1.6 Analyze Elements of a Risk Analysis (combination Asset, Vulnerability, and Threat) 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital's risk team is analyzing the risk to its patient records database. The database contains protected health information (PHI) and is hosted on a legacy server that is missing the latest security patches. The team has determined that a known ransomware group has been actively targeting healthcare organizations. Using a quantitative approach, the team estimates that if the database is compromised, the financial impact would be $500,000, and the likelihood of a successful exploit within the next year is 20%. What is the annualized loss expectancy (ALE) for this risk?

   • A$500,000
   • B$100,000
   • C$2,500,000
   • D$100,000,000
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a risk assessment for a manufacturing company, the analyst identifies that the industrial control system (ICS) that manages the assembly line has a default administrator password. The analyst also notes that a hacktivist group has recently claimed responsibility for disrupting similar manufacturers. Which of the following correctly pairs the threat with the vulnerability?

   • AThreat: default administrator password; Vulnerability: hacktivist group
   • BThreat: ICS; Vulnerability: assembly line
   • CThreat: hacktivist group; Vulnerability: default administrator password
   • DThreat: manufacturing disruption; Vulnerability: hacktivist group
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a quantitative risk calculation, what does the annualized loss expectancy (ALE) represent?

   • AThe likelihood that a threat will exploit a vulnerability in one year
   • BThe expected monetary loss per year from a specific risk
   • CThe total cost of implementing all security controls
   • DThe maximum possible loss from a single security incident
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A risk analyst is identifying assets for a risk assessment at a logistics company. The company's fleet management system tracks vehicle locations and delivery schedules. The system is critical for daily operations. Which of the following is the most appropriate way to classify this system in the risk analysis?

   • AAs a threat because it is exposed to the internet
   • BAs a high-value asset due to its critical role in operations
   • CAs a vulnerability because it may have software flaws
   • DAs a low-value asset because it does not handle customer data
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the role of threat identification in a risk analysis?

   • ATo identify potential events or actors that could exploit vulnerabilities and cause harm
   • BTo calculate the likelihood of a vulnerability being exploited
   • CTo evaluate the effectiveness of existing security controls
   • DTo determine which assets are most valuable to the organization
   Reveal Solution Discussion Select an answer first