Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Every organization uses its information to support its business operations. When there are threats in the internal and external environments, they create the risk of information loss or damage. This course examines the design and construction of a risk management program, including policies and plans, to support the identification and treatment of risk to the organization’s information assets.
Q1. A properly organized risk management development project will involve _____.
Q2. In organizations where risk management was never formally done the framework team usually starts by _____.
Q3. When assembling the framework team, which of the following is correct?
Q1. A fundamental premise in Cybersecurity is that with enough effort you can get risk to zero.
Q2. _____ is the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.
Q3. The aggregation of risk _____ becomes the risk appetite for the organization.
Q1. The goals and objectives from senior management are used to first create the risk management _____ and eventually the RM plan.
Q2. The risk management policy, much like the enterprise information security policy, is a(n) _____ document that formalizes much of the intent of the governance group.
Q3. Which of these is NOT an element of risk management policy?
Q1. The risk management (RM) plan contains a _____ set of the steps to perform in the conduct of both the RM framework and the RM process, along with supporting information on who performs each step and how.
Q2. The RM Plan should begin with _____.
Q3. When it is complete, the risk management plan is reproduced and distributed to every employee in the organization.
Q1. In organizations where risk management was never formally done the framework team usually starts by _____.
Q2. _____ is the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.
Q3. The aggregation of risk _____ becomes the risk appetite for the organization.
Q4. A fundamental premise in Cybersecurity is that with enough effort you can get risk to zero.
Q5. The goals and objectives from senior management are used to first create the risk management _____ and eventually the RM plan.
Q6. The risk management policy, much like the enterprise information security policy, is a(n) _____ document that formalizes much of the intent of the governance group.
Q7. Which of these is NOT an element of risk management policy?
Q8. The document that contains the details of the implementation and conduct of the RM efforts is referred to as the risk management _____.
Q9. The risk management (RM) plan contains a _____ set of the steps to perform in the conduct of both the RM framework and the RM process, along with supporting information on who performs each step and how.
Q10. When it is complete, the risk management plan is reproduced and distributed to every employee in the organization.
Q1: At this time, there are _____ formal methods for evaluating risk management methodologies.
Q2. The size and the _____ of the organization will influence which methodology is chosen.
Q3. The International Organization for Standardization or ISO has two standards focusing on risk management. Which of these is NOT one of those standards?
Q1. Governance is the oversight responsibility of the organization’s first-line management and team supervisors.
Q2. The entire risk management program begins with _____.
Q3. Every organization follows a single standard risk management approach to make sure that they get what works best.
Q1. The organization may use a _____ in which only a piece of the RM process is initially implemented, such as the risk identification phase.
Q2. Performance measures are often used to collect data about the RM process and determine its success or failure.
Q3. The direct cutover is an approach to building a formal program to continuously review and improve any type of organizational effort.
Q1. Designing the risk management program means defining and specifying the detailed tasks to be performed by only the framework team.
Q2. Evaluating the risk to the organization’s key assets includes:
Q3. The four basic strategies to treat the risks for those assets include all of the following EXCEPT:
Q1. The size and the _____ of the organization will influence which methodology is chosen.
Q2. The International Organization for Standardization or ISO has two standards focusing on risk management. Which of these is NOT one of those standards?
Q3. The weighted table analysis relies on extremely complex mathematical functions.
Q4. Governance is the oversight responsibility of the organization’s first-line management and team supervisors.
Q5. The implementation of the RM processcould be based on one of the following traditional IT implementation methods EXCEPT:
Q6. The organization may use a _____ in which only a piece of the RM process is initially implemented, such as the risk identification phase.
Q7. The direct cutover is an approach to building a formal program to continuously review and improve any type of organizational effort.
Q8. Evaluating the risk to the organization’s key assets includes:
Q9. The four basic strategies to treat the risks for those assets include all of the following EXCEPT:
Q10. Designing the risk management program means defining and specifying the detailed tasks to be performed by only the framework team.
Q1. Risk identification begins with a process of self-examination, and the first step must be to _____.
Q2. The risk identification process begins with the prioritization of the information assets.
Q3. The more manageable approach to risk identification is to define an information asset as either media or “the sets, databases and other collections of data or information”.
Q1. The asset inventory should also identify the _____.
Q2. A data classification scheme should be developed (or reviewed, if already in place) that _____
Q3. At the end of the risk identification process, an organization should have _____.
Q1. Risk _____ assigns a risk rating or score to each specific vulnerability.
Q2. Likelihood as used in risk management is _____.
Q3. When valuing an asset, an approach that chooses from options of “Very Valuable”, “Valuable”, or “Not Valuable” would be considered as a _____ approach.
