3.1 - Understand Risk Management SSCP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security operations center (SOC) analyst discovers a new attack technique that bypasses the organization's endpoint detection and response (EDR) solution. The analyst wants to share this information with other organizations to improve collective defense. However, the analyst is concerned about revealing sensitive details about the organization's environment. What is the best practice?

   • AKeep the information internal to avoid disclosure
   • BPublish the technique on a public blog
   • CShare the information only with the vendor of the EDR solution
   • DShare the technique through a trusted Information Sharing and Analysis Center (ISAC) with anonymized details
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A manufacturing company identifies a critical vulnerability in its industrial control system (ICS). The estimated cost to implement a patch is $10,000, and the potential loss from a successful exploit is estimated at $5 million. The company decides to apply the patch immediately. Which risk treatment option is being applied?

   • AAvoid
   • BAccept
   • CMitigate
   • DTransfer
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security manager needs to present the organization's top risks to the board of directors. The manager wants to use a visual tool that ranks risks based on their likelihood and impact. Which tool should the manager use?

   • ARisk register
   • BRisk heat map
   • CMITRE ATT&CK matrix
   • DCVSS score
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization processes patient data in a legacy system that cannot be patched because the vendor discontinued support. The system is isolated on a separate network segment, and the organization has purchased cyber liability insurance. The risk owner has decided to continue operating the system because replacing it would cost $2 million and the probability of exploitation is assessed as low. Which risk treatment option is the organization applying?

   • AMitigate
   • BTransfer
   • CAccept
   • DAvoid
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What does risk quantification primarily involve?

   • AAssigning numerical values to the likelihood and impact of risks
   • BListing all risks in a register without analysis
   • CTransferring risk to a third party
   • DQualitatively rating risks as high, medium, or low
   Reveal Solution Discussion Select an answer first