Risk Management CCOA Practice Questions (Page 6)

Questions 26–28

1. 26expert · medium

   A security analyst is explaining the relationship between risk, threat, and vulnerability to a manager. The analyst says, 'The risk of a ransomware attack is high because the threat actors are sophisticated and the vulnerability in our email system is unpatched.' Which of the following statements best describes the relationship in this context?

   • ARisk is the impact of the attack, which is the loss of data.
   • BRisk is the same as the threat because the threat actor is the cause of the risk.
   • CRisk is the same as the vulnerability because the vulnerability is what allows the attack.
   • DRisk is the combination of the likelihood of a threat exploiting a vulnerability and the impact of that exploitation.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A risk analyst is using a qualitative risk assessment to evaluate risks for a new project. The analyst rates the likelihood of a cyber attack as 'high' and the impact as 'moderate'. According to a standard risk matrix, this combination results in a 'high' risk level. What does this 'high' risk level indicate?

   • AThe risk has a specific monetary value that can be calculated.
   • BThe risk should be transferred to an insurance provider.
   • CThe risk requires immediate mitigation action before the project proceeds.
   • DThe risk is acceptable and can be monitored periodically.
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   In risk analysis, what is the term for a potential event that could cause harm to an organization's assets?

   • AThreat
   • BRisk
   • CImpact
   • DVulnerability
   Reveal Solution Discussion Select an answer first