Which of the following statements is NOT true regarding the risk management plan?

• A.The risk management plan is an output of the Plan Risk Management process.
• B.The risk management plan is an input to all the remaining risk-planning processes.
• C.The risk management plan includes a description of the risk responses and triggers.
• D.The risk management plan includes thresholds, scoring and interpretation methods, responsible parties, and budgets.
• E.Explanation:
  The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. The risk management plan does not include responses to risks or triggers. Responses to risks are documented in the risk register as part of the Plan Risk Responses process.

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of GHT project. You are performing cost and benefit analysis of control. You come across the result that costs of specific controls exceed the benefits of mitigating a given risk. What is the BEST action would you choose in this scenario?

• A.The enterprise may apply the appropriate control anyway.
• B.The enterprise should adopt corrective control.
• C.The enterprise may choose to accept the risk rather than incur the cost of mitigation.
• D.The enterprise should exploit the risk.
• E.Explanation:
  If the costs of specific controls or countermeasures (control overhead) exceed the benefits of
  mitigating a given risk the enterprise may choose to accept the risk rather than incur the cost of
  mitigation. This is done according to the principle of proportionality described in:
  Generally accepted security systems principles (GASSP)
  Generally accepted information security principles (GAISP)
• F.is incorrect. When the cost of specific controls exceed the benefits of mitigating a given
  risk, then controls are not applied, rather risk is being accepted.
• G.is incorrect. The risk is being exploited when there is an opportunity, i.e., the risk is
  positive. But here in this case, negative risk exists as it needs mitigation. So, exploitation cannot
  be done.

Comment: *

Name: *

Email: *

Verification: *

Which of the following would BEST help to ensure that suspicious network activity is identified?

• A.Analyzing server logs
• B.Coordinating events with appropriate agencies
• C.Analyzing intrusion detection system (IDS) logs
• D.Using a third-party monitoring provider

Comment: *

Name: *

Email: *

Verification: *

The MOST important consideration when selecting a control to mitigate an identified risk is whether:

• A.the control eliminates the risk
• B.there are sufficient internal resources to implement the control
• C.the cost of control exceeds the mitigation value
• D.the mitigation measures create compounding effects

Comment: *

Name: *

Email: *

Verification: *

Which of the following is MOST important when developing key risk indicators (KRIs)?

• A.Availability of qualitative data.
• B.Alignment with regulatory requirements.
• C.Property set thresholds.
• D.Alignment with industry benchmarks.

Comment: *

Name: *

Email: *

Verification: *