Risk Assessment and Management Flashcards

Which risk assessment methodology uses probability and impact ratings to calculate a risk score?

Answer: Semi-quantitative risk assessment

Semi-quantitative risk assessment combines numerical scales for probability and impact to produce a risk score without requiring precise monetary values.

A company identifies that a vendor handling PII could be breached. This scenario best represents which risk concept?

Answer: Third-party risk

Third-party risk refers to the potential for harm arising from a vendor, supplier, or partner relationship where sensitive data or processes are involved.

In NIST SP 800-30, which step immediately follows risk identification?

Answer: Risk analysis

NIST SP 800-30 defines the risk management process as: framing, assessing (identify then analyze), responding, and monitoring — so analysis follows identification.

An organization determines that the cost of a control exceeds the potential loss it would prevent. The BEST action is to:

Answer: Accept the residual risk

When control costs exceed potential losses, accepting the residual risk is the rational response based on cost-benefit analysis.

Which of the following BEST describes the concept of risk appetite?

Answer: The amount of risk an organization is willing to accept in pursuit of objectives

Risk appetite is the broad-based amount of risk an organization is willing to accept in pursuit of its mission and strategic goals.

When conducting a Business Impact Analysis (BIA), which metric defines the maximum tolerable downtime before significant harm occurs?

Answer: Maximum Tolerable Downtime (MTD)

MTD (also called Maximum Tolerable Period of Disruption) is the longest time a business function can be unavailable before causing unacceptable consequences.

A risk register entry shows a threat with HIGH likelihood but LOW impact. How should this risk typically be prioritized?

Answer: Medium priority — monitor and apply cost-effective controls

High likelihood / low impact risks warrant medium priority: they occur often but don't cause severe harm, so cost-effective monitoring and controls are appropriate.

Which quantitative risk metric represents the expected monetary loss from a specific threat occurring once?

Answer: Single Loss Expectancy (SLE)

SLE = Asset Value × Exposure Factor, representing the dollar loss expected from a single threat event.

An organization uses insurance to shift financial exposure from a cyberattack to a third party. This is an example of:

Answer: Risk transfer

Risk transfer shifts the financial consequence of a risk to another party, most commonly through insurance or contractual indemnification.

In ISO 31000, which component provides the mandate and commitment for risk management?

Answer: Principles and framework

ISO 31000 structures risk management into Principles, Framework, and Process — the framework provides the mandate and commitment from leadership.

A CGRC professional performing a risk assessment notices that two separate low-level risks, when combined, create a high-impact exposure. This is best described as:

Answer: Aggregate risk

Aggregate risk refers to the combined effect of multiple individual risks that together create a larger overall exposure than each risk alone would suggest.

Which control type is BEST suited to reduce the likelihood of a threat exploiting a vulnerability?

Answer: Preventive control

Preventive controls reduce the likelihood that a threat will successfully exploit a vulnerability by blocking or discouraging the threat.

During risk treatment, an organization decides to stop offering a high-risk product line to eliminate exposure. This strategy is:

Answer: Risk avoidance

Risk avoidance means eliminating the activity or condition that gives rise to the risk entirely, removing exposure rather than managing it.

Which of the following BEST describes a vulnerability in the context of risk assessment?

Answer: A weakness that could be exploited by a threat

A vulnerability is a weakness or gap in protection that a threat could exploit to cause harm to an asset.

An Annualized Loss Expectancy (ALE) is calculated as:

Answer: Single Loss Expectancy × Annualized Rate of Occurrence

ALE = SLE × ARO; it represents the expected annual monetary loss from a specific threat given how often that threat is expected to occur.

Which risk assessment approach is MOST appropriate when precise data is unavailable but expert judgment can be gathered?

Answer: Qualitative risk assessment

Qualitative risk assessment uses expert judgment and descriptive scales (High/Medium/Low) when hard data is unavailable or cost-prohibitive to gather.

A risk owner is PRIMARILY responsible for:

Answer: Accepting, mitigating, or transferring risks within their area

A risk owner is accountable for managing a specific risk, including deciding on treatment options within their domain and monitoring outcomes.

Which of the following BEST distinguishes risk tolerance from risk appetite?

Answer: Risk appetite is the strategic willingness to accept risk; risk tolerance is the acceptable variance around that level

Risk appetite is the overall desired level of risk, while risk tolerance defines the acceptable deviation above or below that appetite in practice.

An organization performs a threat analysis and finds that employees are the most frequent source of incidents. This category of threat source is called:

Answer: Insider threat

Insider threats originate from current or former employees, contractors, or business partners who misuse authorized access, whether maliciously or accidentally.

In the context of CGRC, a risk heat map is PRIMARILY used to:

Answer: Visually communicate risk likelihood and impact to stakeholders

A risk heat map provides a visual matrix of risks plotted by likelihood and impact, making it easy for stakeholders to prioritize and communicate risk posture.