vulnerability. 
A)  They can be removed completely by taking proper actions. 
B)  They can be analyzed and measured by the risk analysis process. 
C)  They can be mitigated by reviewing and taking responsible actions based on possible risks. 
D)  They are considered an indicator of threats coupled with vulnerability.

Question 7

Risks with low ratings of probability and impact are included on a ____ for future monitoring.

Accepted Answer

A)  Watchlist 
B)  Risk alarm 
C)  Observation list 
D)  Risk register 
A)  Watchlist 
B)  Risk alarm 
C)  Observation list 
D)  Risk register

Question 8

Which of the following parts of BS 7799 covers risk analysis and management?

Accepted Answer

A)  Part 1 
B)  Part 3 
C)  Part 2 
D)  Part 4 
A)  Part 1 
B)  Part 3 
C)  Part 2 
D)  Part 4

Question 9

You are the project manager for your company and a new change request has been approved for your project. This change request, however, has introduced several new risks to the project. You have communicated these risk events and the project stakeholders understand the possible effects these risks could have on your project. You elect to create a mitigation response for the identified risk events. Where will you record the mitigation response?

Accepted Answer

A)  Risk register 
B)  Risk log 
C)  Risk management plan 
D)  Project management plan 
A)  Risk register 
B)  Risk log 
C)  Risk management plan 
D)  Project management plan

Question 10

You work as a project manager for BlueWell Inc. You are working with Nancy, the COO of your company, on several risks within the project. Nancy understands that through qualitative analysis you have identified 80 risks that have a low probability and low impact as the project is currently planned. Nancy's concern, however, is that the impact and probability of these risk events may change as conditions within the project may change. She would like to know where will you document and record these 80 risks that have low probability and low impact for future reference. What should you tell Nancy?

Accepted Answer

A)  Risk identification is an iterative process so any changes to the low probability and low impact risks will be reassessed throughout the project life cycle. 
B)  Risks with low probability and low impact are recorded in a watchlist for future monitoring. 
C)  All risks, regardless of their assessed impact and probability, are recorded in the risk log. 
D)  All risks are recorded in the risk management plan 
A)  Risk identification is an iterative process so any changes to the low probability and low impact risks will be reassessed throughout the project life cycle. 
B)  Risks with low probability and low impact are recorded in a watchlist for future monitoring. 
C)  All risks, regardless of their assessed impact and probability, are recorded in the risk log. 
D)  All risks are recorded in the risk management plan

Question 11

In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  Medium 
B)  High 
C)  Low 
D)  Moderate 
A)  Medium 
B)  High 
C)  Low 
D)  Moderate

Question 12

Diana is the project manager of the QPS project for her company. In this project Diana and the project team have identified a pure risk. Diana and the project team decided, along with the key stakeholders, to remove the pure risk from the project by changing the project plan altogether. What is a pure risk?

Accepted Answer

A)  It is a risk event that only has a negative side, such as loss of life or limb. 
B)  It is a risk event that cannot be avoided because of the order of the work. 
C)  It is a risk event that is created by a risk response. 
D)  It is a risk event that is generated due to errors or omission in the project work. 
A)  It is a risk event that only has a negative side, such as loss of life or limb. 
B)  It is a risk event that cannot be avoided because of the order of the work. 
C)  It is a risk event that is created by a risk response. 
D)  It is a risk event that is generated due to errors or omission in the project work.

Question 13

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&
A) . 
B)  An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&
A) . 
C)  An ISSE provides advice on the continuous monitoring of the information system. 
D)  An ISSO takes part in the development activities that are required to implement system ch anges. 
E)  An ISSE provides advice on the impacts of system changes. 
A)  An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&
A) . 
B)  An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&
A) . 
C)  An ISSE provides advice on the continuous monitoring of the information system. 
D)  An ISSO takes part in the development activities that are required to implement system ch anges. 
E)  An ISSE provides advice on the impacts of system changes.

Question 14

David is the project manager of HGF project for his company. David, the project team, and several key stakeholders have completed risk identification and are ready to move into qualitative risk analysis. Tracy, a project team member, does not understand why they need to complete qualitative risk analysis. Which one of the following is the best explanation for completing qualitative risk analysis?

