Risk Analysis & Mitigation Strategies Flashcards

Which of the following scenarios BEST illustrates a 'secondary risk' introduced by a risk mitigation action?

Answer: A firewall rule blocks an attacker but also disrupts legitimate business traffic

Secondary risks emerge as unintended consequences of control implementation, such as a firewall disrupting business operations while blocking threats.

An analyst is calculating risk using the formula Risk = Threat × Vulnerability × Asset Value. Which scenario reflects the LOWEST risk?

Answer: High threat, low vulnerability, low asset value

With high threat but low vulnerability and low asset value, the multiplicative result is significantly reduced compared to combinations with high values across all three factors.

A risk analyst identifies a new zero-day vulnerability with no available patch. Which mitigation strategy is MOST appropriate in the short term?

Answer: Implement compensating controls such as network segmentation and enhanced monitoring

When no patch exists, compensating controls like segmentation and monitoring reduce exposure and detect exploitation attempts until a patch is available.

Which of the following BEST describes the relationship between a threat, a vulnerability, and an exploit in risk analysis?

Answer: A threat is a potential harm source; a vulnerability is a weakness; an exploit is the mechanism used to leverage the weakness

In risk analysis, threats are potential harm sources, vulnerabilities are weaknesses, and exploits are the specific techniques that turn vulnerabilities into realized threats.

An organization wants to measure the effectiveness of its risk mitigation controls over time. Which metric is MOST useful?

Answer: Reduction in residual risk after control implementation

Tracking the reduction in residual risk directly measures whether implemented controls are achieving the intended decrease in exposure.

During risk prioritization, an analyst uses a 5×5 risk matrix. A risk rated 4 (likelihood) × 5 (impact) should be compared to a risk rated 5 × 4. What is TRUE about these two risks?

Answer: They are equal in aggregate risk score but may warrant different responses

Both risks produce a score of 20, so their aggregate risk is equal, but treatment strategies may differ based on whether managing likelihood or impact is more feasible.

Which phase of the risk management lifecycle involves continuously monitoring the risk environment to identify changes that could affect the risk profile?

Answer: Risk monitoring and review

Risk monitoring and review is the ongoing phase that detects new risks, evaluates control effectiveness, and updates the risk register as conditions change.