Describe Risk Assessment. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a common output of a risk assessment?

   • AA risk register listing identified risks, their ratings, and mitigation status
   • BA network diagram showing all connected devices
   • CA list of all employees and their job titles
   • DA firewall rule set for blocking malicious traffic
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After completing a risk assessment, a financial services firm needs to document the identified risks, their likelihood and impact ratings, and the recommended mitigation actions. Which output of the risk assessment process should they use?

   • ARisk register
   • BBusiness impact analysis
   • CIncident response plan
   • DVulnerability scan report
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key advantage of using quantitative risk analysis over qualitative risk analysis?

   • AIt is always more accurate than qualitative analysis
   • BIt provides results in monetary terms that can be compared to control costs
   • CIt requires no data collection or analysis effort
   • DIt eliminates the need for expert judgment
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In risk evaluation and prioritization, which two factors are primarily used to determine the level of risk?

   • ACost and speed of mitigation
   • BLikelihood and impact
   • CAsset value and depreciation
   • DNumber of vulnerabilities and number of threats
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A financial institution is conducting a risk assessment for its online banking platform. The team has identified a critical vulnerability in the authentication system. They have also identified that the threat of credential stuffing attacks is high. However, they are uncertain about the potential impact because the platform has multiple layers of security controls. What should the team do to accurately assess this risk?

   • AAssume the worst-case impact to be conservative
   • BSkip the impact analysis and focus only on the likelihood
   • CAnalyze the effectiveness of existing security controls to determine the residual risk
   • DTreat the risk as low because of the existing controls
   Reveal Solution Discussion Select an answer first