Answer & Explanation:Assessment Worksheet Use —-file:///C:/Users/Jamie/Downloads/Lab05_SLMx_Risk20.pdf use all the questionsPerforming a Qualitative Risk Assessment for an IT InfrastructureCourse Name and Number: _____________________________________________________Student Name: ________________________________________________________________Instructor Name: ______________________________________________________________Lab Due Date: ________________________________________________________________OverviewIn this lab, you defined the purpose of an IT risk assessment, you aligned identified risks, threats,and vulnerabilities to an IT risk assessment that encompasses the seven domains of a typical ITinfrastructure, you classified the risks, threats, and vulnerabilities, and you prioritized them.Finally, you wrote an executive summary that addresses the risk assessment findings, riskassessment impact, and recommendations to remediate areas of noncompliance.Lab Assessment Questions & Answers1. What is an IT risk assessment’s goal or objective?2. Why is it difficult to conduct a quantitative risk assessment for an IT infrastructure?3. What was your rationale in assigning a “1” risk impact/risk factor value of “Critical” to anidentified risk, threat, or vulnerability?4. After you had assigned the “1,” “2,” and “3” risk impact/risk factor values to the identified risks,threats, and vulnerabilities, how did you prioritize the “1,” “2,” and “3” risk elements? Whatwould you say to executive management about your final recommended prioritization?5. Identify a risk-mitigation solution for each of the following risk factors:a. User downloads and clicks on an unknown e-mail attachmentb. Workstation OS has a known software vulnerabilityc. Need to prevent eavesdropping on WLAN due to customer privacy data accessd. Weak ingress/egress traffic-filtering degrades performancee. DoS/DDoS attack from the WAN/Internetf. Remote access from home officeg. Production server corrupts databasePart 2Use ——file:///C:/Users/Jamie/Downloads/Lab06_SLMx_Risk20.pdfAssessment WorksheetDeveloping a Risk-Mitigation Plan Outline for an IT InfrastructureCourse Name and Number: _____________________________________________________Student Name: ________________________________________________________________Instructor Name: ______________________________________________________________Lab Due Date: ________________________________________________________________OverviewIn this lab, you identified the scope for an IT risk-mitigation plan, you aligned the plan’s majorparts with the seven domains of an IT infrastructure, you defined the risk-mitigation steps, youdefined procedures and processes needed to maintain a security baseline for ongoing mitigation,and you created an outline for an IT risk-mitigation plan.Lab Assessment Questions & Answers1. Why is it important to prioritize your IT infrastructure risks, threats, and vulnerabilities?2. Based on your executive summary produced in the Performing a Qualitative Risk Assessment foran IT Infrastructure lab in this lab manual, what is the primary focus of your message to executivemanagement?3. Given the scenario for your IT risk-mitigation plan, what influence did your scenario have onprioritizing your identified risks, threats, and vulnerabilities?4. What risk-mitigation solutions do you recommend for handling the following risk element: Userinserts CDs and USB hard drives with personal photos, music, and videos on organization-ownedcomputers?5. What is a security baseline definition?6. What questions do you have for executive management to finalize your IT risk-mitigation plan?7. What is the most important risk-mitigation requirement you uncovered and want to communicateto executive management? In your opinion, why is this the most important risk-mitigationrequirement?8. Based on your IT risk-mitigation plan, what is the difference between short-term and long-termrisk-mitigation tasks and ongoing duties?9. For which of the seven domains of a typical IT infrastructure is it easy to implement riskmitigationsolutions but difficult to monitor and track effectiveness?10. Which of the seven domains of a typical IT infrastructure usually contains privacy data insystems, servers, and databases?11. Which of the seven domains of a typical IT infrastructure can access privacy data and also store iton local hard drives and disks?12. Why is the Remote Access Domain the most risk-prone of all in a typical IT infrastructure?13. When considering the implementation of software updates, software patches, and software fixes,why must you test the upgrade or software patch before you implement it as a risk-mitigationtactic?14. Are risk-mitigation policies, standards, procedures, and guidelines needed as part of your longtermrisk-mitigation plan? Why or why not?15. If an organization under a compliance law is not in compliance, how critical is it for yourorganization to mitigate this noncompliance risk element?
