CRM Risk Management & Security 2

Question 1

Which type of risk assessment methodology assigns numeric values to the likelihood and impact of threats to calculate an overall risk score?

Accepted Answer

Quantitative assessment

Answer

Quantitative risk assessment uses numeric values and formulas (such as ALE = ARO × SLE) to produce measurable risk scores.

Question 2

A records manager discovers that classified contracts are stored in an unlocked filing cabinet in a shared workspace. This situation primarily represents which category of risk?

Accepted Answer

Operational risk

Answer

Operational risk arises from failures in internal processes, people, or physical controls, such as inadequate physical security for records.

Question 3

Under NIST SP 800-60, what is the primary purpose of information type categorization?

Accepted Answer

To determine the appropriate security category for federal information systems

Answer

NIST SP 800-60 maps information types to security categories (confidentiality, integrity, availability) to guide federal information system security.

Question 4

Which control is specifically designed to limit the number of employees who can access highly sensitive personnel records?

Accepted Answer

Need-to-know access

Answer

Need-to-know access restricts record access to only those individuals whose job functions require it, reducing unauthorized disclosure risk.

Question 5

A records security plan should address which of the following to protect records during a declared disaster?

Accepted Answer

Vital records protection and off-site storage

Answer

Vital records protection, including duplication and off-site storage, ensures critical records survive disasters and support business continuity.

(CRM) Certified Records Management Practice Test

(CRM) Certified Records Management Practice Test

CRM Risk Management & Security 2