3.3 Conduct Risk Assessments ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is using a 5x5 qualitative risk matrix. The risk of a data breach is rated as 'Possible' likelihood and 'Major' impact. The risk of a system failure is rated as 'Unlikely' likelihood and 'Severe' impact. Which risk has the higher risk rating?

   • AIt depends on the specific matrix scoring, but typically the risk with the higher combined score (e.g., likelihood × impact) is rated higher.
   • BThe data breach, because 'Possible' is more likely than 'Unlikely'.
   • CBoth have the same rating, because the matrix is symmetric.
   • DThe system failure, because 'Severe' impact is higher than 'Major'.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In quantitative risk analysis, what does the Annualized Loss Expectancy (ALE) represent?

   • AThe cost of implementing a security control
   • BThe probability that a threat will occur in a year
   • CThe expected monetary loss per year due to a specific risk
   • DThe total value of all assets in the organization
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After completing a quantitative risk assessment, the CISO needs to present the findings to the board of directors. The board is not familiar with technical risk terminology. Which approach is most effective for communicating the results?

   • AShare only the raw data and let the board interpret the results.
   • BProvide a high-level summary with key metrics (e.g., ALE) and a prioritized risk register, using non-technical language.
   • CPresent a detailed technical report with all calculations and data sources.
   • DFocus exclusively on the qualitative ratings, ignoring the quantitative metrics.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An organization needs to perform a risk assessment quickly and with limited resources, but it does not require precise monetary values. Which risk assessment approach is most appropriate?

   • ACompliance-based risk assessment
   • BQualitative risk assessment
   • CQuantitative risk assessment
   • DHybrid risk assessment
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is calculating the ALE for a potential ransomware attack. The asset value is $1,000,000, the exposure factor is 50%, and the ARO is 0.1. What is the ALE?

   • A$500,000
   • B$50,000
   • C$100,000
   • D$1,000,000
   Reveal Solution Discussion Select an answer first