SSP Risk Evaluation & Management 2

Question 1

A security manager is comparing two risk treatment options. Option A has an annualized loss expectancy (ALE) of $80,000 and costs $20,000 to implement. Option B has an ALE of $50,000 and costs $60,000 to implement. Which option provides better value?

Accepted Answer

Option A, because the net benefit ($60,000 reduction) exceeds its cost by more

Answer

Option A yields a net benefit of $60,000 (ALE reduction) minus $20,000 (cost) = $40,000 net benefit, while Option B yields $30,000 minus $60,000 = -$30,000 net loss.

Question 2

During a risk assessment, a practitioner discovers that a critical asset has no documented owner. What is the MOST significant consequence of this gap?

Accepted Answer

No one is accountable for accepting, treating, or monitoring risk to that asset

Answer

Without an asset owner, accountability for risk decisions—accept, treat, transfer, or avoid—is undefined, leaving the asset unmanaged.

Question 3

Which risk treatment strategy is being applied when an organization decides to discontinue a product line that carries unacceptable cybersecurity risk?

Accepted Answer

Risk avoidance

Answer

Risk avoidance eliminates the activity or condition that creates the risk, such as discontinuing a product line.

Question 4

A risk matrix uses likelihood and consequence axes. A threat rated 'possible' (3/5) with 'major' consequences (4/5) produces a risk score of 12. The organization's risk appetite threshold is 10. What action is required?

Accepted Answer

The risk must be treated because it exceeds the risk appetite threshold

Answer

A risk score of 12 exceeds the threshold of 10, so the organization's risk appetite requires a treatment plan.

Question 5

What is the primary purpose of a residual risk assessment conducted AFTER implementing security controls?

Accepted Answer

To determine whether remaining risk falls within the organization's risk acceptance criteria

Answer

Residual risk assessment verifies that the post-control risk level is acceptable relative to the organization's defined tolerance.

(SSP) Safety and Security Practitioner Certification Practice Test

(SSP) Safety and Security Practitioner Certification Practice Test

SSP Risk Evaluation & Management 2