Q1. _____ is simply the comparison of the risk ratings to the organization’s risk appetite.
Q2. Each organization must establish a default risk threshold value based on their risk appetite statement.
Q3. Assets with vulnerabilities with assessed risk levels that are above the established risk threshold settings do not have to be addressed by the organization.
Q1. The risk identification process begins with the prioritization of the information assets.
Q2. The more manageable approach to risk identification is to define an information asset as either media or “the sets, databases and other collections of data or information”.
Q3. Very few organizations use asset inventory systems to keep track of their information assets.
Q4. A data classification scheme should be developed (or reviewed, if already in place) that _____
Q5. At the end of the risk identification process, an organization should have _____.
Q6. For most organizations, a simple classification scheme of public, internal, and confidential is usually sufficient.
Q7. Risk _____ assigns a risk rating or score to each specific vulnerability.
Q8. When valuing an asset, an approach that chooses from options of “Very Valuable”, “Valuable”, or “Not Valuable” would be considered as a _____ approach.
Q9. _____ is simply the comparison of the risk ratings to the organization’s risk appetite.
Q10. Risk entanglement comes from the obervations that solutions for one information asset never positively or negatively affect the level of risk in other information assets.
Q1. Applying controls and safeguards that eliminate or reduce the remaining uncontrolled risk is the strategy known as _____.
Q2. Understanding the consequences of choosing to leave an information asset’s vulnerability facing the current level of risk, but only after a formal evaluation and intentional acknowledgment of this decision is the strategy known as _____.
Q3. The point in time before a disruption or system outage to which business process data can be recovered after an outage, given the most recent backup copy of the data is called _____.
Q1. The risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards in an effort to change the likelihood of a successful attack on an information asset is known as the _____ strategy.
Q2. Outsourcing is a risk free way to acheive risk transference.
Q3. The common approaches given here to implement the mitigation risk treatment stargey include all of these EXCEPT:
Q1. The risk treatment strategy that is based on the organization’s intentional choice not to protect an asset is known as the _____ strategy.
Q2. The risk treatment strategy that is the decision to do nothing beyond the current level of protection to shield an information asset from risk and to accept the outcome from any resulting exploitation is known as the _____ strategy.
Q3. It is an acceptable response for an organization to plead ignorance and thus abdicate its legal responsibility to protect employees’ and customers’ information.
Q1. The goal of Cybersecurity is not to bring residual risk to zero;
rather, it is to _____.
Q2. After an information system is designed, the organization must determine whether the system has _____ that can be exploited
Q3. When a vulnerability (flaw or weakness) exists in an important asset—Implement security controls to increase the likelihood of a vulnerability being exploited.
Q1. Understanding the consequences of choosing to leave an information asset’s vulnerability facing the current level of risk, but only after a formal evaluation and intentional acknowledgment of this decision is the strategy known as _____.
Q2. _____ is a preparatory activity common to both CP and risk management. It helps the organization determine which business functions and information systems are the most critical to the success of the organization.
Q3. The point in time before a disruption or system outage to which business process data can be recovered after an outage, given the most recent backup copy of the data is called _____.
Q4. The risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards in an effort to change the likelihood of a successful attack on an information asset is known as the _____ strategy.
Q5. The risk treatment strategy that attempts to shift risk to other assets, processes, or organizations that may be accomplished by rethinking how services are offered, revising deployment models, outsourcing to other organizations, purchasing insurance, or implementing service contracts with providers is known as the _____ strategy.
Q6. Outsourcing is a risk free way to achieve risk transference.
Q7. Sometimes, the cost of protecting an asset outweighs its value and it may be too difficult or expensive to protect an asset.
Q8. Sometimes, the cost of protecting an asset outweighs its value and it may be too difficult or expensive to protect an asset.
Q9. To calculate a cost-benefit analysis on new controls, begin with _____ for which we would like to implement new controls.
Q10. When a vulnerability (flaw or weakness) exists in an important asset—Implement security controls to increase the likelihood of a vulnerability being exploited.
Q1. A properly organized risk management development project will involve _____.
Q2. In organizations where risk management was never formally done the framework team usually starts by _____.
Q3. When assembling the framework team, which of the following are correct?
Q4. _____ is the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.
Q5. The aggregation of risk _____ becomes the risk appetite for the organization.
Q6. A fundamental premise in Cybersecurity is that with enough effort you can get risk to zero.
Q7. The goals and objectives from senior management are used to first create the risk management _____ and eventually the risk management plan.
Q8. Which of these is NOT an element of a well-prepared risk management policy?
Q9. The document that contains the details of the implementation and conduct of the risk management efforts is referred to as the risk management _____.
