MCTS 70-642 Risk Assessment & Management 5

Question 1

A Windows Server 2008 security team is implementing a defense-in-depth strategy. Which risk management principle does this strategy reflect by using multiple overlapping layers of controls?

Accepted Answer

Layered countermeasures

Answer

Defense-in-depth applies layered countermeasures so that if one control fails, subsequent layers continue to protect the asset.

Question 2

An administrator reviewing Windows Server 2008 security policy notices that the organization has not updated its risk assessment in two years. Which risk management best practice requires that risk assessments be revisited periodically or after major changes?

Accepted Answer

Continuous monitoring

Answer

Continuous monitoring ensures that the risk posture remains current by regularly reassessing threats, vulnerabilities, and controls as the environment changes.

Question 3

A Windows Server 2008 network faces a risk from an unpatched vulnerability. Management decides to segment the vulnerable server into an isolated VLAN with strict firewall rules rather than patching. Which risk response strategy does this represent?

Accepted Answer

Risk mitigation

Answer

Implementing network segmentation and firewall rules reduces the exploitability of the vulnerability, which is a risk mitigation (reduction) strategy.

Question 4

During a Windows Server 2008 environment risk assessment, which document formally records identified risks, their likelihood, impact ratings, assigned owners, and planned responses?

Accepted Answer

Risk register

Answer

A risk register is the formal repository that catalogs all identified risks along with their attributes, ownership, and treatment plans.

Question 5

A Windows Server 2008 administrator is assessing the risk of a worm outbreak. The Exposure Factor (EF) for the file server is determined to be 75%. What does this value represent?

Accepted Answer

The percentage of the asset's value that would be lost in a single incident

Answer

The Exposure Factor (EF) represents the proportion of an asset's value that would be lost or compromised in a single occurrence of a specific threat.

MCTS 70-642 Exam Practice Test

MCTS 70-642 Exam Practice Test

MCTS 70-642 Risk Assessment & Management 5