CISSP Exam Preparation (Question 304)

(304) How should a risk be handled when the cost of the countermeasures outweighs the cost of the risk?

A. Reject the risk

B. Perform another risk analysis

C. Accept the risk

D. Reduce the risk

Correct Answer: C

Explanation

Explanation/Reference:

- Idham Azhari

CISSP Exam Preparation (Question 303)

(303) Risk is commonly expressed as a function of the

A. Systems vulnerabilities and the cost to mitigate.

B. Types of countermeasures needed and the system's vulnerabilities.

C. Likelihood that the harm will occur and its potential impact.

D. Computer system-related assets and their costs.

Correct Answer: C

Explanation

Explanation/Reference:

The likelihood of a threat agent taking advantage of a vulnerability. A risk is the loss potential, or probability, that a threat will exploit a vulnerability. - Shon Harris All-in-one CISSP Certification Guide pg 937

- Idham Azhari

CISSP Exam Preparation (Question 302)

(302) Which one of the following risk analysis terms characterizes the absence or weakness of a risk-reducing safegaurd?

A. Threat

B. Probability

C. Vulnerability

D. Loss expectancy

Correct Answer: C

Explanation

Explanation/Reference:

A weakness in system security procedures, system design, implementation, internal controls, and so on that could be exploited to violate system security policy. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 927

- Idham Azhari

CISSP Exam Preparation (Question 301)

(301) When conducting a risk assessment, which one of the following is NOT an acceptable social engineering practice?

A. Shoulder surfing

B. Misrepresentation

C. Subversion

D. Dumpster diving

Correct Answer: A

Explanation/Reference:

Explanation:

Shoulder Surfing: Attackers can thwart confidentiality mechanisms by network monitoring, shoulder surfing, stealing password files, and social engineering. These topics will be address more in-depth in later chapters, but shoulder surfing is when a person looks over another person's shoulder and watches keystrokes or data as it appears on the screen. Social engineering is tricking another person into sharing confidential information by posing as an authorized individual to that information. Shon Harris: CISSP Certification pg. 63. Shoulder surfing is not social engineering.

- Idham Azhari

CISSP Exam Preparation (Question 300)

(300) A new worm has been released on the Internet. After investigation, you have not been able to determine if you are at risk of exposure. Management is concerned as they have heard that a number of their counterparts are being affected by the worm. How could you determine if you are at risk?

A. Evaluate evolving environment.

B. Contact your anti-virus vendor.

C. Discuss threat with a peer in another organization.

D. Wait for notification from an anti-virus vendor.

Correct Answer: B

Explanation/Reference:

- Idham Azhari

CISSP Exam Preparation (Question 299)

(299) Which of the following is not a part of risk analysis?

A. Identify risks

B. Quantify the impact of potential threats

C. Provide an economic balance between the impact of the risk and the cost of the associated

countermeasures

D. Choose the best countermeasure

Correct Answer: D

Explanation/Reference:

- Idham Azhari

CISSP Exam Preparation (Question 298)

(298) Which one of the following is not one of the outcomes of a vulnerability analysis?

A. Quantative loss assessment

B. Qualitative loss assessment

C. Formal approval of BCP scope and initiation document

D. Defining critical support areas

Correct Answer: C

Explanation/Reference:

- Idham Azhari