CASE Risk Management & Mitigation 2

Question 1

An organization's risk register shows a vulnerability with a likelihood of 0.6 and an impact score of 8. What is the risk score using the formula Risk = Likelihood × Impact?

Accepted Answer

4.8

Answer

Risk = Likelihood × Impact = 0.6 × 8 = 4.8.

Question 2

Which risk response strategy involves purchasing cyber insurance to cover potential breach costs?

Accepted Answer

Risk transfer

Answer

Buying insurance transfers the financial consequence of a risk to a third party.

Question 3

A development team identifies that a third-party library has a known CVE but no patch is available. They decide to monitor the library and accept the residual risk. Which document should formally record this decision?

Accepted Answer

Risk acceptance form / exception record

Answer

A risk acceptance form (exception record) formally documents the decision to accept a known risk with management sign-off.

Question 4

In DREAD risk scoring, what does the 'R' stand for?

Accepted Answer

Reproducibility

Answer

In DREAD, R stands for Reproducibility — how easily the attack can be replicated.

Question 5

Which of the following BEST describes a Residual Risk?

Accepted Answer

The risk remaining after security controls have been applied

Answer

Residual risk is the level of risk that remains after countermeasures or controls have been implemented.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Risk Management & Mitigation 2