Microsoft Networking Essentials Exam Risk Assessment & Management 5

Question 1

A third-party vendor with access to your network is compromised, leading to a breach of your systems. This scenario is an example of:

Accepted Answer

Supply chain risk

Answer

Supply chain risk occurs when a trusted partner or vendor introduces vulnerabilities into your environment.

Question 2

Which document formally authorizes the operation of an IT system by accepting its residual risk?

Accepted Answer

Authority to Operate (ATO)

Answer

An ATO is an official management decision to authorize operation of a system, acknowledging and accepting its residual risk.

Question 3

During risk prioritization, an analyst should address which combination FIRST?

Accepted Answer

High likelihood, high impact

Answer

Risks with both high likelihood and high impact pose the greatest overall threat and should be addressed first.

Question 4

What is the MAIN difference between a threat and a vulnerability in risk terminology?

Accepted Answer

A threat is a potential danger; a vulnerability is a weakness that can be exploited

Answer

A threat is any circumstance or event that could exploit a vulnerability, while a vulnerability is the specific weakness being exploited.

Question 5

A company installs an intrusion prevention system (IPS) to automatically block detected attacks. This is an example of which type of control?

Accepted Answer

Preventive

Answer

A preventive control stops attacks before they cause damage, which an IPS does by blocking malicious traffic in real time.

Microsoft Networking Essentials Exam Practice Test