Risk Assessment Flashcards

In quantitative risk analysis, Annualized Loss Expectancy (ALE) is calculated as:

Answer: ALE = Single Loss Expectancy × Annualized Rate of Occurrence

ALE equals SLE multiplied by ARO, representing the expected annual financial loss from a specific risk.

Which risk treatment option involves purchasing cyber insurance to cover potential cardholder data breach losses?

Answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as an insurer, without eliminating the underlying risk.

A new e-commerce checkout feature is being deployed that will process card-not-present transactions. When should a risk assessment be conducted?

Answer: Before the feature is deployed, as a significant environmental change

PCI DSS requires risk assessments upon significant changes to the cardholder data environment, and a new payment feature qualifies as such a change.

Which asset classification BEST describes PANs stored in an encrypted database within the cardholder data environment?

Answer: Sensitive cardholder data requiring protection

PANs are classified as sensitive cardholder data and must be protected per PCI DSS even when encrypted, as they remain within scope.

During a risk assessment workshop, a stakeholder suggests accepting a high-rated risk because remediation is too costly. As a PCIP, you should:

Answer: Document the formal risk acceptance with executive sign-off and set a review date

Risk acceptance is a valid treatment option but must be formally documented with executive approval and a defined review timeline.

Which of the following BEST represents a vulnerability in the context of PCI DSS risk assessment?

Answer: An unpatched operating system running on a POS terminal

A vulnerability is a weakness in a system, such as an unpatched OS, that a threat could exploit; threats and impacts are separate risk components.

A risk register entry shows: Threat=Phishing, Vulnerability=No email filtering, Likelihood=High, Impact=High. Which action is MOST appropriate?

Answer: Implement email filtering controls as a priority mitigation

A High/High risk with an identifiable control gap (missing email filtering) should be prioritized for mitigation with the specific control that closes the gap.