SSP Risk Evaluation & Management 3

Question 1

An organization uses the DELPHI technique during a risk assessment. What is the defining characteristic of this approach?

Accepted Answer

Experts provide anonymous, iterative estimates that are reconciled through successive rounds

Answer

The Delphi technique uses anonymous, iterative rounds of expert input to reach consensus while avoiding groupthink.

Question 2

A quantitative risk analysis produces a probability distribution of possible losses. What does the 95th percentile value on this distribution represent?

Accepted Answer

There is a 5% chance that losses will exceed this value in a given period

Answer

The 95th percentile means there is a 5% probability that losses will exceed that threshold, commonly used to set worst-case planning budgets.

Question 3

Which risk register field is MOST critical for tracking the effectiveness of a risk treatment plan over time?

Accepted Answer

Target risk rating and review date for post-treatment reassessment

Answer

A target risk rating with a scheduled review date allows practitioners to verify whether treatment reduced risk to the desired level.

Question 4

An organization is deciding whether to self-insure or purchase third-party insurance for a specific risk. Which factor MOST strongly favors purchasing insurance?

Accepted Answer

The potential loss magnitude is catastrophic and would threaten organizational survival

Answer

Insurance is most valuable when a single loss event could be catastrophic, since self-insurance only makes sense when the organization can absorb the maximum likely loss.

Question 5

A security practitioner performing a business impact analysis (BIA) identifies that a payroll system has a Recovery Time Objective (RTO) of 4 hours. What does this mean for risk management?

Accepted Answer

Any risk treatment must ensure the system can be restored within 4 hours of a disruption

Answer

An RTO of 4 hours means risk controls must support restoring the payroll system within that window to meet business continuity requirements.

(SSP) Safety and Security Practitioner Certification Practice Test

(SSP) Safety and Security Practitioner Certification Practice Test

SSP Risk Evaluation & Management 3