1.4 Compare Security Concepts 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is explaining risk to a new team member. The analyst states that risk is the potential for loss or damage when a threat exploits a vulnerability. Which additional factor must be considered to fully define risk in this context?

   • AThe likelihood of the threat exploiting the vulnerability and the resulting impact.
   • BThe cost of the security controls currently in place.
   • CThe number of vulnerabilities present in the system.
   • DThe type of threat actor that might exploit the vulnerability.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In a risk-scoring model, what does weighting typically represent?

   • AThe number of vulnerabilities associated with each asset
   • BThe speed at which a threat can propagate across the network
   • CThe relative importance of different risk factors, such as impact versus likelihood
   • DThe total cost of all security controls implemented
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In cybersecurity, which statement best defines risk?

   • AThe likelihood that a specific threat will exploit a vulnerability, combined with the resulting impact
   • BThe certainty that a vulnerability will be exploited by an external actor within a given year
   • CThe total number of vulnerabilities present in an organization's systems
   • DThe process of identifying and classifying assets based on their value to the organization
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A hospital's risk assessment identifies that its patient monitoring system has a critical vulnerability that cannot be patched without causing downtime. The system is essential for patient care. The hospital has a limited budget and cannot afford a full replacement. The risk team must decide on a risk treatment strategy. Which approach best balances patient safety and operational continuity?

   • AShut down the system until a patch is available
   • BAccept the risk and continue normal operations
   • CImplement network segmentation and monitoring to reduce the likelihood of exploitation
   • DPurchase cyber insurance to cover potential losses
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is performing a risk assessment for a manufacturing company. The analyst identifies two risks: Risk A has a likelihood score of 8 out of 10 and an impact score of 3 out of 10. Risk B has a likelihood score of 4 out of 10 and an impact score of 9 out of 10. The company's risk tolerance threshold is a risk score of 30. Using a simple multiplication model (likelihood × impact), which risk(s) require immediate action?

   • ARisk B only, because its risk score exceeds the threshold.
   • BBoth Risk A and Risk B, because both have at least one high score.
   • CNeither risk, because the threshold is too low to be meaningful.
   • DRisk A only, because its likelihood score is higher.
   Reveal Solution Discussion Select an answer first