1. What is the meaning of the CIA triad in Information Security?

2. What is the difference between Symmetric and Asymmetric Key Cryptography

3. What is SSL? What is SET? Which one is technically superior? Which one is the de-facto standard on commercial selling on the Internet?

4. Mention four advantages of Qualitative risk analysis

5. Mention four disadvantages of quantitative risk analysis

6. Define a safeguard....also known as ...................... or .........................

Define a threat

Define vulnerability

7. How do you calculate the total threat impact?

8. Give two examples of each of the following

Risk Avoidance

Risk Assurance

Risk Detection

Risk Recovery

9. What should be included in a risk analysis report? Be brief

10. Sketch the different tables for the following with one example row in each

Financial Loss table

Extent of legal implications table

Enterprise Embarrassment table

11. Sketch a Risk Analysis Matrix filled with a few suggested solutions

12. Which method(s) would you use for risk Analysis in the Military Base Network? Select your top two favorites. Explain why?

1- Vulnerability Analysis

2- Hazard Impact Analysis

3- Threat Analysis

4- Questionnaires

5- Single-time loss algorithm

13. What is the formula used for ALE? (Annualized loss expectancy or Exposure)

14. A company's premises have one chance in a million of being affected by flooding. A flood would cost the company $10 million.

What would be your budget for mitigating the effects of the flood?

Would you start stocking up sand bags in preparation of the flood?

15. A company has a chance 1 in 3,000 of being within ten miles of an earthquake epicenter measuring 5.0 on the Richter scale. The Earthquake will cause $60 million of loss.

What would be the budget for reducing or preventing that damage?

16. A company has one large router that ties all their network segments. If the router dies it will take one day to repair. There is 70% chance that failure will occur once every 24 months. The outage will cause 1000 people to be out of work for a day. The company estimates the loss of productivity to be $68,000

How much should you spend for router redundancy?

17. What is BS7799? What is ISO 17799?

18. What is the difference between the Red Book and the Orange book in US government and defense security

19. What is ITSEC?

20. What is The Common Criteria?

21. T or F In risk analysis, the value of an asset can be estimated by asking for the book value from the accountant

22. T or F Security policies usually have to be written in a policy document

23. T or F Cost Benefit analysis is probably the most important step in any risk analysis process

24. Give an example of risk avoidance

25. Give an example of risk acceptance