Assessment and Evaluation Flashcards

In the classic risk formula, risk is most commonly expressed as a function of which three elements?

Answer: Threat, vulnerability, and consequence

Risk is generally assessed as the combination of threat likelihood, vulnerability to that threat, and the consequence or impact of loss.

A security manager calculates Annualized Loss Expectancy (ALE). Which formula is correct?

Answer: Single Loss Expectancy × Annualized Rate of Occurrence

ALE equals SLE multiplied by ARO, giving the expected annual monetary loss from a specific risk.

Which risk treatment option is being used when a company purchases insurance to cover potential theft losses?

Answer: Risk transfer

Insurance shifts the financial burden of a loss to a third party, which is risk transfer.

During a security survey, what is the primary purpose of the exit interview with facility management?

Answer: To present preliminary findings and clarify observations before the final report

The exit briefing allows the surveyor to share initial observations and correct misunderstandings before formal reporting.

Which type of risk assessment relies primarily on descriptive ratings such as high, medium, and low rather than dollar values?

Answer: Qualitative

Qualitative assessments use relative descriptive scales instead of precise numerical or monetary values.

The concept of 'criticality' in asset assessment refers to what?

Answer: The impact on the organization if the asset is lost or compromised

Criticality measures how severely the organization would be affected by the loss of an asset.

When is a security countermeasure generally considered cost-effective?

Answer: When its total cost is less than the reduction in expected loss it provides

A cost-effective countermeasure produces a loss reduction greater than its lifecycle cost.