CSC Threat Assessment & Risk Analysis 2

Question 1

A security consultant is asked to evaluate risks using a scenario-based approach rather than asset-based. Which methodology best fits this requirement?

Accepted Answer

Threat-centric risk assessment

Answer

Threat-centric risk assessment focuses on threat scenarios and adversary capabilities rather than starting from an asset inventory.

Question 2

During a red team engagement, analysts discover the organization has no visibility into DNS query logs. This finding primarily affects which risk analysis component?

Accepted Answer

Threat likelihood estimation

Answer

Without DNS log visibility, analysts cannot accurately estimate the likelihood of DNS-based threats or detect active exfiltration.

Question 3

The FAIR (Factor Analysis of Information Risk) model decomposes risk into Loss Event Frequency and which other primary factor?

Accepted Answer

Probable loss magnitude

Answer

FAIR defines risk as a function of Loss Event Frequency (LEF) and Probable Loss Magnitude (PLM).

Question 4

A CSC is reviewing a client's risk register and notices that several risks are marked 'accepted' with no documented rationale. What is the primary concern?

Accepted Answer

Risk acceptance without documented rationale may violate governance and accountability requirements

Answer

Undocumented risk acceptance undermines accountability and may expose the organization to liability if the risk materializes.

Question 5

Which threat intelligence source provides the highest confidence attribution for a nation-state advanced persistent threat (APT) group?

Accepted Answer

Strategic intelligence from government CERTs with classified backing

Answer

Government CERTs with access to classified signals intelligence provide the highest-confidence attribution for nation-state APTs.

(CSC) Certified Security Consultant Practice Test

(CSC) Certified Security Consultant Practice Test

CSC Threat Assessment & Risk Analysis 2