Following a Security Assessment, the Chief Information Security Officer (CISO)

question 333

Multiple Choice

Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the results of the assessment and evaluating potential risk treatment strategies. As part of the CISO's evaluation, a judgment of potential impact based on the identified risk is performed. To prioritize response actions, the CISO uses past experience to take into account the exposure factor as well as the external accessibility of the weakness identified. Which of the following is the CISO performing?

• A) Documentation of lessons learned
• B) Quantitative risk assessment
• C) Qualitative assessment of risk
• D) Business impact scoring
• E) Threat modeling

---

Definitions:

Punishment

A consequence that decreases the likelihood of a behavior being repeated, often used in the context of discipline or behavioral modification.

Reinforcer

Any stimulus that strengthens or increases the probability of a specific response or behavior by providing a consequence an individual finds rewarding.

Change Her Behavior

The process or act of modifying an individual's actions or reactions through various methods, such as reinforcement or punishment.

Conditioned Stimulus

A previously neutral stimulus that, after becoming associated with the unconditioned stimulus, eventually comes to trigger a conditioned response.