CCP Quantitative Risk Assessment 5

Question 1

When using threat intelligence data in quantitative risk assessment, what is the primary challenge with externally reported breach statistics?

Accepted Answer

Survivorship and reporting biases mean they may not represent the true frequency of incidents

Answer

External breach data suffers from reporting bias (only notable incidents are publicized) and survivorship bias, skewing frequency estimates.

Question 2

A CISO must present cyber risk to the board using quantitative metrics. Which format best communicates risk in financial terms?

Accepted Answer

Annualized loss expectancy ranges with confidence intervals

Answer

Boards understand financial exposure; ALE ranges with confidence intervals translate cyber risk into business-relevant monetary terms.

Question 3

In quantitative risk assessment, what is a 'risk appetite threshold' used for?

Accepted Answer

To define the level of risk the organization is willing to accept before requiring treatment

Answer

A risk appetite threshold defines the acceptable level of residual risk; risks exceeding it must be treated, transferred, or escalated.

Question 4

Which of the following is a key limitation of using historical loss data in quantitative cyber risk models?

Accepted Answer

Past cyber incidents may not predict future losses due to rapidly evolving threat landscapes

Answer

The cyber threat landscape evolves rapidly, meaning historical breach data may poorly predict future risks from new attack vectors.

Question 5

An organization is deciding between two controls: Control A costs $100K and reduces ALE by $150K; Control B costs $200K and reduces ALE by $250K. Which should be prioritized based purely on ROSI?

Accepted Answer

Control A because it has a higher ROSI (50% vs 25%)

Answer

ROSI for A = ($150K-$100K)/$100K = 50%; ROSI for B = ($250K-$200K)/$200K = 25%; Control A is more efficient per dollar spent.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Quantitative Risk Assessment 5