SSCP Certification SSCP Risk Management Process 4

Question 1

Which framework uses a five-step process including Frame, Assess, Respond, Monitor, and is published by NIST for organizational risk management?

Accepted Answer

NIST SP 800-39

Answer

NIST SP 800-39 'Managing Information Security Risk' defines the organization-wide risk management process with Frame, Assess, Respond, and Monitor steps.

Question 2

A threat source intentionally exploits a weakness in an application to gain unauthorized access. In risk terminology, what is the threat source in this scenario?

Accepted Answer

Threat agent

Answer

A threat agent (or threat actor) is the entity — human or otherwise — that intentionally or unintentionally initiates a threat event against a system.

Question 3

In a Delphi risk assessment technique, a group of experts anonymously provide risk estimates in multiple rounds. What is the primary advantage of this approach?

Accepted Answer

It reduces groupthink and anchoring bias by anonymizing expert opinions

Answer

The Delphi technique uses anonymized, iterative expert feedback to reach consensus while avoiding the social pressures that cause groupthink or anchoring bias.

Question 4

A Single Loss Expectancy (SLE) is calculated as:

Accepted Answer

Asset Value × Exposure Factor

Answer

SLE = Asset Value (AV) × Exposure Factor (EF), representing the expected loss from a single occurrence of a specific threat.

Question 5

Which risk analysis method uses attack trees, scenarios, and threat modeling to systematically identify risk without assigning specific monetary values?

Accepted Answer

Qualitative risk analysis

Answer

Qualitative risk analysis uses descriptive scales and scenario-based methods like attack trees to rank risks without requiring precise financial quantification.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Risk Management Process 4