SSCP Risk Management & Compliance

Question 1

Which risk management approach involves accepting the potential loss from a risk because the cost of mitigation exceeds the benefit?

Accepted Answer

Risk acceptance

Answer

Risk acceptance (also called risk tolerance or risk retention) is chosen when the cost of countermeasures outweighs the potential impact of the risk.

Question 2

What is the formula for calculating Annualized Loss Expectancy (ALE)?

Accepted Answer

ALE = SLE × ARO

Answer

ALE equals Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO), representing the expected annual loss from a threat.

Question 3

Which framework provides a structured, flexible approach to managing cybersecurity risk and is widely adopted in US critical infrastructure?

Accepted Answer

NIST Cybersecurity Framework

Answer

The NIST Cybersecurity Framework (CSF) was specifically designed for US critical infrastructure and organizes practices around Identify, Protect, Detect, Respond, and Recover functions.

Question 4

A qualitative risk assessment differs from a quantitative risk assessment primarily because it:

Accepted Answer

Uses descriptive ratings like High, Medium, and Low instead of exact numbers

Answer

Qualitative assessments use subjective ratings and descriptive scales (e.g., High/Medium/Low) rather than precise monetary calculations, making them faster but less precise.

Question 5

Which term describes the remaining risk after security controls have been applied?

Accepted Answer

Residual risk

Answer

Residual risk is the risk that remains after safeguards or controls have been implemented to reduce the original (inherent) risk.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Risk Management & Compliance