CSS Security Risk Assessment & Analysis 2 — Questions and Answers
Question 1: Which risk assessment methodology uses probability and impact ratings to produce a numerical risk score?
- Qualitative risk assessment
- Quantitative risk assessment (Correct answer)
- Semi-quantitative risk assessment
- Residual risk assessment
Correct answer: Quantitative risk assessment
Quantitative risk assessment assigns numerical values to probability and impact to calculate a numeric risk score such as Annual Loss Expectancy (ALE).
Question 2: A security analyst calculates that a server has a 25% chance of being compromised each year with an asset value of $200,000 and an exposure factor of 40%. What is the Annual Loss Expectancy (ALE)?
- $20,000 (Correct answer)
- $80,000
- $50,000
- $200,000
Correct answer: $20,000
ALE = SLE × ARO; SLE = $200,000 × 40% = $80,000; ALE = $80,000 × 0.25 = $20,000.
Question 3: In risk management, what does the term 'threat vector' refer to?
- The financial impact of a realized threat
- The path or means by which a threat actor gains access to a target (Correct answer)
- The probability that a vulnerability will be exploited
- The category of assets most at risk
Correct answer: The path or means by which a threat actor gains access to a target
A threat vector is the specific path, method, or route a threat actor uses to gain unauthorized access to a system or network.
Question 4: Which framework specifically provides a five-function model (Identify, Protect, Detect, Respond, Recover) for managing cybersecurity risk?
- ISO/IEC 27005
- NIST Cybersecurity Framework (CSF) (Correct answer)
- OCTAVE Allegro
- FAIR model
Correct answer: NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities around five core functions: Identify, Protect, Detect, Respond, and Recover.
Question 5: During a risk assessment, an organization identifies a vulnerability with no known exploit and no evidence of active threat actors targeting it. How should this risk be classified?
- Critical — patch immediately regardless of threat activity
- Low — likelihood is minimal given no active exploitation (Correct answer)
- Residual — it will always remain after controls
- Inherent — it exists independent of any controls
Correct answer: Low — likelihood is minimal given no active exploitation
Without an active threat actor or known exploit, the likelihood of exploitation is low, which lowers the overall risk rating even if the vulnerability is technically severe.
Question 6: What is the primary purpose of a Business Impact Analysis (BIA) in the context of risk assessment?
- To enumerate all existing vulnerabilities in IT systems
- To determine the financial and operational effects of disruption to critical business functions (Correct answer)
- To assign risk ratings to each identified threat
- To document the results of penetration testing exercises
Correct answer: To determine the financial and operational effects of disruption to critical business functions
A BIA identifies critical business functions and quantifies the impact—financial, reputational, and operational—if those functions were disrupted.
Question 7: Which term describes the risk that remains after all planned security controls have been implemented?
- Inherent risk
- Secondary risk
- Residual risk (Correct answer)
- Transferred risk
Correct answer: Residual risk
Residual risk is the level of risk that persists after an organization has applied its security controls and mitigation measures.
CSS Security Risk Assessment & Analysis 2
Which risk assessment methodology uses probability and impact ratings to produce a numerical risk score?