CSC Security Risk Management 3

Question 1

Which of the following BEST describes the concept of 'inherent risk'?

Accepted Answer

The risk level that exists before any controls are implemented

Answer

Inherent risk is the raw, unmitigated level of risk present in an environment before any security controls are in place.

Question 2

A CSC is asked to evaluate which assets require the most protection. Which criterion should carry the GREATEST weight in this determination?

Accepted Answer

The criticality and value of the asset to organizational operations

Answer

Asset criticality and business value are the primary drivers for prioritizing protection efforts in a risk-based security program.

Question 3

What is the primary goal of a threat modeling exercise in the context of security risk management?

Accepted Answer

To identify potential threats, attack vectors, and prioritize mitigations early in design

Answer

Threat modeling systematically identifies threats and vulnerabilities during the design phase so that mitigations can be built in proactively.

Question 4

Which risk assessment framework is commonly used by US federal agencies and contractors and is published by NIST?

Accepted Answer

RMF (SP 800-37)

Answer

NIST SP 800-37 defines the Risk Management Framework (RMF), which is mandatory for US federal information systems.

Question 5

A security consultant discovers that two different business units use the same critical server but neither owns accountability for its security. This BEST illustrates which risk management problem?

Accepted Answer

Lack of asset ownership leading to security governance gaps

Answer

Without clearly assigned ownership, no one is accountable for protecting the asset, creating a governance gap that elevates risk.

(CSC) Certified Security Consultant Practice Test

(CSC) Certified Security Consultant Practice Test

CSC Security Risk Management 3