Analysis of Risk Assessment Techniques CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of performing a risk assessment in the context of security testing?

   • ATo guarantee that all identified vulnerabilities are eliminated before release
   • BTo replace the need for security testing by providing a static list of threats
   • CTo assign a monetary value to every asset in the organization
   • DTo identify, analyze, and evaluate risks to inform decisions about which security controls to implement
   Reveal Solution Discussion Select an answer first
2. 12expert · hard · select all that apply

   A security tester is advising a company on risk treatment for a newly identified risk of a ransomware attack. The company has a low risk appetite and wants to reduce the risk as much as possible. Which of the following are appropriate risk treatment strategies? Select all that apply.

   • AImplement regular data backups and offline storage
   • BImplement endpoint detection and response (EDR) to detect and block ransomware
   • CDecommission all internet-facing systems to eliminate the attack surface
   • DPurchase cyber insurance to cover potential losses
   • EAccept the risk because ransomware is unpredictable
   Check answers Discussion Select an answer first
4. 13application · medium

   A company has identified a risk that a key supplier could go out of business, disrupting operations. The company decides to sign a contract with a second supplier as a backup. Which risk treatment strategy is this?

   • ARisk transfer
   • BRisk mitigation
   • CRisk avoidance
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In risk evaluation, how are risks typically prioritized?

   • ABy the cost of the asset alone
   • BBy the order in which risks were identified
   • CBy the number of vulnerabilities identified in each system
   • DBy combining the likelihood of occurrence and the potential impact
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the context of security testing, what is the relationship between risk assessment and security testing?

   • ARisk assessment is performed only after all security testing is complete
   • BSecurity testing is used to eliminate the need for risk assessment
   • CSecurity testing and risk assessment are independent and do not influence each other
   • DRisk assessment provides input to prioritize security testing activities and interpret their results
   Reveal Solution Discussion Select an answer first