Risk Assessment EDRP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a key characteristic of a quantitative risk analysis?

   • AIt is faster and easier to perform than qualitative analysis.
   • BIt uses subjective ratings such as high, medium, and low to assess risk.
   • CIt relies on numerical values and monetary figures to calculate risk.
   • DIt does not require any input from business stakeholders.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A financial institution is performing a quantitative risk assessment for its online banking platform. The platform processes $10 million in transactions daily. A security breach could result in a loss of $5 million. The probability of a breach occurring in the next year is estimated at 5%. The institution has a risk tolerance of $200,000. What is the annualized loss expectancy (ALE) and what action should be taken?

   • AALE = $500,000; transfer the risk
   • BALE = $250,000; mitigate the risk
   • CALE = $250,000; accept the risk
   • DALE = $50,000; monitor the risk
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A manufacturing firm is evaluating risks to its production line. The risk team has identified a potential equipment failure that could cause a shutdown. The estimated cost of a shutdown is $1 million, and the equipment is expected to fail once every 5 years. The firm's risk tolerance is $300,000. Which risk analysis result should be used to decide on treatment?

   • AThe SLE is $1 million, so the risk should be transferred via insurance.
   • BThe ALE is $200,000, which is below the tolerance, so the risk is acceptable.
   • CThe ARO is 0.2, so the risk is low and can be ignored.
   • DThe ALE is $1 million, which exceeds the tolerance, so the risk must be mitigated.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A healthcare organization has completed a risk assessment and is updating its disaster recovery plan. The assessment identified a high risk of a data breach due to unencrypted patient records. The organization has decided to implement encryption as a mitigation control. The DR plan must be updated to reflect this decision. Which documentation approach is most effective?

   • ADocument the risk, the selected control (encryption), the risk owner, and the residual risk after implementation.
   • BDocument the encryption vendor's contact information and leave the rest of the DR plan unchanged.
   • CDocument the risk assessment methodology but omit the specific treatment decision.
   • DDocument only the encryption implementation steps, without referencing the risk assessment.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A university is conducting a risk assessment for its student information system. The team is identifying potential threats. Which of the following is an example of a threat, rather than a vulnerability or risk?

   • AThe potential for unauthorized access to student records
   • BA phishing email that tricks an employee into revealing credentials
   • CThe system lacks multi-factor authentication
   • DThe impact of a data breach on student privacy
   Reveal Solution Discussion Select an answer first