Core Concepts and Principles Flashcards

Which risk treatment option involves purchasing insurance to cover potential theft losses?

Answer: Risk transfer

Insurance shifts the financial impact of a loss to a third party, which is risk transfer.

A company decides not to open a branch in a high-crime area because protection costs exceed expected benefits. This is:

Answer: Risk avoidance

Avoidance eliminates exposure by not engaging in the risky activity at all.

In a security risk assessment, which step should normally come FIRST?

Answer: Identify and value assets

You must know what you are protecting and its value before analyzing threats and vulnerabilities.

Which term describes risk that remains after countermeasures have been applied?

Answer: Residual risk

Residual risk is what remains after controls are implemented and must be accepted or further treated.

Theft, fire, and natural disasters that offer only a chance of loss and no chance of gain are examples of what kind of risk?

Answer: Pure risk

Pure risk involves only the possibility of loss or no loss, which is the focus of security management.

A qualitative risk assessment typically expresses probability and impact as:

Answer: Descriptive ratings such as high, medium, low

Qualitative assessments use relative ratings rather than precise numerical values.

Annualized loss expectancy (ALE) is calculated as:

Answer: Single loss expectancy x annualized rate of occurrence

ALE multiplies the expected loss from one event by how many times per year it is expected to occur.