SSP Risk Evaluation & Management 5

Question 1

A practitioner is reviewing a risk treatment plan and finds that the proposed control will reduce likelihood but NOT reduce consequence. What type of control is this?

Accepted Answer

A preventive control that reduces the probability of the threat event occurring

Answer

Controls that reduce likelihood are preventive—they make a threat event less likely without changing the severity if it does occur.

Question 2

During a risk review, a practitioner notes that a previously accepted risk has materially changed due to a new regulatory requirement. What risk management principle does this illustrate?

Accepted Answer

Risk is dynamic and must be continuously monitored and reassessed as conditions change

Answer

Risk management must be iterative; any material change in context—such as new regulations—can alter the risk level and invalidate prior acceptance decisions.

Question 3

An organization is applying a Monte Carlo simulation to model financial losses from security incidents. What is the PRIMARY advantage of this technique over a single-point ALE estimate?

Accepted Answer

It produces a range of probable outcomes with associated probabilities, capturing uncertainty better than a single estimate

Answer

Monte Carlo simulation runs thousands of scenarios with variable inputs, producing a probability distribution of losses that reflects real-world uncertainty better than a deterministic ALE.

Question 4

Which of the following scenarios BEST illustrates the concept of 'risk aggregation'?

Accepted Answer

Multiple low-rated risks combine to create an enterprise-level risk that exceeds the organization's risk tolerance

Answer

Risk aggregation occurs when individually acceptable risks collectively create an unacceptable cumulative exposure—a common blind spot in siloed risk management.

Question 5

A security practitioner is tasked with evaluating insider threat risk. Which data source would be MOST valuable for establishing a likelihood rating?

Accepted Answer

Historical internal incident records combined with industry benchmarking data on insider threat frequency

Answer

Insider threat likelihood is best estimated from the organization's own historical incidents supplemented by industry benchmarks that reflect comparable insider threat rates.

(SSP) Safety and Security Practitioner Certification Practice Test

(SSP) Safety and Security Practitioner Certification Practice Test

SSP Risk Evaluation & Management 5