A company is evaluating a risk with an ALE of $500,000. The security team proposes two controls: Control A costs $100,000 per year and reduces the ALE to $50,000. Control B costs $50,000 per year and reduces the ALE to $200,000. The company's risk tolerance is $150,000. Which control should the company implement?

Neither control because the costs exceed the risk reduction

Control A because it brings the residual risk below the tolerance level

Control B because it is cheaper

Both controls because they provide defense in depth

A company operates a legacy system that is critical to operations but cannot be patched. The risk assessment shows the system has a high likelihood of exploitation and a high impact. The company has a low risk tolerance and cannot afford to replace the system. Which combination of risk treatment options is most appropriate?

Mitigate by isolating the system and transfer the residual risk through insurance

Transfer the risk entirely through insurance

Accept the risk because the system is critical

Avoid the risk by decommissioning the system

A company is conducting a risk assessment for a new cloud-based customer relationship management (CRM) system. The security team identifies that the CRM vendor has experienced two data breaches in the past year. The company's risk tolerance is low, and the CRM is critical for sales operations. What is the most appropriate risk treatment?

Avoid the risk by not using the CRM

Transfer the risk entirely to the vendor through insurance

Accept the risk because the CRM is critical

Mitigate by implementing additional security controls and monitoring, and transfer residual risk through contractual clauses

Systems Security Certified Practitioner

Domain 3Objective 1

3.1 - Understand Risk Management SSCP Practice Questions (Page 1)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

15%of the exam

Questions 1–5

1expert · hard
A company is evaluating a risk with an ALE of $500,000. The security team proposes two controls: Control A costs $100,000 per year and reduces the ALE to $50,000. Control B costs $50,000 per year and reduces the ALE to $200,000. The company's risk tolerance is $150,000. Which control should the company implement?
Select an answer first
2expert · hard
A company operates a legacy system that is critical to operations but cannot be patched. The risk assessment shows the system has a high likelihood of exploitation and a high impact. The company has a low risk tolerance and cannot afford to replace the system. Which combination of risk treatment options is most appropriate?
Select an answer first
3application · medium
A security analyst is investigating a phishing campaign and wants to map the attacker's techniques to a standardized framework to identify gaps in the organization's defenses. Which resource should the analyst use?
Select an answer first
4expert · hard
A company is conducting a risk assessment for a new cloud-based customer relationship management (CRM) system. The security team identifies that the CRM vendor has experienced two data breaches in the past year. The company's risk tolerance is low, and the CRM is critical for sales operations. What is the most appropriate risk treatment?
Select an answer first
5application · medium
A retail company is assessing the risk of a ransomware attack. The security team calculates that the annualized rate of occurrence is 0.2 and the single loss expectancy is $500,000. What is the annualized loss expectancy (ALE)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

3.1 - Understand Risk Management SSCP Practice Questions (Page 1)

Questions 1–5

A security analyst is investigating a phishing campaign and wants to map the attacker's techniques to a standardized framework to identify gaps in the organization's defenses. Which resource should the analyst use?

A retail company is assessing the risk of a ransomware attack. The security team calculates that the annualized rate of occurrence is 0.2 and the single loss expectancy is $500,000. What is the annualized loss expectancy (ALE)?

Keep studying — Risk Identification, Monitoring and Analysis