1.6 Analyze Elements of a Risk Analysis (combination Asset, Vulnerability, and Threat) 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst has completed a risk assessment for a mid-sized company and compiled the following data: - Risk A: Customer database exposed to the internet; likelihood 0.8, impact $200,000 - Risk B: Internal file server with weak passwords; likelihood 0.5, impact $50,000 - Risk C: Legacy application with known unpatched vulnerability; likelihood 0.3, impact $400,000 - Risk D: Office Wi-Fi using WPA2 with a shared password; likelihood 0.2, impact $10,000 Based on quantitative risk scores (likelihood × impact), which risk should be prioritized for mitigation first?

   • ARisk C
   • BRisk B
   • CRisk A
   • DRisk D
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A government agency is performing a risk analysis for a new citizen portal. The portal will collect personal data and must comply with strict data protection regulations. The agency has historical data from similar systems, but the threat landscape is evolving rapidly. The risk team must decide between a qualitative and a quantitative approach. The agency's leadership wants a defensible, data-driven ranking of risks, but also needs to incorporate expert judgment about emerging threats. Which approach best meets these requirements?

   • APure qualitative approach using expert judgment only
   • BDefer the analysis until more threat data is available
   • CHybrid approach combining quantitative data with qualitative expert adjustments
   • DPure quantitative approach using historical data only
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A utility company is performing a risk analysis for its smart grid management system. The system has a known vulnerability in its firmware update process. The company has received a warning from a national cybersecurity agency about a state-sponsored group that has been targeting utility companies. Which of the following is the threat in this scenario?

   • ANational cybersecurity agency warning
   • BSmart grid management system
   • CState-sponsored group
   • DFirmware update vulnerability
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security consultant is helping a hospital identify assets for a risk analysis. The hospital's network includes an electronic health record (EHR) system, a building access control system, and a public website. Which asset should be classified as having the highest criticality for patient safety?

   • ABuilding access control system
   • BEHR system
   • CAll assets have equal criticality
   • DPublic website
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a risk assessment, an analyst discovers that a web server is running an outdated version of the Apache HTTP Server with a known vulnerability that allows directory traversal. The server hosts the company's public marketing site, which does not contain sensitive data. How should this vulnerability be characterized in the risk analysis?

   • AMedium risk because the asset is low value but the vulnerability is exploitable
   • BLow risk because the asset is not critical
   • CHigh risk because the vulnerability is well-known
   • DNo risk because the site is public
   Reveal Solution Discussion Select an answer first