CSET Risk Assessment & Management 2

Question 1

A school district identifies that a new software system could fail during high-stakes testing. Which risk response strategy involves purchasing cybersecurity insurance to cover potential losses?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial consequences of a risk to a third party, such as an insurance provider.

Question 2

During a quantitative risk analysis, a project manager calculates Expected Monetary Value (EMV). If an event has a 30% probability of occurring and would cost $50,000, what is its EMV?

Accepted Answer

$15,000

Answer

EMV is calculated by multiplying the probability (0.30) by the impact ($50,000), yielding $15,000.

Question 3

Which risk analysis technique uses optimistic, pessimistic, and most likely estimates to model uncertainty in project timelines?

Accepted Answer

PERT analysis

Answer

PERT (Program Evaluation and Review Technique) uses three-point estimates to calculate expected durations under uncertainty.

Question 4

A risk register entry shows a risk with HIGH likelihood and LOW impact. How should this risk be prioritized compared to a risk with LOW likelihood and HIGH impact?

Accepted Answer

Prioritization depends on the calculated risk score for each

Answer

Risk prioritization is based on the overall risk score (likelihood × impact), not on either factor alone.

Question 5

In the context of information security risk management, what does the term 'vulnerability' refer to?

Accepted Answer

A weakness that can be exploited by a threat

Answer

A vulnerability is a weakness or gap in a system's defenses that a threat can exploit to cause harm.

CSET Test Practice Test

CSET Test Practice Test

CSET Risk Assessment & Management 2