Assessment and Evaluation Flashcards

A risk assessor estimates a single theft would cost $40,000 and expects it to occur once every four years. What is the annualized loss expectancy (ALE)?

Answer: $10,000

ALE = SLE × ARO = $40,000 × 0.25 = $10,000.

What is the main purpose of a Design Basis Threat (DBT) in security evaluation?

Answer: To define the adversary attributes and capabilities the PPS must be designed and evaluated against

A DBT describes the adversary's numbers, tactics, weapons, tools, and insider help, which gives a fixed basis for design and evaluation.

Which evaluation approach judges a security program by how well it actually stops adversaries rather than by checking whether required features exist?

Answer: Performance-based evaluation

Performance-based evaluation measures how effective components are against the threat, while compliance-based evaluation only confirms requirements are met.

An assessor wants to estimate threat likelihood when historical data is scarce by gathering anonymous expert opinions over several rounds. Which technique fits?

Answer: Delphi technique

The Delphi technique moves anonymous expert judgments toward agreement through repeated rounds of feedback.

Why should detection ideally happen early in the adversary path, before most delay elements?

Answer: So the delay after detection gives the response force enough time to arrive

Delay only helps after detection, so detection must come first to start the response timeline.

Which statement best describes a 'functional test' of an intrusion sensor, as opposed to a full performance test?

Answer: It confirms the sensor is operating and reports an alarm, without measuring detection probability against defeat methods

Functional tests confirm basic operation, while performance tests measure effectiveness, such as P(D), under realistic conditions.

A facility's response force arrives in 6 minutes. After first detection, the adversary needs 4 minutes to reach and complete the task. What does this indicate?

Answer: The adversary will likely finish before interruption, so delay or detection must be improved

Interruption needs remaining adversary time to exceed response force time, and 4 minutes is less than 6.