Accepted Answer

A)  It is a rapid and cost-effective means of establishing priorities for the plan risk responses and lays the foundation for quantitative analysis. 
B)  It is a cost-effective means of establishing probability and impact for the project risks. 
C)  Qualitative risk analysis helps segment the project risks, create a risk breakdown structure, and create fast and accurate risk responses. 
D)  All risks must pass through quantitative risk analysis before qualitative risk analysis. 
A)  It is a rapid and cost-effective means of establishing priorities for the plan risk responses and lays the foundation for quantitative analysis. 
B)  It is a cost-effective means of establishing probability and impact for the project risks. 
C)  Qualitative risk analysis helps segment the project risks, create a risk breakdown structure, and create fast and accurate risk responses. 
D)  All risks must pass through quantitative risk analysis before qualitative risk analysis.

Question 15

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three.

Accepted Answer

A)  It preserves the internal and external consistency of information. 
B)  It prevents the unauthorized or unintentional modification of information by the authorized users. 
C)  It prevents the modification of information by the unauthorized users. 
D)  It prevents the intentional or unintentional unauthorized disclosure of a message's contents . 
A)  It preserves the internal and external consistency of information. 
B)  It prevents the unauthorized or unintentional modification of information by the authorized users. 
C)  It prevents the modification of information by the unauthorized users. 
D)  It prevents the intentional or unintentional unauthorized disclosure of a message's contents .

Question 16

Harry is the project manager of the MMQ Construction Project. In this project Harry has identified a supplier who can create stained glass windows for 1,000 window units in the construction project. The supplier is an artist who works by himself, but creates windows for several companies throughout the United States. Management reviews the proposal to use this supplier and while they agree that the supplier is talented, they do not think the artist can fulfill the 1,000 window units in time for the project's deadline. Management asked Harry to find a supplier who will guarantee the completion of the windows by the needed date in the schedule. What risk response has management asked Harry to implement?

Accepted Answer

A)  Mitigation 
B)  Acceptance 
C)  Transference 
D)  Avoidance 
A)  Mitigation 
B)  Acceptance 
C)  Transference 
D)  Avoidance

Question 17

A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk response is this?

Accepted Answer

A)  Avoidance 
B)  Mitigation 
C)  Exploit 
D)  Transference 
A)  Avoidance 
B)  Mitigation 
C)  Exploit 
D)  Transference

Question 18

What does RTM stand for?

Accepted Answer

A)  Resource Testing Method 
B)  Replaced Traceability Matrix 
C)  Requirements Traceability Matrix 
D)  Resource Tracking Matrix 
A)  Resource Testing Method 
B)  Replaced Traceability Matrix 
C)  Requirements Traceability Matrix 
D)  Resource Tracking Matrix

Question 19

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

Accepted Answer

A)  Security law 
B)  Privacy law 
C)  Copyright law 
D)  Trademark law 
A)  Security law 
B)  Privacy law 
C)  Copyright law 
D)  Trademark law

Question 20

A project team member has just identified a new project risk. The risk event is determined to have significant impact but a low probability in the project. Should the risk event happen it'll cause the project to be delayed by three weeks, which will cause new risk in the project. What should the project manager do with the risk event?

Accepted Answer

A)  Add the identified risk to a quality control management control chart. 
B)  Add the identified risk to the risk register. 
C)  Add the identified risk to the issues log. 
D)  Add the identified risk to the low-level risk watchlist. 
A)  Add the identified risk to a quality control management control chart. 
B)  Add the identified risk to the risk register. 
C)  Add the identified risk to the issues log. 
D)  Add the identified risk to the low-level risk watchlist.

In which of the following phases does the SSAA maintenance take place?

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed. How often should you and the project team do risk identification?

Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?

What approach can a project manager use to improve the project's performance during qualitative risk analysis?

Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

Risks with low ratings of probability and impact are included on a ____ for future monitoring.

Which of the following parts of BS 7799 covers risk analysis and management?

In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represents a complete solution. Choose all that apply.

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three.

A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk response is this?

What does RTM stand for?

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

Certified Cloud Security Professional (CCSP)

Certified Information Systems Security Professional

Filters

Exam 1: Certified Authorization Professional

In which of the following phases does the SSAA maintenance take place?

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed. How often should you and the project team do risk identification?

Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?

What approach can a project manager use to improve the project's performance during qualitative risk analysis?

Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

Risks with low ratings of probability and impact are included on a ____ for future monitoring.

Which of the following parts of BS 7799 covers risk analysis and management?

In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represents a complete solution. Choose all that apply.

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three.

A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk response is this?

What does RTM stand for?

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

Certified Cloud Security Professional (CCSP)

Certified Information Systems Security Professional

Filters