Q10. The risk management (RM) plan contains a _____ set of the steps to perform in the conduct of both the RM framework and the RM process, along with supporting information on who performs each step and how.
Q11. The risk management plan should begin with _____.
Q12. When it is complete, the risk management plan is reproduced and distributed to every employee in the organization.
Q13. At this time, there are _____ formal methods for evaluating risk management methodologies.
Q14. The International Organization for Standardization or ISO has two standards focusing on risk management. Which of these is NOT one of those standards?
Q15. The entire risk management program begins with _____.
Q16. Every organization organization follows a standard risk management approach to make sure that they get what works best.
Q17. The implementation of the risk management process could be based on one of the following traditional IT implementation methods EXCEPT:
Q18. The organization may use a _____ in which only a piece of the risk management process is initially implemented, such as the risk identification phase.
Q19. The four basic strategies to treat the risks for those assets include all of the following EXCEPT:
Q20. Risk identification begins with a process of self-examination, and the first step must be to _____.
Q21. The risk identification process begins with the prioritization of the information assets.
Q22. The more manageable approach to risk identification is to define an information asset as either media or “the sets, databases and other collections of data or information”.
Q23. Very few organizations use asset inventory systems to keep track of their information assets.
Q24. The asset inventory should also identify the _____.
Q25. A data classification scheme should be developed (or reviewed, if already in place) that _____
Q26. At the end of the risk identification process, an organization should have _____.
Q27. For most organizations, a simple classification scheme of public, internal, and confidential is usually sufficient.
Q28. Risk _____ assigns a risk rating or score to each specific vulnerability.
Q29. Estimating risk is _____.
Q30. Likelihood as used in risk management is _____.
Q31. When valuing an asset, an approach that chooses from options of “Very Valuable”, “Valuable”, or “Not Valuable” would be considered as a _____ approach.
Q32. _____ is simply the comparison of the risk ratings to the organization’s risk appetite.
Q33. Each organization must establish a default risk threshold value based on their risk appetite statement.
Q34. Assets with vulnerabilities with assessed risk levels that are above the established risk threshold settings do not have to be addressed by the organization.
Q35. Risk entanglement comes from the observation that solutions for one information asset never positively or negatively affect the level of risk in other information assets.
Q36. As risk treatment begins, the organization has a list of information assets that have more risk than can be justified and needs to select an appropriate strategy to reduce risk further. Most organizations apply _____ strategies to assets with excessive residual risk.
Q37. Applying controls and safeguards that eliminate or reduce the remaining uncontrolled risk is the strategy known as _____.
Q38. Understanding the consequences of choosing to leave an information asset’s vulnerability facing the current level of risk, but only after a formal evaluation and intentional acknowledgment of this decision is the strategy known as _____.
Q39. _____ is a preparatory activity common to both CP and risk management. It helps the organization determine which business functions and information systems are the most critical to the success of the organization.
Q40. The point in time before a disruption or system outage to which business process data can be recovered after an outage, given the most recent backup copy of the data is called _____.
Q41. The risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards in an effort to change the likelihood of a successful attack on an information asset is known as the _____ strategy.
Q42. The risk treatment strategy that attempts to shift risk to other assets, processes, or organizations that may be accomplished by rethinking how services are offered, revising deployment models, outsourcing to other organizations, purchasing insurance, or implementing service contracts with providers is known as the _____ strategy.
Q43. The common approaches given here to implement the mitigation risk treatment strategy include all of these EXCEPT:
Q44. The risk treatment strategy that is based on the organization’s intentional choice not to protect an asset is known as the _____ strategy.
Q45. The risk treatment strategy that is the decision to do nothing beyond the current level of protection to shield an information asset from risk and to accept the outcome from any resulting exploitation is known as the _____ strategy.
Q46. Sometimes, the cost of protecting an asset outweighs its value and it may be too difficult or expensive to protect an asset.
Q47. It is an acceptable response for an organization to plead ignorance and thus abdicate its legal responsibility to protect employees’ and customers’ information.
Q48. the goal of Cybersecurity is not to bring residual risk to zero;
rather, it is to _____.
Q49. After an information system is designed, the organization must determine whether the system has _____ that can be exploited
Q50. To calculate a cost-benefit analysis on new controls, begin with _____ for which we would like to implement new controls.
I hope this A General Approach to Risk Management Coursera Quiz Answers would be useful for you to learn something new from this problem. If it helped you then don’t forget to bookmark our site for more Coding Solutions.
This Problem is intended for audiences of all experiences who are interested in learning about Data Science in a business context; there are no prerequisites.
Keep Learning!
More Coding Solutions >>