SSCP Certification SSCP Risk Management Process 2

Question 1

A security analyst is comparing two risk treatment options.
Option A costs $50,000 and reduces annual loss expectancy from $200,000 to $80,000.
Option B costs $90,000 and reduces it to $40,000.
Which metric best justifies selecting Option A?

Accepted Answer

Return on Security Investment (ROSI)

Answer

Mean Time to Recovery (MTTR)

Answer

Control Objectives for Information Technology (COBIT)

Answer

Business Impact Analysis (BIA)

Question 2

During a risk assessment, a threat is identified with a likelihood of 0.3 and an impact of $500,000. What is the risk value using quantitative risk analysis?

Accepted Answer

$150,000

Answer

$500,000

Answer

$166,667

Answer

$1,500,000

Question 3

Which risk response strategy is being used when a company purchases cyber liability insurance to cover potential data breach costs?

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 4

A risk register entry shows a vulnerability with no known exploits and a patch available but not yet applied. Which qualitative risk rating is most appropriate?

Accepted Answer

Medium

Answer

Critical

Answer

Low

Answer

High

Question 5

What is the primary purpose of a risk appetite statement in an organization's risk management framework?

Accepted Answer

To define the level of risk the organization is willing to accept in pursuit of its objectives

Answer

To enumerate all identified threats and vulnerabilities

Answer

To assign dollar values to potential losses

Answer

To document regulatory compliance requirements

Question 6

During a risk assessment, the team identifies that a flood has a 1-in-10 chance of occurring each year and would cause $300,000 in damages. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$30,000

Answer

$300,000

Answer

$3,000,000

Answer

$3,000

Question 7

Which document formally records identified risks, their severity, owners, and treatment plans in a structured format?

Accepted Answer

Risk register

Answer

Business continuity plan

Answer

Security policy

Answer

Vulnerability assessment report