SSCP Certification SSCP Risk Management Process 2

Question 1

A security analyst is comparing two risk treatment options. Option A costs $50,000 and reduces annual loss expectancy from $200,000 to $80,000. Option B costs $90,000 and reduces it to $40,000. Which metric best justifies selecting Option A?

Accepted Answer

Return on Security Investment (ROSI)

Answer

ROSI compares the reduction in annual loss expectancy against the cost of the control, making it the correct metric for comparing security investment options.

Question 2

During a risk assessment, a threat is identified with a likelihood of 0.3 and an impact of $500,000. What is the risk value using quantitative risk analysis?

Accepted Answer

$150,000

Answer

Quantitative risk value = Likelihood × Impact = 0.3 × $500,000 = $150,000 (Annualized Loss Expectancy concept).

Question 3

Which risk response strategy is being used when a company purchases cyber liability insurance to cover potential data breach costs?

Accepted Answer

Risk transfer

Answer

Purchasing insurance transfers the financial consequence of a risk to a third party (the insurer), which is the definition of risk transfer.

Question 4

A risk register entry shows a vulnerability with no known exploits and a patch available but not yet applied. Which qualitative risk rating is most appropriate?

Accepted Answer

Medium

Answer

No known active exploits lowers likelihood, but an unpatched vulnerability with available patch represents a moderate, manageable risk — typically rated Medium.

Question 5

What is the primary purpose of a risk appetite statement in an organization's risk management framework?

Accepted Answer

To define the level of risk the organization is willing to accept in pursuit of its objectives

Answer

A risk appetite statement formally defines how much risk an organization is willing to tolerate while pursuing its strategic objectives.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Risk Management Process 2