Risk Anticipation with Risk Management CND Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In risk analysis, what does 'risk level' typically represent?

   • AThe cost of implementing controls
   • BThe combination of likelihood and impact
   • CThe number of vulnerabilities in a system
   • DThe time required to recover from an incident
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm implemented a new endpoint detection and response (EDR) solution six months ago to mitigate the risk of advanced persistent threats. The security team now wants to ensure the solution remains effective. Which activity is most appropriate?

   • ADocument the EDR implementation in the risk register and close the risk item.
   • BReview EDR alerts and conduct periodic penetration tests to validate detection coverage.
   • CIncrease the risk likelihood rating because EDR solutions are known to fail.
   • DReplace the EDR with a next-generation firewall to reduce complexity.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network defender has implemented a risk treatment plan to reduce the risk of insider threats by implementing user behavior analytics (UBA) and stricter access controls. After three months, the defender notices that the UBA system is generating a high number of false positives, causing alert fatigue among the security team. What is the most appropriate action?

   • AAdjust the UBA thresholds and rules to reduce false positives while maintaining effective monitoring.
   • BDisable the UBA system to reduce alert fatigue.
   • CIncrease the number of security analysts to handle the alert volume.
   • DIgnore the false positives and focus on the true positives.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is continuous monitoring of risks important in risk management?

   • ATo eliminate the need for risk assessments
   • BTo ensure that risk levels remain within acceptable thresholds
   • CTo automate all risk treatment decisions
   • DTo guarantee that no new risks emerge
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In risk evaluation, what is a 'risk criterion'?

   • AA tool for scanning vulnerabilities
   • BA standard used to determine the acceptability of a risk
   • CA method for calculating asset values
   • DA list of all potential threats
   Reveal Solution Discussion Select an answer first