Risk Analysis & Mitigation Strategies Flashcards

The FAIR (Factor Analysis of Information Risk) model decomposes risk into which two primary components?

Answer: Loss event frequency and probable loss magnitude

FAIR defines risk as a function of Loss Event Frequency (how often a loss occurs) and Probable Loss Magnitude (how much is lost).

A vulnerability assessor needs to communicate risk to non-technical executives. Which approach is MOST effective?

Answer: Map risks to business impact using financial and operational language

Executives make decisions based on business impact, so framing technical risks in financial and operational terms ensures effective communication.

Which document formally records identified risks, their likelihood, impact, mitigation strategies, and current status?

Answer: Risk register

A risk register is the authoritative document that tracks all identified risks along with their attributes and treatment status.

An organization's risk tolerance differs from its risk appetite in that risk tolerance specifically refers to:

Answer: The maximum acceptable variation from the risk appetite

Risk tolerance is the acceptable deviation or variance around the risk appetite level, representing operational flexibility in risk management.

When applying the NIST Risk Management Framework (RMF), which step involves selecting and implementing security controls based on risk categorization?

Answer: Implement

The Implement step in the NIST RMF involves deploying the security controls that were selected during the Select step.

A CVA candidate is reviewing a risk heat map. Which cell represents the HIGHEST priority for immediate treatment?

Answer: High likelihood, high impact

A combination of high likelihood and high impact produces the greatest overall risk level and demands the most urgent mitigation.

Which mitigation approach involves adding security controls that operate independently yet protect the same asset, ensuring protection if one control fails?

Answer: Defense in depth

Defense in depth layers multiple independent controls so that a failure in one does not expose the asset to successful attack.