CCP Quantitative Risk Assessment 3

Question 1

A financial institution uses Value at Risk (VaR) for cyber risk. A 99% VaR of $5 million means:

Accepted Answer

There is a 1% chance losses will exceed $5 million in a given period

Answer

VaR at 99% confidence means there is a 1% probability that losses will exceed the stated amount in the defined period.

Question 2

When building a quantitative risk model, what is the primary purpose of using probability distributions (e.g., PERT, lognormal) for loss estimates?

Accepted Answer

To capture the range and likelihood of different loss scenarios

Answer

Probability distributions capture the inherent uncertainty in loss estimates by modeling the full range of plausible outcomes.

Question 3

An organization experiences data breaches at an average rate of 0.5 times per year. Using the Poisson distribution, what is the probability of exactly zero breaches in a given year?

Accepted Answer

approximately 61%

Answer

P(0) = e^(-0.5) ≈ 0.6065, or about 61%, using the Poisson formula with λ=0.5.

Question 4

In the FAIR (Factor Analysis of Information Risk) model, what are the two primary components that combine to determine risk?

Accepted Answer

Loss event frequency and loss magnitude

Answer

FAIR defines risk as a function of Loss Event Frequency (how often) and Loss Magnitude (how much).

Question 5

A cyber risk analyst is told to use a 'minimum, most likely, maximum' approach for loss estimates. Which distribution does this describe?

Accepted Answer

PERT (Program Evaluation and Review Technique) distribution

Answer

PERT distribution uses minimum, most likely, and maximum values to model uncertain estimates with emphasis on the most likely value.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Quantitative Risk Assessment 3