Which of the following is not a compensating measure for access violations?

Risk analysis is MOST useful when applied during which phase of the system development
process?

Which one of the following is not one of the outcomes of a vulnerability analysis?

Which of the following is not a part of risk analysis?

A new worm has been released on the Internet. After investigation, you have not been able to
determine if you are at risk of exposure. Management is concerned as they have heard that a
number of their counterparts are being affected by the worm. How could you determine if you are
at risk?

When conducting a risk assessment, which one of the following is NOT an acceptable social
engineering practice?

Which one of the following risk analysis terms characterizes the absence or weakness of a riskreducing safegaurd?

Risk is commonly expressed as a function of the

How should a risk be handled when the cost of the countermeasures outweighs the cost of the
risk?

Which of the following is an advantage of a qualitative over quantitative risk analysis?