CySA+ Test Risk Assessment 3

Question 1

A CySA+ analyst is using the FAIR (Factor Analysis of Information Risk) model. What does FAIR primarily focus on?

Accepted Answer

Quantifying risk in financial terms using probability and magnitude

Answer

FAIR is a quantitative framework that models risk as a function of probable frequency and probable magnitude of loss events.

Question 2

During threat modeling, which technique involves working backward from a defined adverse outcome to identify contributing causes?

Accepted Answer

Fault tree analysis

Answer

Fault tree analysis starts with an undesired top-level event and traces backward through logical branches to identify root causes and contributing failures.

Question 3

An analyst discovers that a critical web application has a vulnerability with a CVSS base score of 9.1. Which factor would LOWER the environmental score for this system?

Accepted Answer

The system is not internet-facing and sits behind multiple firewalls

Answer

Environmental scores account for existing mitigating controls; being isolated behind firewalls reduces the exploitability in the specific environment.

Question 4

Which risk concept describes the probability that a given threat will exploit a specific vulnerability within a defined time period?

Accepted Answer

Threat likelihood

Answer

Threat likelihood (also called probability) is the estimated chance that a threat event will occur and successfully exploit a vulnerability in a given timeframe.

Question 5

A security team is assessing supply chain risk. Which control BEST reduces third-party vendor risk?

Accepted Answer

Conducting periodic third-party security assessments and audits

Answer

Periodic independent assessments and audits provide objective evidence of a vendor's security posture beyond self-attestation.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Risk Assessment 3