1) In a CBA, if the benefits of a control outweigh the costs of implementing that control, then the control can be implemented to reduce risk.

1) In a CBA, if the benefits of a control outweigh the costs of implementing that control, then the control can be implemented to reduce risk. However, if the cost outweighs the benefit, then ______________.

1. the control won't reduce the risk
2. the risk can be accepted
3. the risk increases
4. you must assess the intangible value before deciding whether or not to implement the control

2) All of the following terms have the same meaning EXCEPT:

1. cause and effect diagram
2. Ishikawa diagram
3. fishbone diagram
4. affinity diagram

3) What information should you include in your report for management when you present your recommendations?

1. findings, recommendation cost and time frame, and cost-benefit analysis
2. recommendation, justification, and procedure
3. affinity diagram, POAM, and CBA
4. stakeholders, key stakeholders, and C-level stakeholders

4) You use ________________ to communicate a risk and the resulting impact.

1. risk management plans
2. CBAs
3. risk statements
4. POAMs

5) In the findings section of your report to management where you present your recommendations, the "cause" is often an outage of some type. Is it True or False?

6) You are creating objectives for your risk management plan. What do you NOT include at this stage?

1. POAM
2. list of threats
3. cost-benefit analysis
4. one or more reports

7) All stakeholders have vested interests in their projects and want to see those projects succeed. Is it True or False?

8) Cause and effect diagrams are used to link problems with causes.