CSP Threat Evaluation & Risk Analysis 3 — Questions and Answers
Question 1: A risk analyst calculates that a warehouse has a 15% annual probability of experiencing cargo theft. This figure represents the:
- Single loss expectancy
- Annualized rate of occurrence (Correct answer)
- Residual risk value
- Asset exposure factor
Correct answer: Annualized rate of occurrence
The annualized rate of occurrence (ARO) expresses the estimated frequency with which a specific threat is expected to occur within a one-year period.
Question 2: When evaluating threats in a high-rise office building, which factor would most significantly increase the vulnerability rating for the lobby?
- Presence of security cameras at all entry points
- Lack of visitor management system and open access to elevators (Correct answer)
- High volume of foot traffic during business hours
- Proximity to a fire station
Correct answer: Lack of visitor management system and open access to elevators
The absence of a visitor management system combined with unrestricted elevator access eliminates layered access control, dramatically increasing lobby vulnerability.
Question 3: A threat evaluation matrix rates threat actors on capability and intent. An actor with HIGH capability but LOW intent should be classified as:
- Highest priority threat requiring immediate countermeasures
- Moderate concern requiring monitoring but not immediate action (Correct answer)
- No threat and removed from analysis
- Immediate arrest and prosecution
Correct answer: Moderate concern requiring monitoring but not immediate action
High capability with low intent warrants monitoring because intent can change, but does not yet justify the same countermeasure investment as a high-capability, high-intent actor.
Question 4: During a risk assessment at a data center, the analyst identifies that backup power systems have not been tested in 18 months. This finding most directly affects which risk component?
- Threat likelihood
- Asset criticality
- Countermeasure effectiveness (Correct answer)
- Threat actor capability
Correct answer: Countermeasure effectiveness
Untested backup power systems cannot be relied upon, reducing the effectiveness of this countermeasure and increasing overall residual risk.
Question 5: Social engineering attacks targeting employees with legitimate system access are most effectively countered at which risk mitigation level?
- Physical barrier enhancement
- Personnel security and awareness training (Correct answer)
- Network perimeter hardening
- Surveillance camera density increase
Correct answer: Personnel security and awareness training
Since social engineering exploits human behavior rather than physical or technical gaps, personnel security awareness training directly addresses the root vulnerability.
Question 6: A risk register entry shows a threat with HIGH impact but VERY LOW likelihood. The recommended risk treatment strategy is typically:
- Accept the risk without any mitigation investment
- Transfer the risk through insurance or contractual means (Correct answer)
- Eliminate all operations that create this risk
- Deploy maximum available countermeasures immediately
Correct answer: Transfer the risk through insurance or contractual means
For high-impact, low-likelihood risks, risk transfer (such as insurance) is typically cost-effective because mitigation investment may exceed expected loss value.
Question 7: A surveillance professional reviewing CCTV footage identifies an unknown individual accessing a server room using a valid badge. The most appropriate immediate action is:
- Delete the footage to avoid a compliance violation
- Notify the access control administrator and security management (Correct answer)
- Physically detain the individual immediately
- Wait to see if the individual exits normally before taking action
Correct answer: Notify the access control administrator and security management
Immediately notifying access control administrators and security management enables a coordinated response and investigation while preserving evidence.
CSP Threat Evaluation & Risk Analysis 3
A risk analyst calculates that a warehouse has a 15% annual probability of experiencing cargo theft.
This figure represents the: