CIM Risk Assessment & Mitigation 2

Question 1

A quantitative risk assessment assigns a risk score of 0.15 to a threat. Which formula was most likely used to calculate this value?

Accepted Answer

Impact × Likelihood on a 0–1 normalized scale

Answer

A normalized 0–1 score is produced by multiplying probability (likelihood) by impact, both scaled to a 0–1 range.

Question 2

Which mitigation strategy is MOST appropriate when the cost of controlling a risk exceeds the value of the asset at risk?

Accepted Answer

Risk acceptance

Answer

When control costs outweigh asset value, risk acceptance (knowingly tolerating the risk) is the rational economic choice.

Question 3

During a business impact analysis, the Recovery Point Objective (RPO) is best described as:

Accepted Answer

The point in time to which data must be restored after an incident

Answer

RPO defines the maximum age of data that must be recovered, determining backup frequency requirements.

Question 4

A threat agent exploits a known unpatched vulnerability in a web application. In risk terminology, the 'vulnerability' refers to:

Accepted Answer

A weakness that can be exploited to cause harm

Answer

A vulnerability is a weakness or gap in protection that a threat agent can exploit.

Question 5

Which control type is specifically designed to DETECT risks after they have materialized?

Accepted Answer

Detective controls

Answer

Detective controls identify and alert on incidents or anomalies that have already occurred.

(CIM) Certified Incident Manager Practice Test