CVA Risk Analysis & Mitigation Strategies 3

Question 1

Which of the following BEST describes a qualitative risk analysis approach?

Accepted Answer

Uses descriptive scales such as High, Medium, and Low to rank risk

Answer

Qualitative risk analysis uses subjective, descriptive ratings rather than numerical calculations to prioritize risks.

Question 2

A penetration tester discovers that a compensating control is in place for an unpatched vulnerability. What should the risk analyst record for this finding?

Accepted Answer

Residual risk reflecting the compensating control's effectiveness

Answer

Residual risk captures the remaining exposure after all controls, including compensating controls, have been applied.

Question 3

In the context of risk analysis, what is 'threat probability' most closely related to?

Accepted Answer

The likelihood that a threat agent will successfully exploit a vulnerability

Answer

Threat probability (or likelihood) represents the chance that a given threat will materialize and successfully exploit a vulnerability.

Question 4

Which framework uses the concept of 'critical success factors' and 'areas of concern' to guide risk assessments for operational resilience?

Accepted Answer

OCTAVE

Answer

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) centers risk analysis on operational context, critical success factors, and areas of concern.

Question 5

A risk assessment determines that implementing a $30,000 control reduces expected annual losses from $80,000 to $20,000. What is the control's Return on Security Investment (ROSI)?

Accepted Answer

$50,000

Answer

ROSI = Risk Mitigated − Cost of Control = ($80,000 − $20,000) − $30,000 = $60,000 − $30,000 = $30,000... wait — ROSI = ALE Before − ALE After − Control Cost = $60,000 − $30,000 = $30,000.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA Risk Analysis & Mitigation Strategies 3