ISC2 CISSP Certified Information Systems Security Professional Official Practice Tests, 4th Edition

AppendixAnswers to Review Questions

Chapter 1: Security and Risk Management (Domain 1)

1. C.  Alyssa should use periodic content reviews to continually verify that the content in her program meets the organization's needs and is up-to-date based upon the evolving risk landscape. She may do this using a combination of computer-based training, live training, and gamification, but those techniques do not necessarily verify that the content is updated.
2. B.  The residual risk is the level of risk that remains after controls have been applied to mitigate risks. Inherent risk is the original risk that existed prior to the controls. Control risk is new risk introduced by the addition of controls to the environment. Mitigated risk is the risk that ...