CPI CPI Risk Assessment & Threat Analysis

Question 1

In risk assessment, how is 'risk' formally defined?

Accepted Answer

The product of threat likelihood and the impact (consequence) of that threat

Answer

The presence of any hazard on a property

Answer

The total cost of security equipment installed

Answer

The number of incidents that occurred in the past year

Question 2

What is the difference between a 'threat' and a 'hazard' in security risk assessment terminology?

Accepted Answer

A threat is an intentional act by an adversary; a hazard is typically an unintentional or natural source of harm

Answer

They are interchangeable terms

Answer

A hazard is more serious than a threat

Answer

A threat only applies to cyber incidents

Question 3

A CPI conducting a threat assessment identifies that a local activist group has publicly threatened a facility. This is an example of which threat category?

Accepted Answer

External adversarial threat

Answer

Natural hazard

Answer

Insider threat

Answer

Accidental/unintentional hazard

Question 4

Which risk treatment option involves purchasing insurance or outsourcing to reduce financial exposure?

Accepted Answer

Risk transference

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 5

In a quantitative risk assessment, what does 'Annual Loss Expectancy (ALE)' represent?

Accepted Answer

The expected financial loss from a specific risk over a one-year period

Answer

The total replacement cost of all assets

Answer

The maximum possible loss in any single incident

Answer

The annual budget allocated to security countermeasures

Question 6

What is an 'insider threat' and why is it particularly challenging to address in risk assessments?

Accepted Answer

A threat from employees, contractors, or trusted individuals who have authorized access; it is challenging because they bypass perimeter controls

Answer

A threat from adjacent businesses; it is challenging because of property lines

Answer

A threat from building systems failures; challenging because of technical complexity

Answer

A threat from foreign governments; challenging because of legal jurisdiction