Risk Analysis & Mitigation Strategies Flashcards
7 cards from real CVA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Analysis & Mitigation Strategies flashcards as text
A quantitative risk analysis assigns a probability of 0.3 to a threat event and an asset value of $500,000 with an exposure factor of 40%. What is the Annualized Loss Expectancy (ALE)?
Answer: $60,000
ALE = SLE × ARO = ($500,000 × 0.40) × 0.3 = $200,000 × 0.3 = $60,000.
Which risk mitigation strategy involves outsourcing risk to a third party such as purchasing cyber liability insurance?
Answer: Risk transference
Risk transference shifts the financial consequence of a risk to another party, such as an insurance provider.
During a risk assessment, a vulnerability is found with a CVSS base score of 9.8 but the asset has no internet exposure. Which factor most appropriately adjusts the effective risk?
Answer: Environmental score modifier
The CVSS Environmental score allows organizations to adjust the base score based on their specific deployment environment, including network exposure.
A risk register entry shows a residual risk that exceeds the organization's risk appetite. What is the MOST appropriate next step?
Answer: Apply additional controls to further reduce risk
When residual risk exceeds the defined risk appetite, additional controls must be implemented to bring risk within acceptable thresholds.
What does the term 'risk appetite' describe in an organizational security context?
Answer: The amount of risk an organization is willing to accept in pursuit of its objectives
Risk appetite is the level of risk an organization is willing to tolerate while pursuing its strategic goals.
Which threat modeling methodology focuses on identifying security objectives, decomposing applications, identifying threats, and then ranking them?
Answer: DREAD
DREAD is a threat ranking model that scores threats on Damage, Reproducibility, Exploitability, Affected users, and Discoverability.
An organization decides to discontinue a legacy application because the cost of patching exceeds the asset's value. Which risk response is being applied?
Answer: Risk avoidance
Discontinuing the application eliminates the risk entirely by removing the activity or asset that creates the risk, which is risk avoidance.
How this page was made: written with AI tools. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- mile2.com — Test delivery, eligibility, retake policy, score validity, passing score, fees · verified Oct 2026