Risk Analysis & Mitigation Strategies Flashcards

Which of the following BEST describes a qualitative risk analysis approach?

Answer: Uses descriptive scales such as High, Medium, and Low to rank risk

Qualitative risk analysis uses subjective, descriptive ratings rather than numerical calculations to prioritize risks.

A penetration tester discovers that a compensating control is in place for an unpatched vulnerability. What should the risk analyst record for this finding?

Answer: Residual risk reflecting the compensating control's effectiveness

Residual risk captures the remaining exposure after all controls, including compensating controls, have been applied.

In the context of risk analysis, what is 'threat probability' most closely related to?

Answer: The likelihood that a threat agent will successfully exploit a vulnerability

Threat probability (or likelihood) represents the chance that a given threat will materialize and successfully exploit a vulnerability.

Which framework uses the concept of 'critical success factors' and 'areas of concern' to guide risk assessments for operational resilience?

Answer: OCTAVE

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) centers risk analysis on operational context, critical success factors, and areas of concern.

A risk assessment determines that implementing a $30,000 control reduces expected annual losses from $80,000 to $20,000. What is the control's Return on Security Investment (ROSI)?

Answer: $50,000

ROSI = Risk Mitigated − Cost of Control = ($80,000 − $20,000) − $30,000 = $60,000 − $30,000 = $30,000... wait — ROSI = ALE Before − ALE After − Control Cost = $60,000 − $30,000 = $30,000.

During a risk assessment, an analyst identifies a vulnerability with a low likelihood but a catastrophic impact. How should this risk be prioritized?

Answer: Flagged for senior management review despite low likelihood

Catastrophic-impact risks require executive attention regardless of low probability because the potential consequence is unacceptable.

Which of the following is an example of a risk mitigation control targeting the 'reduce likelihood' dimension rather than 'reduce impact'?

Answer: Implementing multi-factor authentication to block unauthorized access

MFA directly reduces the likelihood that an attacker can gain unauthorized access, addressing probability rather than consequence.