Risk Management Practice Questions

Answers and explanations appear when you work through the set above.

1. A risk committee must prioritize several risks whose likelihood data is too sparse for reliable dollar estimates. Which approach is BEST?

   • Use qualitative scales with documented criteria and expert input.
   • Assign every risk the highest possible ALE until better data exists.
   • Exclude risks that cannot be expressed as precise monetary values.
   • Average the asset values and apply one organization-wide exposure factor.

2. Management decides that a low-likelihood risk is within the approved risk appetite and records the decision without adding controls. Which risk treatment is this?

   • Risk transfer
   • Risk avoidance
   • Risk mitigation through additional controls
   • Risk acceptance

3. In the NIST Risk Management Framework, which activity follows implementation of selected controls and determines whether they are operating as intended?

   • Categorize
   • Assess
   • Authorize
   • Monitor

4. An organization wants an information-security risk-management process aligned with its broader ISO/IEC 27001 information security management system. Which guidance is MOST directly relevant for structuring the risk process?

   • ISO/IEC 27005
   • ISO/IEC 27002 only
   • NIST SP 800-53
   • RFC 2196

5. A design team is modeling a new web service and wants a systematic prompt for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Which method should the security manager recommend?

   • DREAD
   • PASTA
   • STRIDE
   • BIA

6. A company is onboarding a cloud analytics provider that will process regulated customer data. What is the FIRST risk-management action?

   • Require the provider to use the company's exact firewall platform.
   • Identify data, service dependencies, and supplier risks before selecting controls.
   • Purchase cyber insurance and treat the supplier risk as transferred.
   • Wait for the provider's next annual audit report before identifying any contractual security requirements.

7. During a business impact analysis, which result BEST supports setting recovery priorities for a customer-ordering application?

   • The preferred brand of backup appliance
   • The number of firewall rules protecting the application
   • Maximum tolerable downtime and the business impact over time
   • The average number of security alerts generated each month

8. Which security-awareness program measure is MOST useful to management when evaluating whether training reduces phishing risk?

   • Completion rates plus changes in simulated-phishing reporting and clicks
   • The number of training slides presented to each employee during the annual course
   • The number of security policies published on the intranet and the frequency of policy updates
   • The annual learning-management license cost and the cost per registered employee

9. A threat model rates a likely attack as having severe business impact, but the team has not yet confirmed which trust boundary the attack crosses. What is the BEST next step?

   • Immediately implement every available security control.
   • Use DREAD scores to select controls without validating the architecture or locating the relevant trust boundary.
   • Validate assets, data flows, and trust boundaries with stakeholders before treatment.
   • Remove the threat from the model because likelihood is not yet exact.