QUESTION: 17

You are undertaking a qualitative risk assessment of a likely security threat to an information system. What is the MAIN issue with this type of risk assessment?

These risk assessments are largely subjective and require agreement on rankings beforehand.
Dealing with statistical and other numeric data can often be hard to interpret.
There needs to be a large amount of previous data to "train" a qualitative risk methodology.
It requires the use of complex software tools to undertake this risk assessment.

Answer(s): D

Reveal Solution Next Question

QUESTION: 18

When calculating the risk associated with a vulnerability being exploited, how is this risk calculated?

Risk = Likelihood * Impact.
Risk = Likelihood / Impact.
Risk = Vulnerability / Threat.
Risk = Threat * Likelihood.

Answer(s): C

Reveal Solution Next Question

QUESTION: 19

Which of the following is an accepted strategic option for dealing with risk?

Correction.
Detection.
Forbearance.
Acceptance

Answer(s): A

Reveal Solution Next Question

QUESTION: 20

What Is the KEY purpose of appending security classification labels to information?

To provide guidance and instruction on implementing appropriate security controls to protect the information.
To comply with whatever mandatory security policy framework is in place within the geographical location in question.
To ensure that should the information be lost in transit, it can be returned to the originator using the correct protocols.
To make sure the correct colour-coding system is used when the information is ready for archive.

Answer(s): A

Reveal Solution Next Question

Free CISMP-V9 Exam Braindumps (page: 5)

QUESTION: 17

QUESTION: 18

QUESTION: 19

QUESTION: 20