Risk Assessment Flashcards

In the NIST SP 800-30 risk assessment framework, which step directly follows threat and vulnerability identification?

Answer: Likelihood determination

After identifying threats and vulnerabilities, NIST SP 800-30 calls for determining the likelihood that a threat will exploit a vulnerability.

Which of the following BEST describes the purpose of network segmentation in the context of PCI DSS risk reduction?

Answer: It reduces the scope and attack surface of the cardholder data environment

Network segmentation limits the CDE scope by isolating cardholder data systems, thereby reducing the number of systems subject to PCI DSS requirements and the overall attack surface.

A risk assessment finds that a payment terminal vendor's remote access credentials are shared among multiple technicians. The PRIMARY risk this creates is:

Answer: Inability to attribute actions to individuals, undermining accountability

Shared credentials prevent individual accountability, making it impossible to trace malicious or erroneous actions to a specific person, which violates PCI DSS access control principles.

Which of the following scenarios represents risk AVOIDANCE as a treatment strategy?

Answer: Discontinuing a high-risk paper-based order process that captures full PANs

Risk avoidance eliminates the risk entirely by stopping the activity that creates it, such as discontinuing a risky business process.

When prioritizing risk remediation in a PCI DSS environment, which factor should be weighted MOST heavily?

Answer: The combination of likelihood and impact on cardholder data confidentiality

Prioritization should focus on risks with high likelihood of exploitation and high potential impact on cardholder data, aligning remediation efforts with actual CDE exposure.

A PCIP is asked to validate a risk assessment that was conducted entirely by the IT department without business stakeholder input. The PRIMARY concern is:

Answer: Business context and operational risks may be missed without cross-functional input

Effective risk assessments require input from business stakeholders to capture operational context, business process risks, and impact to business-critical functions.

Which of the following is a characteristic of a MATURE organizational risk management program in a PCI DSS context?

Answer: Risks are continuously monitored with defined key risk indicators and escalation thresholds

A mature program features continuous monitoring with defined KRIs and escalation paths, rather than point-in-time assessments driven only by external requirements.