Algorithms Risk Assessment & Management 5 ā Questions and Answers
Question 1: Which quantitative technique calculates the expected value of additional information to decide whether further risk analysis is worth its cost?
- Expected Value of Perfect Information (EVPI) (Correct answer)
- Net Present Value (NPV)
- Return on Security Investment (ROSI)
- Earned Value Management (EVM)
Correct answer: Expected Value of Perfect Information (EVPI)
EVPI quantifies the maximum amount an organization should pay for perfect information about an uncertain outcome, bounding the value of further analysis.
Question 2: A risk management plan specifies a 'risk threshold' of $50,000. What does crossing this threshold trigger?
- Automatic risk acceptance
- Escalation to a higher decision-making authority (Correct answer)
- Immediate project cancellation
- Transfer of the risk to an insurer
Correct answer: Escalation to a higher decision-making authority
Risk thresholds define the point at which a risk must be escalated or actively managed rather than monitored passively.
Question 3: Which software development risk assessment activity involves systematically walking through a design to identify security flaws before implementation?
- Code review
- Threat modeling (Correct answer)
- User acceptance testing
- Regression testing
Correct answer: Threat modeling
Threat modeling (e.g., STRIDE) analyzes system architecture to proactively identify potential attack vectors and design weaknesses early in the SDLC.
Question 4: In supply chain risk management for software, what is a 'software bill of materials' (SBOM) used for?
- Tracking developer productivity
- Identifying all third-party components and their known vulnerabilities (Correct answer)
- Estimating software licensing costs only
- Automating software deployment pipelines
Correct answer: Identifying all third-party components and their known vulnerabilities
An SBOM is a complete inventory of software components and dependencies, enabling rapid identification of exposure when new vulnerabilities (e.g., Log4Shell) are disclosed.
Question 5: A project team establishes a 'risk owner' for each identified risk. What is this person primarily responsible for?
- Eliminating the risk completely
- Funding all mitigation activities from personal budget
- Monitoring the risk and executing the agreed response plan (Correct answer)
- Reporting all risks directly to regulators
Correct answer: Monitoring the risk and executing the agreed response plan
A risk owner is accountable for tracking the risk's status, implementing the mitigation or contingency plan, and communicating updates to stakeholders.
Question 6: Which attack specifically targets the algorithm training pipeline by injecting malicious data to corrupt a machine learning model's behavior?
- Adversarial example attack
- Data poisoning attack (Correct answer)
- Model inversion attack
- Membership inference attack
Correct answer: Data poisoning attack
Data poisoning inserts manipulated training samples to cause the trained model to misclassify specific inputs or behave maliciously in production.
Question 7: When applying risk management to algorithm selection, which factor does 'technical debt risk' specifically capture?
- The probability that competitors will copy the algorithm
- The future cost and complexity imposed by choosing a quick, suboptimal implementation now (Correct answer)
- The risk that developers will quit before finishing the project
- Regulatory penalties for using patented algorithms
Correct answer: The future cost and complexity imposed by choosing a quick, suboptimal implementation now
Technical debt risk acknowledges that shortcuts in algorithm design accumulate interest in the form of higher future maintenance, refactoring, or failure costs.
Algorithms Risk Assessment & Management 5
Which quantitative technique calculates the expected value of additional information to decide whether further risk analysis is worth its cost?