# Quiz ## Question 1 What is risk?
Solution The happening of an event is uncertain, with possibility to bring positive and/or negative impacts
## Question 2 In the lecture video 1.2, Prof. Dias mentioned that internal man-made threat is more serious than an external man-made threat. Why is it so?
Solution Internal man-made threat is relatively more difficult to be prevented as if a staff is intended to steal the digital assets which he / she is being granted with corresponding access rights to such digital assets according to his/her roles
## Question 3 When determine the risk level of an event, which two elements of such event should be assessed?
Solution “Impact” and “Probability”
## Question 4 When making decisions to mitigate a risk, which of the following statement is NOT correct?
Solution Risk can ultimately be eliminated by putting in the maximum level of controls
## Question 5 After the remaining risk is being transferred to third party after the completion of risk mitigation exercise, which of the following statement is correct?
Solution The same risk level remains, however the impact posses by the relevant event will be compensated by the third party
## Question 6 When is the best time to conduct risk re-evaluation against an activity?
Solution When any of these conditions happen, risk re-evaluation should be conducted
## Question 7 Which of the following is a detective control to address unauthorized network access?
Solution Reviewing of system access log regularly
## Question 8 Preventive controls could prevent a risk being realized. Should we only implement preventive controls?
Solution No – none of the preventive, detective and corrective controls could solely help to mitigate risk effectively, and not everything risk can be prevented or detected so implementing a combination of these types of controls would provide the best protection to the organisation
## Question 9 What is the control category of “data backup and restoration”?
Solution Both preventive and corrective
## Question 10 Your company is looking into the feasibility of building the data center near the coast and your supervisor would like you to conduct a risk assessment exercise. How would you get started?
Solution Use the risk matrix to calculate the impact and probability of the risk