1.6 Analyze Elements of a Risk Analysis (combination Asset, Vulnerability, and Threat) 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key advantage of using a quantitative risk analysis method?

   • AIt requires less data and can be completed quickly with expert opinions
   • BIt provides objective, numeric results that can be used for cost-benefit analysis
   • CIt is the only method accepted by regulatory frameworks such as NIST
   • DIt eliminates the need to identify assets, threats, and vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which formula correctly represents the calculation of risk in a quantitative risk analysis?

   • ARisk = Likelihood × Impact
   • BRisk = Threat × Vulnerability
   • CRisk = Asset Value × Threat
   • DRisk = Vulnerability × Impact
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A hospital's patient portal is hosted on a web server that stores protected health information (PHI). A recent scan found that the server runs an outdated version of the web application framework with a known remote code execution vulnerability. The IT team is performing a risk analysis and needs to calculate the risk score for this asset. Which combination of factors should be used to calculate the risk score?

   • AThe severity rating of the vulnerability and the number of users who access the portal
   • BThe number of vulnerabilities found on the server and the cost of the server hardware
   • CThe probability of a natural disaster affecting the data center and the cost of downtime
   • DThe likelihood that the vulnerability will be exploited and the impact on the confidentiality, integrity, and availability of the PHI
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has completed a risk assessment and calculated the following risk scores: - Risk A: $50,000 - Risk B: $75,000 - Risk C: $20,000 - Risk D: $60,000 The company has a budget to mitigate only two risks this year. Which two risks should be prioritized?

   • ARisk D and Risk C
   • BRisk A and Risk B
   • CRisk B and Risk D
   • DRisk C and Risk A
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is calculating risk for a company's customer relationship management (CRM) system. The system contains sensitive customer data and is accessible from the internet. The analyst has determined the following: - The system has a known vulnerability that could allow unauthorized access. - The likelihood of exploitation is estimated at 0.3. - The impact if exploited is estimated at $400,000. The company's risk tolerance is $100,000 per risk. Based on the calculated risk score, what should the analyst recommend?

   • ATransfer the risk because the impact is high
   • BAccept the risk because the likelihood is low
   • CMitigate the risk because the risk score exceeds the risk tolerance
   • DIgnore the risk because the CRM system is not critical
   Reveal Solution Discussion Select an answer first