CASE Risk Management & Mitigation 2 — Questions and Answers
Question 1: An organization's risk register shows a vulnerability with a likelihood of 0.6 and an impact score of 8. What is the risk score using the formula Risk = Likelihood × Impact?
- 4.8 (Correct answer)
- 6.8
- 8.6
- 14.0
Correct answer: 4.8
Risk = Likelihood × Impact = 0.6 × 8 = 4.8.
Question 2: Which risk response strategy involves purchasing cyber insurance to cover potential breach costs?
- Risk avoidance
- Risk transfer (Correct answer)
- Risk acceptance
- Risk mitigation
Correct answer: Risk transfer
Buying insurance transfers the financial consequence of a risk to a third party.
Question 3: A development team identifies that a third-party library has a known CVE but no patch is available. They decide to monitor the library and accept the residual risk. Which document should formally record this decision?
- Threat model
- Risk acceptance form / exception record (Correct answer)
- Security policy
- Vulnerability scan report
Correct answer: Risk acceptance form / exception record
A risk acceptance form (exception record) formally documents the decision to accept a known risk with management sign-off.
Question 4: In DREAD risk scoring, what does the 'R' stand for?
- Reliability
- Reproducibility (Correct answer)
- Resilience
- Recoverability
Correct answer: Reproducibility
In DREAD, R stands for Reproducibility — how easily the attack can be replicated.
Question 5: Which of the following BEST describes a Residual Risk?
- The risk that remains after all controls have been removed
- The risk remaining after security controls have been applied (Correct answer)
- The total risk before any mitigation
- The risk transferred to a third party
Correct answer: The risk remaining after security controls have been applied
Residual risk is the level of risk that remains after countermeasures or controls have been implemented.
Question 6: An application security team wants to prioritize remediation efforts. They rank vulnerabilities by exploitability, business impact, and data sensitivity. Which framework supports this structured ranking approach?
- OWASP Risk Rating Methodology (Correct answer)
- CVSS base score only
- CWE classification
- NIST SP 800-30
Correct answer: OWASP Risk Rating Methodology
The OWASP Risk Rating Methodology guides teams to score vulnerabilities using threat agent, vulnerability, and business impact factors.
Question 7: What is the primary purpose of a Risk Treatment Plan (RTP)?
- To document all discovered vulnerabilities in a registry
- To define specific actions, owners, and timelines for addressing identified risks (Correct answer)
- To assign CVSS scores to application flaws
- To outline penetration testing scope and rules of engagement
Correct answer: To define specific actions, owners, and timelines for addressing identified risks
A Risk Treatment Plan specifies how each identified risk will be handled, who is responsible, and by when.
CASE Risk Management & Mitigation 2
An organization's risk register shows a vulnerability with a likelihood of 0.6 and an impact score of 8.
What is the risk score using the formula Risk = Likelihood × Impact?