Risk Assessment EDRP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a common qualitative risk analysis technique?

   • ACalculating the Annualized Loss Expectancy (ALE) for each risk.
   • BPerforming a Monte Carlo simulation to model risk outcomes.
   • CUsing a risk matrix to rate likelihood and impact as high, medium, or low.
   • DDetermining the Single Loss Expectancy (SLE) for an asset.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A utility company is conducting a risk assessment for its SCADA system. The risk team has identified a potential cyberattack that could disrupt power distribution. They have estimated the impact at $10 million and the likelihood at 0.01 per year. The company's risk tolerance is $50,000. Which risk treatment decision is most appropriate?

   • AAccept the risk because the likelihood is very low.
   • BAvoid the risk by disconnecting the SCADA system from the internet.
   • CImplement network segmentation and intrusion detection to reduce the likelihood.
   • DTransfer the risk by purchasing a cyber insurance policy.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A hospital is evaluating risks to its patient monitoring system. The risk assessment has identified a risk with a high likelihood and a high impact. The hospital's risk appetite is low. Which of the following risk treatment options is most appropriate?

   • AMitigate the risk by implementing redundant monitoring systems
   • BAvoid the risk by discontinuing the monitoring service
   • CAccept the risk because it is inherent to the system
   • DTransfer the risk by purchasing liability insurance
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A regional bank is conducting a risk assessment for its core banking application. The risk team has identified a ransomware attack as a key threat. Historical data shows the bank experienced one ransomware incident in the past 10 years, and the estimated loss from a successful attack is $5 million. The bank's risk tolerance threshold for a single risk is $1 million. Which approach should the risk team use to prioritize this risk?

   • AAssign a qualitative rating of 'high' based on the potential impact and proceed with mitigation regardless of frequency.
   • BCalculate the annualized loss expectancy (ALE) as $500,000 and compare it to the risk tolerance threshold.
   • CTreat the risk as acceptable because the ARO is less than 1, so no further action is required.
   • DUse the single loss expectancy (SLE) of $5 million as the risk value and treat it as high priority.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A government agency has completed a risk assessment for its public-facing website. The assessment identified a high risk of a DDoS attack. The agency's DR plan must be updated to reflect this risk. Which documentation practice is most important to ensure the DR plan is effective?

   • ARecord the names of all employees who participated in the risk assessment.
   • BInclude the contact information of the DDoS mitigation vendor in the DR plan.
   • CList all potential DDoS attack vectors and their technical details.
   • DDocument the risk assessment methodology, findings, and the rationale for the chosen treatment in the DR plan.
   Reveal Solution Discussion Select an answer first