CVA Risk Analysis & Mitigation Strategies 2

Question 1

A quantitative risk analysis assigns a probability of 0.3 to a threat event and an asset value of $500,000 with an exposure factor of 40%. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$60,000

Answer

ALE = SLE × ARO = ($500,000 × 0.40) × 0.3 = $200,000 × 0.3 = $60,000.

Question 2

Which risk mitigation strategy involves outsourcing risk to a third party such as purchasing cyber liability insurance?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial consequence of a risk to another party, such as an insurance provider.

Question 3

During a risk assessment, a vulnerability is found with a CVSS base score of 9.8 but the asset has no internet exposure. Which factor most appropriately adjusts the effective risk?

Accepted Answer

Environmental score modifier

Answer

The CVSS Environmental score allows organizations to adjust the base score based on their specific deployment environment, including network exposure.

Question 4

A risk register entry shows a residual risk that exceeds the organization's risk appetite. What is the MOST appropriate next step?

Accepted Answer

Apply additional controls to further reduce risk

Answer

When residual risk exceeds the defined risk appetite, additional controls must be implemented to bring risk within acceptable thresholds.

Question 5

What does the term 'risk appetite' describe in an organizational security context?

Accepted Answer

The amount of risk an organization is willing to accept in pursuit of its objectives

Answer

Risk appetite is the level of risk an organization is willing to tolerate while pursuing its strategic goals.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA Risk Analysis & Mitigation Strategies 2