Microsoft Networking Essentials Exam Risk Assessment & Management 5

Question 1

A third-party vendor with access to your network is compromised, leading to a breach of your systems. This scenario is an example of:

Accepted Answer

Supply chain risk

Answer

Zero-day exploit

Answer

Insider threat

Answer

Social engineering

Question 2

Which document formally authorizes the operation of an IT system by accepting its residual risk?

Accepted Answer

Authority to Operate (ATO)

Answer

System Security Plan (SSP)

Answer

Risk Treatment Plan

Answer

Incident Response Plan

Question 3

During risk prioritization, an analyst should address which combination FIRST?

Accepted Answer

High likelihood, high impact

Answer

Low likelihood, high impact

Answer

High likelihood, low impact

Answer

Low likelihood, low impact

Question 4

What is the MAIN difference between a threat and a vulnerability in risk terminology?

Accepted Answer

A threat is a potential danger; a vulnerability is a weakness that can be exploited

Answer

A threat is internal; a vulnerability is external

Answer

A vulnerability causes harm directly; a threat only describes weakness

Answer

They are interchangeable terms

Question 5

A company installs an intrusion prevention system (IPS) to automatically block detected attacks. This is an example of which type of control?

Accepted Answer

Preventive

Answer

Deterrent

Answer

Detective

Answer

Compensating

Question 6

Which standard provides a globally recognized framework for establishing, implementing, and improving an Information Security Management System (ISMS)?

Accepted Answer

ISO/IEC 27001

Answer

NIST SP 800-53

Answer

PCI DSS

Answer

SOC 2 Type II

Question 7

An organization decides to stop offering a particular online service because the security risks are too great to manage. This is an example of:

Accepted Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transference