1. Which of the following individuals is responsible for the final accreditation decision?

2. Which of the following acts promote a risk-based policy for cost effective security?

3. You are the project manager for TTP project. You are in the Identify Risks process. You
have to create the risk register. Which of the following are included in the risk register?

4. Which of the following acts is used to recognize the importance of information security
to the economic and national security interests of the United States?

5. Numerous information security standards promote good security practices and define
frameworks or systems to structure the analysis and design for managing information
security controls. Which of the following are the international information security
standards?

6. Which of the following processes is used to protect the data based on its secrecy,
sensitivity, or confidentiality?

7. Which of the following is NOT a phase of the security certification and accreditation
process?

8. Which of the following is NOT considered an environmental threat source?

9. A part of a project deals with the hardware work. As a project manager, you have
decided to hire a company to deal with all hardware work on the project. Which type of
risk response is this?

10. Management wants you to create a visual diagram of what resources will be utilized in
the project deliverables. What type of a chart is management asking you to create?

11. Which of the following is an entry in an object’s discretionary access control list
(DACL) that grants permissions to a user or group?

12. Adrian is the project manager of the NHP Project. In her project there are several work
packages that deal with electrical wiring. Rather than to manage the risk internally she
has decided to hire a vendor to complete all work packages that deal with the electrical
wiring. By removing the risk internally to a licensed electrician Adrian feels more
comfortable with project team being safe.
What type of risk response has Adrian used in this example?

13. Information risk management (IRM) is the process of identifying and assessing risk,
reducing it to an acceptable level, and implementing the right mechanisms to maintain
that level. What are the different categories of risk?
Each correct answer represents a complete solution. Choose all that apply.

14. Gary is the project manager of his organization. He is managing a project that is similar
to a project his organization completed recently. Gary has decided that he will use the
information from the past project to help him and the project team to identify the risks
that may be present in the project. Management agrees that this checklist approach is
ideal and will save time in the project. Which of the following statement is most
accurate about the limitations of the checklist analysis approach for Gary?

15. Which of the following recovery plans includes a monitoring process and triggers for
initiating planned actions?