Assignment
1. Why is a risk assessment valuable for an organization?
a. Helps protect assets
b. Helps plan employee vacation timing
c. Identifies future capital investments
d. Helps protect management
2. Which of the following is not a component of the risk assessment process?
a. Risk identification
b. Risk likelihood
c. Risk elimination
d. Risk prioritization
3. Which of the following is a type of risk assessment?
a. Monitoring
b. Quantity
c. Processing
d. Qualitative
4. What type of risk assessment uses monetary values to assess a risk?
a. Quantitative
b. Qualitative
c. Ongoing
d. Subjective
5. What type of risk assessment uses terms such as ALE, SLE, and ARO?
a. Delphi
b. Risk Matrix
c. Quantitative
d. Qualitative
6. You are analyzing a risk and have determined that the SLE is $1,500 and the ARO is 5. What is the ALE?
a. Unable to determine with information given
b. $300
c. $7,500
d. $90,000
7. A company issues laptop computers to 100 employees. The value of each laptop including hardware, software, and data is $1,000. On average, employees lose one laptop a month. What is the SLE?
a. 12
b. 100
c. $1,000
d. $12,000
8. A company issues laptop computers to 100 employees. The value of each laptop including hardware, software, and data is $1,000. On average, employees lose one laptop a month. What is the ARO?
a. 12
b. 100
c. $1,000
d. $12,000
9. A company issues laptop computers to 100 employees. The value of each laptop including hardware, software, and data is $1,000. On average, employees lose one laptop a month. Management determines that it can purchase hardware locks for a total of $1,000 and reduce the number of lost laptops to one per year. Should they purchase the locks?
a. Yes, because the savings is greater than the cost of the control.
b. Yes, because the cost of the control is greater than the savings.
c. No, because the savings is greater than the cost of the control.
d. No, because the cost of the control is greater than the savings.
10. Senior management has recently reviewed an RA but chose not to accept any of the recommendations. What risk management strategy are they using?
a. Risk mitigation
b. Profitability
c. Survivability
d. Risk acceptance
Scenario:
In order to help make better decisions regarding risk assessment data, senior management at YieldMore has requested quantitative information relating to key information technology (IT) assets.
Tasks:
You, as an employee of YieldMore, have been given a task of providing quantitative risk assessment information to senior management.
1. Estimate the value of at least five key IT assets in the organization.
2. Be sure you consider direct and indirect financial and business impact of the IT assets.
3. Calculate the single loss expectancy (SLE) of the IT assets. (For this exercise, you will need to estimate this value.)
4. Calculate the annual rate of occurrence (ARO) for risk associated with the IT assets. (For this exercise, you will need to estimate this value.)
5. Calculate the annual loss expectancy (ALE) of the IT assets.