CASE Risk Management & Mitigation 3 — Questions and Answers
Question 1: Which attack tree component represents the goal an attacker is trying to achieve?
- Leaf node
- Root node (Correct answer)
- Branch node
- AND node
Correct answer: Root node
The root node of an attack tree represents the attacker's ultimate objective.
Question 2: A SaaS provider stores customer data in a shared cloud environment. Which risk mitigation control BEST addresses data co-mingling concerns?
- Encryption at rest with tenant-specific keys (Correct answer)
- Shared TLS certificates across tenants
- Single sign-on federation
- Rate limiting on API endpoints
Correct answer: Encryption at rest with tenant-specific keys
Tenant-specific encryption keys ensure that even if data is co-located, one tenant cannot decrypt another's data.
Question 3: Under NIST SP 800-30, which step comes AFTER risk identification?
- Risk framing
- Risk assessment (Correct answer)
- Risk monitoring
- Risk response
Correct answer: Risk assessment
NIST SP 800-30 sequence is: Frame → Identify (Assess) → Respond → Monitor; risk assessment follows framing.
Question 4: What does 'threat likelihood' represent in qualitative risk analysis?
- The technical severity of a vulnerability
- The probability that a threat will exploit a vulnerability in a given time period (Correct answer)
- The cost to remediate a discovered flaw
- The number of users affected by an exploit
Correct answer: The probability that a threat will exploit a vulnerability in a given time period
Threat likelihood is the probability or frequency with which a threat event is expected to occur.
Question 5: An organization conducts a Business Impact Analysis (BIA). Which TWO values does a BIA primarily establish?
- RTO and RPO (Correct answer)
- CVSS and DREAD scores
- ALE and SLE
- SLA and OLA
Correct answer: RTO and RPO
A BIA establishes Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical business functions.
Question 6: Which approach to risk analysis assigns monetary values such as ALE and SLE to risks?
- Qualitative risk analysis
- Quantitative risk analysis (Correct answer)
- Semi-quantitative risk analysis
- Threat-based risk analysis
Correct answer: Quantitative risk analysis
Quantitative risk analysis uses numerical values (ALE = ARO × SLE) to express risk in financial terms.
Question 7: A CASE practitioner recommends adding input validation, output encoding, and a WAF to counter SQL injection. These controls together represent which risk response?
- Risk transfer
- Risk avoidance
- Defense in depth as risk mitigation (Correct answer)
- Risk acceptance
Correct answer: Defense in depth as risk mitigation
Layering multiple complementary controls (defense in depth) reduces the likelihood and impact of exploitation, constituting risk mitigation.
CASE Risk Management & Mitigation 3
Which attack tree component represents the goal an attacker is trying to achieve?