Algorithms Risk Assessment & Management 5

Question 1

Which quantitative technique calculates the expected value of additional information to decide whether further risk analysis is worth its cost?

Accepted Answer

Expected Value of Perfect Information (EVPI)

Answer

EVPI quantifies the maximum amount an organization should pay for perfect information about an uncertain outcome, bounding the value of further analysis.

Question 2

A risk management plan specifies a 'risk threshold' of $50,000. What does crossing this threshold trigger?

Accepted Answer

Escalation to a higher decision-making authority

Answer

Risk thresholds define the point at which a risk must be escalated or actively managed rather than monitored passively.

Question 3

Which software development risk assessment activity involves systematically walking through a design to identify security flaws before implementation?

Accepted Answer

Threat modeling

Answer

Threat modeling (e.g., STRIDE) analyzes system architecture to proactively identify potential attack vectors and design weaknesses early in the SDLC.

Question 4

In supply chain risk management for software, what is a 'software bill of materials' (SBOM) used for?

Accepted Answer

Identifying all third-party components and their known vulnerabilities

Answer

An SBOM is a complete inventory of software components and dependencies, enabling rapid identification of exposure when new vulnerabilities (e.g., Log4Shell) are disclosed.

Question 5

A project team establishes a 'risk owner' for each identified risk. What is this person primarily responsible for?

Accepted Answer

Monitoring the risk and executing the agreed response plan

Answer

A risk owner is accountable for tracking the risk's status, implementing the mitigation or contingency plan, and communicating updates to stakeholders.

Algorithms Practice Test

Algorithms Practice Test

Algorithms Risk Assessment & Management 5