CSI Threat Identification & Risk Management 2

Question 1

Which risk assessment methodology uses probability and impact matrices to prioritize threats?

Accepted Answer

Qualitative risk analysis

Answer

Qualitative risk analysis uses probability and impact matrices to rank and prioritize threats without precise numerical values.

Question 2

A security investigator notices an employee repeatedly accessing files outside their job role at odd hours. This behavior is best classified as:

Accepted Answer

Insider threat indicator

Answer

Accessing files beyond one's job scope during unusual hours is a classic insider threat behavioral indicator.

Question 3

What does 'residual risk' refer to in a security context?

Accepted Answer

Risk remaining after controls are applied

Answer

Residual risk is the level of risk that remains after security controls and countermeasures have been implemented.

Question 4

Which of the following is a PRIMARY goal of a threat vulnerability assessment?

Accepted Answer

Determine which assets face the greatest exposure

Answer

A threat vulnerability assessment aims to identify which assets are most exposed to identified threats.

Question 5

In the context of risk management, 'risk acceptance' means:

Accepted Answer

Acknowledging risk exists and choosing not to mitigate it further

Answer

Risk acceptance is a deliberate decision to tolerate an identified risk without additional mitigation, typically when the cost of control exceeds the potential loss.

(CSI) Certified Security Investigator Practice Test

(CSI) Certified Security Investigator Practice Test

CSI Threat Identification & Risk Management 2