Analysis of Risk Assessment Techniques CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which technique is commonly used to identify assets, threats, and vulnerabilities during a risk assessment?

   • ACalculating the annual loss expectancy for each asset
   • BAutomated penetration testing only
   • CBrainstorming sessions with stakeholders and subject matter experts
   • DImplementing security controls to mitigate identified risks
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security tester is evaluating risk treatment options for a critical vulnerability in a legacy system. The system is essential for operations, but patching it would require downtime that could disrupt business. The organization has a low risk appetite and cannot afford a breach. Which treatment strategy should the tester recommend?

   • AAccept the risk because patching is too disruptive
   • BImplement compensating controls to reduce the risk while avoiding downtime
   • CAvoid the risk by decommissioning the system
   • DTransfer the risk by purchasing insurance
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which risk treatment option involves sharing the risk with another party, such as through insurance?

   • ATransfer
   • BMitigation
   • CAvoidance
   • DAcceptance
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security tester has identified a risk with a likelihood rating of 'low' and an impact rating of 'catastrophic' in a qualitative assessment. According to a typical risk matrix, how should this risk be prioritized?

   • ANo priority because the risk is acceptable
   • BLow priority because the likelihood is low
   • CMedium priority because likelihood and impact balance out
   • DHigh priority because the impact is catastrophic
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security tester has identified two risks in a risk assessment: Risk A has a high likelihood and low impact, while Risk B has a low likelihood and high impact. The organization has a limited budget and can only treat one risk. The tester must recommend which risk to treat first. What should the tester consider?

   • ATreat both risks simultaneously with the limited budget
   • BTreat Risk B first because its impact is higher
   • CUse a risk matrix to compare the overall risk levels of both risks
   • DTreat Risk A first because it is more likely to occur
   Reveal Solution Discussion Select an answer first