Review questions

1. Which of the following frameworks is primarily used for quantitative risk management?
   1. NIST 800-30
   2. FAIR
   3. ISO 27001
   4. ISO 27005
2. A top-down risk assessment starts from the __.
   1. Team
   2. Individual
   3. Organization
   4. Department
3. A bottom-up risk assessment starts from the __.
   1. Team
   2. Individual
   3. Organization
   4. Department
4. Which of the following is NOT true about qualitative risk management?
   1. Less expensive
   2. Subjective
   3. Requires complex computation
   4. Focused on severity
5. Which of the following NIST frameworks provides guidance for supply chain management?
   1. 800-161
   2. 800-30
   3. 800-57
   4. 27001
6. Which of the following risk assessment techniques provides the results of a risk assessment by displaying links between possible causes, controls, and consequences in terms of a diagram?
   1. FAIR
   2. BTA
   3. Markov analysis
   4. Monte Carlo analysis
7. The results of a risk assessment should be summarized as a(n) __.
   1. CAP
   2. Business continuity plan
   3. Organizational chart
   4. Risk register