Colorado Technical University

CSS 250

Practice Questions – SECURITY AND RISK MANAGEMENT
1. You have just won a contract for a small software development firm, which has asked you to
perform a risk analysis. The firm provided you information on previous incidents and has a list
of the known environmental threats in the geographic area. The firm’s president believes that
risk is something that can be eliminated. As a CISSP, how should you respond to this
statement?
A. Although it can be prohibitively expensive, risk can be eliminated.
B. Risk can be reduced, but cannot be eliminated.
C. A qualitative risk analysis can eliminate risk.
D. A quantitative risk assessment can eliminate risk.
Quick Answer: 33
Detailed Answer: 35
2. Which term describes the method of identifying vulnerabilities and threats and assessing the
possible damage to determine where to implement security safeguards?
A. Information management
B. Risk analysis
C. Countermeasure selection
D. Classification controls
Quick Answer: 33
Detailed Answer: 35
3. Proper security management dictates separation of duties for all the following reasons except
which one?
A. It reduces the possibility of fraud.
B. It reduces dependency on individual workers.
C. It reduces the need for personnel.
D. It provides integrity.
Quick Answer: 33
Detailed Answer: 35
4. As a potential CISSP, you need to know common Request for Comments (RFCs) and National
Institute of Standards and Technology (NIST) standards. One such RFC is 2196. This Internet
Engineering Task Force (IETF) document provides basic guidance on security in a networked
environment. What is the title of this document?
A. “Ethics and the Internet”
B. “Site Security Handbook”
C. “Cracking and Hacking TCP/IP”
D. “Security Policies and Procedures”
Quick Answer: 33
Detailed Answer: 35
5. Mr. Hunting, your former college math teacher, hears that you are studying for your
CISSP exam and asks if you know the formula for total risk. What is the correct response?
A. Annual Loss Expectancy (ALE) * Vulnerability = Total Risk
B. Threat * Vulnerability * Asset Value (AV) = Total Risk
C. Residual Risk (RR)/AV * Vulnerability = Total Risk
D. AV/RR = Total Risk
Quick Answer: 33
Detailed Answer: 35
6. What document gives detailed instructions on how to perform specific operations, providing a
step-by-step guide?
A. Guidelines
B. Policies
C. Procedures
D. Standards
Quick Answer: 33
Detailed Answer: 35
7. Your CEO has hinted that security audits may be implemented next year. As a result, your
director has become serious about performing some form of risk assessment. You are
delegated the task of determining which type of risk assessment to perform. The director
wants to learn more about the type of risk assessment that involves a team of internal
business managers and technical staff. He does