ISC2 Exam ISSEP Topic 2 Question 70 Discussion

Actual exam question for ISC2's ISSEP exam

Question #: 70
Topic #: 2

[All ISSEP Questions]

Which of the following statements is true about residual risks

AIt can be considered as an indicator of threats coupled with vulnerability.

BIt is a weakness or lack of safeguard that can be exploited by a threat.

CIt is the probabilistic risk after implementing all security measures.

DIt is the probabilistic risk before implementing all security measures.

Show Suggested Answer

Suggested Answer: B

The types of cryptography defined by FIPS 185 are as follows:

Type I cryptography: It describes a cryptographic algorithm or a tool accepted by the National

Security Agency for protecting classified

information.

Type II cryptography: It describes a cryptographic algorithm or a tool accepted by the National

Security Agency for protecting

sensitive, unclassified information in the systems as stated in Section 2315 of Title 10, United States

Code, or Section 3502(2) of Title

44, United States Code.

Type III cryptography: It describes a cryptographic algorithm or a tool accepted as a Federal

Information Processing Standard.

Type III (E) cryptography: It describes a Type III algorithm or a tool that is accepted for export from

the United States.

by Mari at Jul 04, 2023, 08:30 AM

Limited Time Offer

25%

Off

Get Premium ISSEP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Dorian

15 days ago

Wait, is this a pop quiz or something? I thought we were just here to have a good time and learn about cybersecurity. Oh well, C it is!

upvoted 0 times

...

Elza

18 days ago

Ha! This is a classic trick question. If you don't know the difference between residual risk and inherent risk, you're in trouble. I'm going with C.

upvoted 0 times

...

Elin

18 days ago

Hmm, that's an interesting perspective. I can see how both answers could be valid depending on the context.

upvoted 0 times

...

Shelia

20 days ago

I disagree, I believe the answer is C) It is the probabilistic risk after implementing all security measures.

upvoted 0 times

...

Elin

22 days ago

I think the answer is A) It can be considered as an indicator of threats coupled with vulnerability.

upvoted 0 times

...

Van

23 days ago

But wouldn't residual risks still exist even after implementing all security measures?

upvoted 0 times

...

Josue

25 days ago

Hmm, I'm not sure about that. I was thinking option D sounded more like the definition of residual risk. Guess I need to review my notes again.

upvoted 0 times

...

Edna

25 days ago

I disagree, I believe the answer is C) It is the probabilistic risk after implementing all security measures.

upvoted 0 times

...

Anika

29 days ago

I think option C is the correct answer. Residual risk is the probabilistic risk that remains after implementing all security measures.

upvoted 0 times

...

Van

1 months ago

I think the answer is A) It can be considered as an indicator of threats coupled with vulnerability.

upvoted 0 times

...