CSET Risk Assessment & Management 4

Question 1

A safety officer conducts a Failure Mode and Effects Analysis (FMEA). What is the primary output of this analysis?

Accepted Answer

A ranking of failure modes by their Risk Priority Number (RPN)

Answer

FMEA produces Risk Priority Numbers (RPN) by multiplying severity, occurrence, and detectability ratings to rank failure modes.

Question 2

Which risk management framework, widely used in IT and organizational settings, categorizes controls as preventive, detective, and corrective?

Accepted Answer

NIST Cybersecurity Framework

Answer

The NIST Cybersecurity Framework organizes security controls into categories including preventive, detective, and corrective control types.

Question 3

A project team identifies a risk and decides to monitor it without taking immediate action because the potential impact is very low. This approach is called:

Accepted Answer

Passive risk acceptance

Answer

Passive risk acceptance means acknowledging a risk and choosing not to act unless it materializes, typically because it has low impact.

Question 4

In a risk assessment, a 'threat agent' is best defined as:

Accepted Answer

The entity or force that can exploit a vulnerability

Answer

A threat agent is the actor—human, natural, or technical—capable of intentionally or unintentionally exploiting a vulnerability.

Question 5

A district technology coordinator uses a decision tree to evaluate two possible responses to a cybersecurity risk. What does a decision tree primarily help with in risk management?

Accepted Answer

Visually mapping outcomes and expected values of different decisions

Answer

A decision tree maps possible choices and their probabilistic outcomes, allowing comparison of expected values to support decision-making.

CSET Test Practice Test

CSET Test Practice Test

CSET Risk Assessment & Management 4