CSS Security Risk Assessment & Analysis 3

Question 1

Which risk response strategy involves purchasing cyber insurance to offset potential financial losses from a breach?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial consequence of a risk to a third party, most commonly through insurance policies or contractual agreements.

Question 2

An organization uses the DREAD model to rate security risks. Which component of DREAD measures how easily an attack can be replicated by others?

Accepted Answer

Reproducibility

Answer

Reproducibility in the DREAD model scores how easily and consistently an attack can be repeated once the method is known.

Question 3

During a risk assessment workshop, participants disagree on risk ratings. Which technique uses rounds of anonymous voting and feedback to build consensus?

Accepted Answer

Delphi technique

Answer

The Delphi technique gathers expert opinions through multiple rounds of anonymous questionnaires with feedback, converging toward consensus without groupthink.

Question 4

A risk assessment reveals a high-severity vulnerability in a legacy system that cannot be patched. The organization deploys additional monitoring and firewall rules instead. This is an example of:

Accepted Answer

Compensating controls

Answer

Compensating controls are alternative safeguards applied when the primary control (patching) is not feasible, providing equivalent risk reduction.

Question 5

What does the Common Vulnerability Scoring System (CVSS) Base Score measure?

Accepted Answer

The intrinsic characteristics of a vulnerability independent of time or environment

Answer

The CVSS Base Score reflects the intrinsic qualities of a vulnerability—such as attack vector, complexity, and impact—that are constant over time and across environments.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Security Risk Assessment & Analysis 3