Administering Windows Server 2012 Risk Assessment & Management 3 — Questions and Answers
Question 1: An organization requires that Windows Server 2012 administrators follow the principle of least privilege. Which risk management concept does this policy directly address?
- Threat modeling
- Reducing attack surface via access control (Correct answer)
- Risk transference through insurance
- Quantitative risk analysis
Correct answer: Reducing attack surface via access control
Least privilege limits user permissions to only what is necessary, directly reducing the attack surface and insider threat risk.
Question 2: You are assessing risk for a Windows Server 2012 cluster used for payroll processing. The Annualized Rate of Occurrence (ARO) for ransomware is 0.5. If SLE is $100,000, what is the ALE?
- $200,000
- $100,000
- $50,000 (Correct answer)
- $25,000
Correct answer: $50,000
ALE = SLE × ARO = $100,000 × 0.5 = $50,000, meaning the expected annual loss is $50,000.
Question 3: After a penetration test, your Windows Server 2012 environment shows residual risk remains even after applying all recommended patches. Residual risk is best described as:
- Risk that has been transferred to an insurer
- Risk remaining after controls have been applied (Correct answer)
- The initial risk before any controls are in place
- Risk that management has formally accepted without controls
Correct answer: Risk remaining after controls have been applied
Residual risk is the risk that remains after security controls have been implemented and is not the same as inherent risk.
Question 4: Windows Server 2012 Group Policy is used to enforce password complexity across the domain. In a risk framework, Group Policy enforcements are classified as:
- Detective controls
- Corrective controls
- Preventive controls (Correct answer)
- Compensating controls
Correct answer: Preventive controls
Group Policy enforcements prevent non-compliant configurations from occurring, making them preventive controls.
Question 5: Your organization's risk assessment identifies that an unpatched Windows Server 2012 IIS vulnerability could be exploited. Which combination correctly maps the risk components?
- Threat = unpatched server; Vulnerability = attacker; Risk = web server
- Threat = attacker; Vulnerability = unpatched IIS; Risk = potential exploitation (Correct answer)
- Threat = web server; Vulnerability = patch; Risk = attacker
- Threat = IIS service; Vulnerability = network; Risk = patch
Correct answer: Threat = attacker; Vulnerability = unpatched IIS; Risk = potential exploitation
A threat (attacker) exploits a vulnerability (unpatched IIS) to create risk (potential exploitation of the system).
Question 6: During a risk assessment of a Windows Server 2012 environment, you determine that deploying a new IDPS would cost $30,000 annually but would reduce ALE by $75,000. What is the safeguard value?
- $30,000
- $45,000 (Correct answer)
- $75,000
- $105,000
Correct answer: $45,000
Safeguard value = ALE reduction − cost of control = $75,000 − $30,000 = $45,000, showing positive ROI for the control.
Question 7: A Windows Server 2012 administrator notices that audit logs are being overwritten due to insufficient log storage. This represents which type of risk to security monitoring?
- Availability risk to detective controls (Correct answer)
- Integrity risk to preventive controls
- Confidentiality risk to corrective controls
- Compliance risk to administrative controls
Correct answer: Availability risk to detective controls
Overwritten logs make detective controls (audit logging) unavailable, creating an availability risk to security monitoring.
Administering Windows Server 2012 Risk Assessment & Management 3
An organization requires that Windows Server 2012 administrators follow the principle of least privilege.
Which risk management concept does this policy directly address?