CSS Security Risk Assessment & Analysis 3 — Questions and Answers
Question 1: Which risk response strategy involves purchasing cyber insurance to offset potential financial losses from a breach?
- Risk avoidance
- Risk mitigation
- Risk acceptance
- Risk transference (Correct answer)
Correct answer: Risk transference
Risk transference shifts the financial consequence of a risk to a third party, most commonly through insurance policies or contractual agreements.
Question 2: An organization uses the DREAD model to rate security risks. Which component of DREAD measures how easily an attack can be replicated by others?
- Damage Potential
- Exploitability
- Affected Users
- Reproducibility (Correct answer)
Correct answer: Reproducibility
Reproducibility in the DREAD model scores how easily and consistently an attack can be repeated once the method is known.
Question 3: During a risk assessment workshop, participants disagree on risk ratings. Which technique uses rounds of anonymous voting and feedback to build consensus?
- STRIDE analysis
- Delphi technique (Correct answer)
- Attack tree analysis
- Monte Carlo simulation
Correct answer: Delphi technique
The Delphi technique gathers expert opinions through multiple rounds of anonymous questionnaires with feedback, converging toward consensus without groupthink.
Question 4: A risk assessment reveals a high-severity vulnerability in a legacy system that cannot be patched. The organization deploys additional monitoring and firewall rules instead. This is an example of:
- Risk avoidance
- Risk acceptance
- Compensating controls (Correct answer)
- Risk transference
Correct answer: Compensating controls
Compensating controls are alternative safeguards applied when the primary control (patching) is not feasible, providing equivalent risk reduction.
Question 5: What does the Common Vulnerability Scoring System (CVSS) Base Score measure?
- The estimated cost to remediate a vulnerability
- The intrinsic characteristics of a vulnerability independent of time or environment (Correct answer)
- The likelihood that a vulnerability will be exploited in the next 90 days
- The number of systems affected by a given CVE
Correct answer: The intrinsic characteristics of a vulnerability independent of time or environment
The CVSS Base Score reflects the intrinsic qualities of a vulnerability—such as attack vector, complexity, and impact—that are constant over time and across environments.
Question 6: Which asset valuation method determines value based on what it would cost to replace an asset with one of equivalent functionality at today's prices?
- Original cost
- Replacement cost (Correct answer)
- Book value
- Salvage value
Correct answer: Replacement cost
Replacement cost valuation determines an asset's worth based on the current market cost to acquire or build an equivalent asset.
Question 7: In threat modeling, what is the purpose of identifying 'entry points'?
- To document which users have elevated privileges
- To enumerate the locations where a threat actor can interact with or inject data into a system (Correct answer)
- To define the financial boundaries of the assessment scope
- To list all approved software in the application inventory
Correct answer: To enumerate the locations where a threat actor can interact with or inject data into a system
Entry points define where attackers can interact with or introduce data into a system, helping focus threat modeling on the highest-exposure interfaces.
CSS Security Risk Assessment & Analysis 3
Which risk response strategy involves purchasing cyber insurance to offset potential financial losses from a breach?