CSS Security Risk Assessment & Analysis 2

Question 1

Which risk assessment methodology uses probability and impact ratings to produce a numerical risk score?

Accepted Answer

Quantitative risk assessment

Answer

Quantitative risk assessment assigns numerical values to probability and impact to calculate a numeric risk score such as Annual Loss Expectancy (ALE).

Question 2

A security analyst calculates that a server has a 25% chance of being compromised each year with an asset value of $200,000 and an exposure factor of 40%. What is the Annual Loss Expectancy (ALE)?

Accepted Answer

$20,000

Answer

ALE = SLE × ARO; SLE = $200,000 × 40% = $80,000; ALE = $80,000 × 0.25 = $20,000.

Question 3

In risk management, what does the term 'threat vector' refer to?

Accepted Answer

The path or means by which a threat actor gains access to a target

Answer

A threat vector is the specific path, method, or route a threat actor uses to gain unauthorized access to a system or network.

Question 4

Which framework specifically provides a five-function model (Identify, Protect, Detect, Respond, Recover) for managing cybersecurity risk?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities around five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 5

During a risk assessment, an organization identifies a vulnerability with no known exploit and no evidence of active threat actors targeting it. How should this risk be classified?

Accepted Answer

Low — likelihood is minimal given no active exploitation

Answer

Without an active threat actor or known exploit, the likelihood of exploitation is low, which lowers the overall risk rating even if the vulnerability is technically severe.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Security Risk Assessment & Analysis 2