Practice Test GeeksISSAP - Information Systems Security Architecture Professional Practice Test
← All ISSAP Flashcard Decks

Risk Assessment and Analysis Flashcards

5 cards from real ISSAP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 5 Risk Assessment and Analysis flashcards as text

  1. What is the first step in the risk assessment process?

    Answer: Identifying assets and their value

    The initial step in any risk assessment process is to identify and categorize the assets that need protection, such as data, systems, and infrastructure. Understanding the value and criticality of these assets helps prioritize security efforts and determine the potential impact of a security incident.

  2. What is the primary purpose of a risk assessment?

    Answer: To identify and evaluate risks to inform decision-making

    The primary purpose of a risk assessment is to systematically identify potential threats and vulnerabilities, analyze the likelihood and impact of these risks, and then use this information to make informed decisions about risk treatment and mitigation strategies. It helps organizations understand their security posture.

  3. What is a residual risk?

    Answer: The risk remaining after implementing security measures

    Residual risk refers to the level of risk that remains after all planned and implemented security controls and mitigation strategies have been applied. It's the risk that an organization accepts because it cannot be entirely eliminated or the cost of further mitigation outweighs the benefit.

  4. Which of the following is used to determine the likelihood and impact of a risk?

    Answer: Quantitative analysis

    Both quantitative and qualitative analysis are used to determine the likelihood and impact of a risk. Qualitative analysis uses descriptive terms (e.g., high, medium, low) for impact and likelihood, while quantitative analysis assigns numerical values and probabilities, often leading to a monetary value of risk.

  5. What is a key component of risk analysis in cybersecurity?

    Answer: Determining threat sources and vulnerabilities

    A key component of risk analysis involves identifying potential threat sources (e.g., hackers, natural disasters) and the vulnerabilities within systems or processes that these threats could exploit. Understanding these elements is crucial for assessing the likelihood and potential impact of a security incident.