CVA Risk Analysis & Mitigation Strategies 5

Question 1

Which of the following scenarios BEST illustrates a 'secondary risk' introduced by a risk mitigation action?

Accepted Answer

A firewall rule blocks an attacker but also disrupts legitimate business traffic

Answer

Secondary risks emerge as unintended consequences of control implementation, such as a firewall disrupting business operations while blocking threats.

Question 2

An analyst is calculating risk using the formula Risk = Threat × Vulnerability × Asset Value. Which scenario reflects the LOWEST risk?

Accepted Answer

High threat, low vulnerability, low asset value

Answer

With high threat but low vulnerability and low asset value, the multiplicative result is significantly reduced compared to combinations with high values across all three factors.

Question 3

A risk analyst identifies a new zero-day vulnerability with no available patch. Which mitigation strategy is MOST appropriate in the short term?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring

Answer

When no patch exists, compensating controls like segmentation and monitoring reduce exposure and detect exploitation attempts until a patch is available.

Question 4

Which of the following BEST describes the relationship between a threat, a vulnerability, and an exploit in risk analysis?

Accepted Answer

A threat is a potential harm source; a vulnerability is a weakness; an exploit is the mechanism used to leverage the weakness

Answer

In risk analysis, threats are potential harm sources, vulnerabilities are weaknesses, and exploits are the specific techniques that turn vulnerabilities into realized threats.

Question 5

An organization wants to measure the effectiveness of its risk mitigation controls over time. Which metric is MOST useful?

Accepted Answer

Reduction in residual risk after control implementation

Answer

Tracking the reduction in residual risk directly measures whether implemented controls are achieving the intended decrease in exposure.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA Risk Analysis & Mitigation Strategies 5