After a security meeting, IT leaders decided that the organization will perform a completely new
risk analysis, as the previous one was done over five years ago. The methods that will be used is
FRAP. Which of the following best describes the FRAP method of risk analysis?

Your organization assigns an Annual Loss Expectancy to assets during a risk analysis meeting.
You have a server which if down for a day will lose the company $35,000, and has a serious root
access attack against it once per month. What is the ALE for this attack against this server?

Which of the following best describes the Repair Model?

Which of the following has the stages of Risk Analysis in order, from a to e?
a. Management
b. Threat Assessment
c. Control Evaluation
d. Inventory
e. Monitoring

You have just recently finished a complete Risk Analysis of your organization. During your
presentation you present the controls you feel must be implemented. Which is considered to be
the major factor in determining a specific control system to implement?