SSCP Security Policies & Risk Management 2

Question 1

A risk manager determines that implementing a control costs $50,000 annually but the expected loss from the threat is only $10,000. What is the recommended action?

Accepted Answer

Accept the risk because the control cost exceeds expected loss

Answer

When annualized control cost exceeds the Annualized Loss Expectancy (ALE), accepting the risk is typically the economically rational choice.

Question 2

Which policy type defines the minimum security requirements that all systems in an organization must meet?

Accepted Answer

Baseline policy

Answer

Baseline policies establish the minimum acceptable security configuration standards applied across all organizational systems.

Question 3

During a risk assessment, the team identifies a vulnerability with no known exploit. How should residual risk be categorized?

Accepted Answer

Low to moderate, since exploitability is currently absent

Answer

Residual risk accounts for both vulnerability severity and current exploitability; no known exploit reduces but does not eliminate risk.

Question 4

What is the PRIMARY purpose of a Statement of Applicability (SoA) in an information security management system?

Accepted Answer

To document which controls from a standard are applicable and why

Answer

The SoA documents selected controls from a framework (e.g., ISO 27001 Annex A), including justifications for inclusion or exclusion.

Question 5

An organization's security policy prohibits personal device use on the corporate network, yet employees routinely connect personal phones. This represents which type of risk?

Accepted Answer

Policy non-compliance risk

Answer

When employees violate established policies, the resulting exposure is classified as policy non-compliance risk.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Policies & Risk Management 2