A security team is prioritizing risks for remediation. They have identified three risks: Risk 1 has a likelihood of 5 and an impact of 5. Risk 2 has a likelihood of 9 and an impact of 2. Risk 3 has a likelihood of 3 and an impact of 10. The team decides to weight impact more heavily than likelihood, using a formula of (likelihood × 0.4) + (impact × 0.6). Which risk should be prioritized first?

Risk 2, because it has the highest likelihood.

Risk 3, because it has the highest weighted score.

Risk 1, because it has the highest combined score.

All risks should be prioritized equally, because they all have the same total score.

A company's firewall has a rule that allows inbound traffic from any source to the internal network. An attacker discovers this rule and uses it to gain unauthorized access. In this scenario, what is the vulnerability?

The attacker's unauthorized access

The firewall rule allowing inbound traffic from any source

What is the primary purpose of assigning a numeric score to risks during a risk assessment?

To eliminate the need for qualitative analysis in the assessment process

To satisfy regulatory requirements that mandate a specific scoring formula

To prioritize risks so that the most significant ones receive attention first

To guarantee that all risks are treated equally regardless of their characteristics

CiscoCertified CyberOps Associate

Domain 1Objective 4

1.4 Compare Security Concepts 200-201 Practice Questions (Page 6)

Part of the 1.0 Security Concepts domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

20%of the exam

Questions 26–30

26foundation · easy
When an organization decides to discontinue a business process because the risk associated with it is too high, which risk management strategy is being applied?
Select an answer first
27application · medium
A security team is prioritizing risks for remediation. They have identified three risks: Risk 1 has a likelihood of 5 and an impact of 5. Risk 2 has a likelihood of 9 and an impact of 2. Risk 3 has a likelihood of 3 and an impact of 10. The team decides to weight impact more heavily than likelihood, using a formula of (likelihood × 0.4) + (impact × 0.6). Which risk should be prioritized first?
Select an answer first
28application · medium
A company's firewall has a rule that allows inbound traffic from any source to the internal network. An attacker discovers this rule and uses it to gain unauthorized access. In this scenario, what is the vulnerability?
Select an answer first
29foundation · easy
What is the primary purpose of assigning a numeric score to risks during a risk assessment?
Select an answer first
30application · medium
A security team is investigating a data breach at a defense contractor. The attackers used sophisticated zero-day exploits and targeted specific intellectual property. The attack appears to be sponsored by a foreign government. Which threat actor category best describes this attacker?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

1.4 Compare Security Concepts 200-201 Practice Questions (Page 6)

Questions 26–30

When an organization decides to discontinue a business process because the risk associated with it is too high, which risk management strategy is being applied?

A company's firewall has a rule that allows inbound traffic from any source to the internal network. An attacker discovers this rule and uses it to gain unauthorized access. In this scenario, what is the vulnerability?

What is the primary purpose of assigning a numeric score to risks during a risk assessment?

A security team is investigating a data breach at a defense contractor. The attackers used sophisticated zero-day exploits and targeted specific intellectual property. The attack appears to be sponsored by a foreign government. Which threat actor category best describes this attacker?

Keep studying — 1.0 Security Concepts