CAD Risk Management & Mitigation 2 — Questions and Answers
Question 1: A development team discovers a critical security vulnerability in a third-party library used in production. Which risk response strategy is MOST appropriate?
- Accept the risk and document it
- Transfer the risk to the vendor
- Mitigate by patching or replacing the library immediately (Correct answer)
- Avoid by shutting down the application
Correct answer: Mitigate by patching or replacing the library immediately
Mitigation involves taking immediate action to reduce the probability or impact of the risk, such as patching or replacing the vulnerable library.
Question 2: Which metric is used to calculate the Annual Loss Expectancy (ALE) in quantitative risk assessment?
- Risk Probability × Impact Score
- Single Loss Expectancy × Annualized Rate of Occurrence (Correct answer)
- Asset Value × Threat Likelihood
- Exposure Factor × Control Effectiveness
Correct answer: Single Loss Expectancy × Annualized Rate of Occurrence
ALE = SLE × ARO, where SLE is the Single Loss Expectancy and ARO is the Annualized Rate of Occurrence.
Question 3: During sprint planning, a team identifies that a new API integration has uncertain requirements. What risk mitigation technique should they apply?
- Spike solution to explore feasibility before committing (Correct answer)
- Skip the integration until requirements are finalized
- Assign the task to the most senior developer only
- Document the risk and proceed without changes
Correct answer: Spike solution to explore feasibility before committing
A spike is a time-boxed research task used in Agile to reduce uncertainty before committing to a full implementation.
Question 4: A risk register entry shows a risk with high probability but low impact. According to a standard risk matrix, how should this risk be prioritized?
- Critical — address immediately
- Medium — monitor and plan response (Correct answer)
- Low — accept and ignore
- Transfer to a third party
Correct answer: Medium — monitor and plan response
High probability combined with low impact typically places a risk in the medium priority zone, requiring monitoring and a planned response.
Question 5: What is the purpose of a fallback plan in risk management?
- To prevent the risk from occurring
- To transfer responsibility to another team
- To execute when the primary risk response fails (Correct answer)
- To document risks that have already occurred
Correct answer: To execute when the primary risk response fails
A fallback plan is a contingency response activated when the primary mitigation strategy proves ineffective.
Question 6: A CAD project's risk log shows a residual risk after controls are applied. What does residual risk represent?
- Risks that were completely eliminated
- The risk remaining after all mitigation measures have been applied (Correct answer)
- Risks transferred to an insurance provider
- New risks introduced by the mitigation controls
Correct answer: The risk remaining after all mitigation measures have been applied
Residual risk is the level of risk that remains after controls and mitigations have been implemented.
Question 7: Which approach best describes risk avoidance in software development?
- Purchasing insurance to cover potential losses
- Changing the project plan to eliminate the risky activity (Correct answer)
- Reducing the probability of the risk occurring
- Sharing the risk with a partner organization
Correct answer: Changing the project plan to eliminate the risky activity
Risk avoidance involves altering plans or scope to completely remove the threat, not just reduce it.
CAD Risk Management & Mitigation 2
A development team discovers a critical security vulnerability in a third-party library used in production.
Which risk response strategy is MOST appropriate?