Risk Assessment Flashcards

A security analyst is performing a risk assessment and needs to calculate the Annualized Loss Expectancy (ALE). Which formula is correct?

Answer: ALE = SLE × ARO

ALE equals Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO).

During a risk assessment, a finding is classified as high likelihood but low impact. Which risk response is MOST appropriate?

Answer: Implement low-cost mitigating controls

High-likelihood, low-impact risks are best addressed with proportionate, low-cost controls rather than expensive remediation or full acceptance.

Which risk assessment methodology uses likelihood and impact ratings to produce a risk score matrix?

Answer: Qualitative risk assessment

Qualitative risk assessment assigns descriptive ratings (e.g., High/Medium/Low) for likelihood and impact, plotted on a risk matrix.

A company wants to quantify risk in financial terms to justify security spending to executives. Which approach is BEST suited?

Answer: Quantitative risk assessment

Quantitative risk assessment assigns numerical monetary values to assets, losses, and probabilities, making it easier to justify budget to executives.

What does the term 'residual risk' refer to in a risk management context?

Answer: Risk remaining after controls have been applied

Residual risk is the level of risk that remains after security controls and mitigations have been implemented.

An organization accepts a risk without implementing additional controls. Which risk treatment strategy does this represent?

Answer: Risk acceptance

Risk acceptance means acknowledging a risk and deliberately choosing not to implement additional controls, often when the cost of control exceeds the potential loss.

Which document formally records identified risks, their likelihood, impact, owner, and current treatment status?

Answer: Risk register

A risk register is the central document that tracks all identified risks along with their attributes, owners, and treatment plans.