1.6 Analyze Elements of a Risk Analysis (combination Asset, Vulnerability, and Threat) 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the context of risk analysis, which of the following best describes the purpose of classifying assets?

   • ATo determine the monetary value of each asset for insurance purposes
   • BTo identify the physical location of each asset for compliance purposes
   • CTo assign ownership and accountability for each asset
   • DTo group assets by their importance and sensitivity so that protection efforts can be prioritized
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A university's IT department is conducting a risk analysis. They are listing all items that could be affected by a security incident. Which of the following should be classified as an asset in this analysis?

   • AStudent records database
   • BWeak password policy
   • CPhishing email campaign
   • DFirewall misconfiguration
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When prioritizing risks, which factor is MOST commonly used to rank them?

   • AThe age of the asset affected by the risk
   • BThe number of vulnerabilities associated with each risk
   • CThe calculated risk score, which combines likelihood and impact
   • DThe cost of the security controls that would mitigate the risk
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In risk analysis, which of the following is the BEST example of a threat?

   • AA phishing email campaign targeting employees to steal credentials
   • BThe encryption algorithm used to protect data at rest
   • CThe sensitive customer data stored in the company's CRM system
   • DA misconfigured database server that is accessible from the internet
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is performing a risk assessment for a small law firm. The firm stores client case files on a network-attached storage (NAS) device that is accessible only from the internal network. The analyst discovers that the NAS firmware is outdated and has a known remote code execution vulnerability. Which element of the risk analysis does this finding represent?

   • AThreat
   • BVulnerability
   • CRisk
   • DAsset
   Reveal Solution Discussion Select an answer first