Algorithms Risk Assessment & Management 4 — Questions and Answers
Question 1: Which principle states that security controls should provide multiple overlapping layers so that failure of one layer does not compromise the entire system?
- Least privilege
- Defense in depth (Correct answer)
- Fail-safe defaults
- Separation of duties
Correct answer: Defense in depth
Defense in depth layers multiple independent controls (firewalls, encryption, monitoring) so an attacker must defeat every layer to succeed.
Question 2: During risk prioritization, a team applies the Pareto principle. What does this suggest about risk distribution?
- All risks contribute equally to project failure
- Roughly 80% of impact comes from 20% of risks (Correct answer)
- Every risk must be mitigated before proceeding
- Low-probability risks are always negligible
Correct answer: Roughly 80% of impact comes from 20% of risks
The Pareto (80/20) principle applied to risk suggests that a small subset of high-priority risks typically account for the majority of potential loss.
Question 3: What distinguishes a 'known unknown' risk from an 'unknown unknown' risk in project management?
- Known unknowns are already occurring; unknown unknowns are future events
- Known unknowns are identified but unquantified; unknown unknowns are entirely unforeseen (Correct answer)
- Known unknowns require transfer; unknown unknowns require avoidance
- There is no practical distinction between the two
Correct answer: Known unknowns are identified but unquantified; unknown unknowns are entirely unforeseen
Known unknowns are recognized uncertainties that can be planned for with contingency reserves, while unknown unknowns are surprises requiring management reserves.
Question 4: A penetration test reveals that a web application's input validation algorithm can be bypassed. Under CVSS v3, which metric primarily captures how easily an attacker can exploit this?
- Scope
- Attack Complexity (Correct answer)
- Privileges Required
- Confidentiality Impact
Correct answer: Attack Complexity
Attack Complexity (AC) in CVSS v3 measures the conditions beyond the attacker's control that must exist for the vulnerability to be exploitable.
Question 5: Which risk response is most appropriate when the cost of mitigating a risk exceeds the expected loss from the risk occurring?
- Avoidance
- Transfer
- Active mitigation
- Acceptance (Correct answer)
Correct answer: Acceptance
When mitigation costs outweigh expected loss, the economically rational response is acceptance, optionally with a contingency plan if the risk materializes.
Question 6: In a risk bow-tie diagram, what separates the threat side from the consequence side?
- The risk owner
- The top event (hazard) (Correct answer)
- The residual risk score
- The risk appetite statement
Correct answer: The top event (hazard)
The bow-tie diagram places the top event (the hazard or undesired event) at the center, with threats and prevention controls on the left and consequences and recovery controls on the right.
Question 7: An algorithm recommendation system exhibits demographic bias, leading to unfair outcomes for certain user groups. What category of risk does this represent?
- Ethical and fairness risk (Correct answer)
- Pure technical risk
- Market risk
- Liquidity risk
Correct answer: Ethical and fairness risk
Algorithmic bias that produces discriminatory outcomes constitutes an ethical and fairness risk with potential legal, reputational, and societal consequences.
Algorithms Risk Assessment & Management 4
Which principle states that security controls should provide multiple overlapping layers so that failure of one layer does not compromise the entire system?