CAIC Cybersecurity & Risk 1 — Questions and Answers
Question 1: What is the first step in CAIC risk assessment?
- Identifying potential hazards and threats (Correct answer)
- Purchasing insurance
- Assigning blame
- Ignoring minor risks
Correct answer: Identifying potential hazards and threats
Risk assessment begins with systematic identification of all potential hazards, forming the foundation for all subsequent analysis.
Question 2: What is the hierarchy of controls in CAIC risk management?
- Elimination, substitution, engineering, administrative, then PPE (Correct answer)
- PPE first, then administrative
- Insurance, training, documentation
- Assessment, planning, implementation
Correct answer: Elimination, substitution, engineering, administrative, then PPE
The hierarchy prioritizes the most effective controls first, from eliminating the hazard to using PPE as last resort.
Question 3: What is a risk matrix used for in CAIC practice?
- Evaluating risks by plotting likelihood against impact severity (Correct answer)
- Creating task schedules
- Mapping facility layouts
- Tracking attendance
Correct answer: Evaluating risks by plotting likelihood against impact severity
A risk matrix plots probability against consequences to prioritize which risks need immediate attention.
Question 4: What does residual risk mean in CAIC practice?
- Risk remaining after all controls are implemented (Correct answer)
- Initial risk before assessment
- Risk affecting waste materials
- Budget overrun risk
Correct answer: Risk remaining after all controls are implemented
Residual risk is the level remaining after practical controls are applied. Some is usually accepted as eliminating all risk is rarely feasible.
Question 5: Why is regular review important in CAIC risk management?
- Conditions change and new risks emerge requiring updates (Correct answer)
- Only needed after incidents
- Prohibited more than annually
- Assessments stay valid forever
Correct answer: Conditions change and new risks emerge requiring updates
Regular reviews ensure assessments remain current as conditions change and lessons from incidents are incorporated.
Question 6: What is a near-miss report in CAIC practice?
- Documentation of an event that could have caused harm but did not (Correct answer)
- A project near deadline
- An employee near target
- A near break-even report
Correct answer: Documentation of an event that could have caused harm but did not
Near-miss reports document events where harm almost occurred, providing data to prevent future incidents.
CAIC Cybersecurity & Risk 1
What is the first step in CAIC risk assessment?