Risk Management CCT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small online retailer faces a risk of website downtime due to a distributed denial-of-service (DDoS) attack. The estimated ALE is $50,000. A managed DDoS protection service costs $60,000 per year. The retailer decides not to purchase the service and instead accepts the risk. Which risk response strategy is the retailer applying?

   • ARisk mitigation
   • BRisk avoidance
   • CRisk transfer
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm is assessing the risk of a phishing attack that could lead to credential theft. The firm has historical data showing that phishing attacks occur about 10 times per year, and each successful attack costs an average of $50,000. However, the firm's security team believes that the likelihood of a successful attack is lower because of recent security awareness training. Which approach would best incorporate both historical data and expert judgment?

   • AUse only the historical data to calculate ALE, ignoring the security team's opinion.
   • BConduct a new quantitative assessment by collecting more data over the next year before making any decisions.
   • CUse only the security team's qualitative assessment and disregard the historical data.
   • DUse a hybrid approach: start with quantitative calculations based on historical data, then adjust the likelihood using expert judgment from the security team.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   If the Annualized Rate of Occurrence (ARO) is 0.5 and the Single Loss Expectancy (SLE) is $10,000, what is the Annualized Loss Expectancy (ALE)?

   • A$20,000
   • B$0.50
   • C$5,000
   • D$10,000
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What information is typically included in a risk report for management?

   • AThe detailed configuration of every network device
   • BA list of all employees' personal information
   • CA summary of the organization's risk posture and key risk indicators
   • DThe complete source code of all applications
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a risk assessment, a security team identifies the following: (1) a vulnerability in the web application, (2) a threat of SQL injection, (3) a potential impact of data loss, and (4) a likelihood rating of high. Which combination represents a risk?

   • AThe threat alone
   • BThe combination of the threat, vulnerability, and resulting impact
   • CThe likelihood rating alone
   • DThe vulnerability alone
   Reveal Solution Discussion Select an answer first