1.6 Analyze Elements of a Risk Analysis (combination Asset, Vulnerability, and Threat) 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is the BEST example of a vulnerability in a risk analysis context?

   • AA distributed denial-of-service (DDoS) attack launched by a hacktivist group
   • BA web server running an outdated version of Apache with known CVEs
   • CThe loss of customer trust after a data breach
   • DThe implementation of a firewall with strict inbound rules
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A bank is conducting a risk analysis. The bank's core banking system has a known vulnerability in its remote access feature. The bank has received credible intelligence that a specific advanced persistent threat (APT) group is targeting financial institutions using this exact vulnerability. Which element of the risk analysis does the APT group represent?

   • AThreat
   • BAsset
   • CVulnerability
   • DImpact
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of risk prioritization in a risk analysis?

   • ATo rank risks based on their severity so that the most critical risks are addressed first
   • BTo assign a monetary value to each asset
   • CTo eliminate all risks to an acceptable level
   • DTo identify all vulnerabilities in the organization's assets
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A cloud service provider is evaluating risks to its customer data storage service. The service uses a shared storage cluster. The risk team has identified the following: - Asset: Customer data (confidentiality and integrity are critical) - Vulnerability: The storage cluster lacks encryption at rest - Threat: Insider threat with administrative access The team must decide how to prioritize this risk against others. They have limited budget and need to justify their decision to the board. Which approach would provide the most defensible prioritization?

   • APrioritize based solely on the asset's criticality
   • BUse a qualitative high/medium/low rating based on team consensus
   • CDefer the risk because insider threats are rare
   • DCalculate a quantitative risk score using likelihood and impact values
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During a risk analysis for a financial services company, which of the following is the BEST example of an asset to include in the asset inventory?

   • AThe firewall rule set that blocks inbound traffic from the internet
   • BThe annual security awareness training program for employees
   • CThe company's public reputation and brand image
   • DThe customer database containing personally identifiable information (PII)
   Reveal Solution Discussion Select an answer first