Algorithms Risk Assessment & Management 4

Question 1

Which principle states that security controls should provide multiple overlapping layers so that failure of one layer does not compromise the entire system?

Accepted Answer

Defense in depth

Answer

Defense in depth layers multiple independent controls (firewalls, encryption, monitoring) so an attacker must defeat every layer to succeed.

Question 2

During risk prioritization, a team applies the Pareto principle. What does this suggest about risk distribution?

Accepted Answer

Roughly 80% of impact comes from 20% of risks

Answer

The Pareto (80/20) principle applied to risk suggests that a small subset of high-priority risks typically account for the majority of potential loss.

Question 3

What distinguishes a 'known unknown' risk from an 'unknown unknown' risk in project management?

Accepted Answer

Known unknowns are identified but unquantified; unknown unknowns are entirely unforeseen

Answer

Known unknowns are recognized uncertainties that can be planned for with contingency reserves, while unknown unknowns are surprises requiring management reserves.

Question 4

A penetration test reveals that a web application's input validation algorithm can be bypassed. Under CVSS v3, which metric primarily captures how easily an attacker can exploit this?

Accepted Answer

Attack Complexity

Answer

Attack Complexity (AC) in CVSS v3 measures the conditions beyond the attacker's control that must exist for the vulnerability to be exploitable.

Question 5

Which risk response is most appropriate when the cost of mitigating a risk exceeds the expected loss from the risk occurring?

Accepted Answer

Acceptance

Answer

When mitigation costs outweigh expected loss, the economically rational response is acceptance, optionally with a contingency plan if the risk materializes.

Algorithms Practice Test

Algorithms Practice Test

Algorithms Risk Assessment & Management 4