CASE Risk Management & Mitigation 3

Question 1

Which attack tree component represents the goal an attacker is trying to achieve?

Accepted Answer

Root node

Answer

The root node of an attack tree represents the attacker's ultimate objective.

Question 2

A SaaS provider stores customer data in a shared cloud environment. Which risk mitigation control BEST addresses data co-mingling concerns?

Accepted Answer

Encryption at rest with tenant-specific keys

Answer

Tenant-specific encryption keys ensure that even if data is co-located, one tenant cannot decrypt another's data.

Question 3

Under NIST SP 800-30, which step comes AFTER risk identification?

Accepted Answer

Risk assessment

Answer

NIST SP 800-30 sequence is: Frame → Identify (Assess) → Respond → Monitor; risk assessment follows framing.

Question 4

What does 'threat likelihood' represent in qualitative risk analysis?

Accepted Answer

The probability that a threat will exploit a vulnerability in a given time period

Answer

Threat likelihood is the probability or frequency with which a threat event is expected to occur.

Question 5

An organization conducts a Business Impact Analysis (BIA). Which TWO values does a BIA primarily establish?

Accepted Answer

RTO and RPO

Answer

A BIA establishes Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical business functions.

(CASE) Certified Application Security Engineer Practice Test