ISC2 CSSLP Exam Dumps

A CI that has the same essential functionality as another CI but a bit different in some small manner, and therefore, might be required to be

analyzed along with its generic group.

A Configuration item (CI) is an IT asset or a combination of IT assets that may depend and have relationships with other IT processes. A CI

will have attributes which may be hierarchical and relationships that will be assigned by the configuration manager in the CM database.

The Configuration Item (CI) attributes are as follows:

1.Technical: It is data that describes the CI's capabilities which include software version and model numbers, hardware and

manufacturer specifications, and other technical details like networking speeds, and data storage size. Keyboards, mice and cables are

considered consumables.

2.Ownership: It is part of financial asset management, ownership attributes, warranty, location, and responsible person for the CI.

3.Relationship: It is the relationship among hardware items, software, and users.

Answer B, D, and A are incorrect. These are incorrect definitions of a variant with regard to Configuration Management.

Qualitative ranks the probability and impact and then helps the project manager and team to determine which risks need further analysis.

Perform Qualitative Risk Analysis is the process of prioritizing risks for further analysis and action. It combines risks and their probability of

occurrences and ranks them accordingly. It enables organizations to improve the project's performance by focusing on high-priority risks.

Perform Qualitative Risk Analysis is usually a rapid and cost-effective means of establishing priorities for Plan Risk Responses. It also lays the

foundation for Perform Quantitative Risk Analysis.

Answer A is incorrect. Risk identification precedes this activity.

Answer B is incorrect. This process does not describe the decomposition and organization of risks that you will complete in a risk

breakdown structure.

Answer D is incorrect. Quantitative analysis is the final step of risk analysis. Note the question tells you that Fred and the team will

identify risks for additional analysis.

The different tasks performed by the owner are as follows:

He makes the original determination to decide what level of classification the information requires, which is based on the business

requirements for the safety of the data.

He reviews the classification assignments from time to time and makes alterations as the business needs change.

He delegates the responsibility of the data safeguard duties to the custodian.

He specifies controls to ensure confidentiality, integrity and availability.

Answer C is incorrect. This task is performed by the custodian and not by the owner.

Detection risks are the risks that an auditor will not be able to find what they are looking to detect. Hence, it becomes tedious to report

negative results when material conditions (faults) actually exist. Detection risk includes two types of risk:

Sampling risk: This risk occurs when an auditor falsely accepts or erroneously rejects an audit sample.

Nonsampling risk: This risk occurs when an auditor fails to detect a condition because of not applying the appropriate procedure or

using procedures inconsistent with the audit objectives (detection faults).

Answer A is incorrect. Residual risk is the risk or danger of an action or an event, a method or a (technical) process that, although being

abreast with science, still conceives these dangers, even if all theoretically possible safety measures would be applied (scientifically

conceivable measures).

The formula to calculate residual risk is (inherent risk) x (control risk) where inherent risk is (threats vulnerability). In the economic context,

residual means 'the quantity left over at the end of a process; a remainder'.

Answer D is incorrect. Inherent risk, in auditing, is the risk that the account or section being audited is materially misstated without

considering internal controls due to error or fraud. The assessment of inherent risk depends on the professional judgment of the auditor, and

it is done after assessing the business environment of the entity being audited.

Answer B is incorrect. A secondary risk is a risk that arises as a straight consequence of implementing a risk response. The secondary

risk is an outcome of dealing with the original risk. Secondary risks are not as rigorous or important as primary risks, but can turn out to be so

if not estimated and planned properly.

The Annualized Rate of Occurrence (ARO) is a number that represents the estimated frequency at which a threat is expected to occur. It is

calculated based upon the probability of the event occurring and the number of employees that could make that event occur.

Answer D is incorrect. The Exposure Factor (EF) represents the % of assets loss caused by a threat. The EF is required to calculate the

Single Loss Expectancy (SLE).

Answer A is incorrect. The Single Loss Expectancy (SLE) is the value in dollars that is assigned to a single event.

SLE = Asset Value ($) X Exposure Factor (EF)

Answer C is incorrect. Safeguard acts as a countermeasure for reducing the risk associated with a specific threat or a group of threats.