CSC Threat Assessment & Risk Analysis 3 — Questions and Answers
Question 1: When applying the NIST Risk Management Framework (RMF), at which step are security controls selected based on system categorization?
- Prepare
- Categorize
- Select (Correct answer)
- Implement
Correct answer: Select
The Select step in NIST RMF involves choosing security controls from NIST SP 800-53 appropriate to the system's categorization level.
Question 2: A CSC is assessing insider threat risk. Which behavioral indicator is most strongly associated with data exfiltration intent?
- Accessing systems during non-business hours once
- Large-volume downloads shortly after submitting a resignation notice (Correct answer)
- Using a shared account for a single task
- Filing an IT help desk ticket for password reset
Correct answer: Large-volume downloads shortly after submitting a resignation notice
Mass data downloads by an employee who has resigned is a classic precursor indicator of intellectual property theft.
Question 3: Which formula correctly represents the fundamental risk calculation used in most qualitative frameworks?
- Risk = Asset Value × Vulnerability
- Risk = Threat × Vulnerability × Impact
- Risk = Likelihood × Impact (Correct answer)
- Risk = Control Gap × Threat Frequency
Correct answer: Risk = Likelihood × Impact
Most qualitative risk frameworks calculate risk as the product of Likelihood (probability of occurrence) and Impact (severity of consequences).
Question 4: A security consultant discovers that a critical industrial control system (ICS) has never been patched due to vendor restrictions. Which risk treatment is most appropriate?
- Immediately apply all available patches to eliminate the vulnerability
- Accept the risk with no compensating controls since patching is impossible
- Implement compensating controls such as network segmentation and enhanced monitoring (Correct answer)
- Transfer the risk entirely to the vendor through contract amendments
Correct answer: Implement compensating controls such as network segmentation and enhanced monitoring
When patching is prohibited, compensating controls like network isolation and anomaly monitoring reduce risk without violating vendor restrictions.
Question 5: Which kill chain phase does lateral movement most directly correspond to in the Lockheed Martin Cyber Kill Chain?
- Weaponization
- Delivery
- Actions on Objectives (Correct answer)
- Installation
Correct answer: Actions on Objectives
Lateral movement occurs as adversaries expand access toward their target, which corresponds to the Actions on Objectives phase where they pursue their mission.
Question 6: A CSC is quantifying risk for a financial services client. The organization experienced 3 breaches in 10 years, each costing $500,000. What is the Annualized Loss Expectancy (ALE)?
- $50,000
- $150,000 (Correct answer)
- $500,000
- $1,500,000
Correct answer: $150,000
ALE = ARO × SLE = (3/10) × $500,000 = 0.3 × $500,000 = $150,000.
Question 7: In a threat modeling exercise, STRIDE is used to categorize threats. Which STRIDE category addresses threats that allow attackers to deny performing an action?
- Spoofing
- Tampering
- Repudiation (Correct answer)
- Information Disclosure
Correct answer: Repudiation
Repudiation threats (the R in STRIDE) involve attackers denying they performed actions when no audit trail or non-repudiation control exists.
CSC Threat Assessment & Risk Analysis 3
When applying the NIST Risk Management Framework (RMF), at which step are security controls selected based on system categorization?