1.6 Analyze Elements of a Risk Analysis (combination Asset, Vulnerability, and Threat) 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of a vulnerability assessment in the risk analysis process?

   • ATo identify weaknesses in assets that could be exploited by threats
   • BTo quantify the financial impact of a potential security breach
   • CTo implement security controls to mitigate identified risks
   • DTo determine the likelihood of a specific threat actor attacking the organization
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A financial services firm is conducting a risk analysis for its new online banking platform. The platform handles customer transactions and stores sensitive account data. The risk team has identified the following: - Asset: Customer transaction database (criticality: high) - Vulnerability: The web application firewall (WAF) is misconfigured, allowing some SQL injection attempts to reach the application server. - Threat: An organized cybercrime group known for targeting financial institutions. The team must choose between a qualitative and a quantitative approach. The organization has limited historical incident data for this platform, but executives need a clear, comparable ranking of risks to justify security investments. Which approach is most appropriate in this situation?

   • AQuantitative analysis using ALE calculations
   • BQualitative analysis using expert judgment and risk ratings
   • CQualitative analysis using only vulnerability scan results
   • DQuantitative analysis using Monte Carlo simulation
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A multinational corporation is conducting a risk analysis for its intellectual property (IP) stored in a cloud environment. The company has a mature security program and extensive historical data on security incidents. However, the threat landscape is changing, and the company's executives want a clear, objective way to compare risks across different business units. Which approach should the risk team use?

   • ADefer the analysis until the threat landscape stabilizes
   • BQualitative analysis using expert panels
   • CHybrid approach with qualitative ratings only
   • DQuantitative analysis using historical incident data
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following best describes a qualitative risk analysis method?

   • AIt assigns monetary values to assets and calculates annualized loss expectancy (ALE)
   • BIt uses subjective ratings such as high, medium, and low to assess likelihood and impact
   • CIt requires a detailed cost-benefit analysis of every security control
   • DIt relies on historical data and statistical models to predict risk frequency
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A cybersecurity team is analyzing risks for a hospital's medical device network. The team has identified the following: - Asset: Infusion pumps (critical for patient care) - Vulnerability: The pumps run on an outdated operating system with known unpatched vulnerabilities - Threat: Malware that can spread through the network The team must decide whether to use a qualitative or quantitative approach. The hospital has no historical incident data for these devices, but the potential impact of a compromise is very high. The team needs to communicate the risk to non-technical executives. Which approach is most appropriate?

   • AQualitative approach using risk ratings and expert judgment
   • BQuantitative approach using Monte Carlo simulation
   • CDefer the risk analysis until more data is available
   • DQuantitative approach using ALE calculations
   Reveal Solution Discussion Select an answer first