Analysis of Risk Assessment Techniques CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has identified a risk that a new regulatory requirement could result in fines if not complied with. After evaluating the cost of compliance versus the potential fines, the company decides to accept the risk and not implement any controls. Which risk treatment strategy is being applied?

   • ARisk avoidance
   • BRisk mitigation
   • CRisk acceptance
   • DRisk transfer
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security tester has completed a risk assessment for an e-commerce platform. The risk register lists the following risks: (1) SQL injection in the product search (likelihood: high, impact: high), (2) DDoS attack on the public website (likelihood: medium, impact: high), (3) insider misuse of customer data (likelihood: low, impact: high), (4) phishing attack on employees (likelihood: medium, impact: low). The organization wants to prioritize remediation efforts based on risk level. Which risk should be addressed first?

   • ASQL injection in product search
   • BDDoS attack on public website
   • CPhishing attack on employees
   • DInsider misuse of customer data
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security tester is conducting a risk assessment for a cloud-based service. The tester needs to identify threats and vulnerabilities, but the organization has limited time and budget. The tester must choose between a comprehensive threat modeling exercise and a vulnerability scan. Which approach should the tester take?

   • ASkip both and rely on the previous year's risk assessment
   • BPerform a vulnerability scan because it is faster and cheaper
   • CPerform threat modeling because it identifies a broader range of threats
   • DCombine both approaches, prioritizing threat modeling for critical components and vulnerability scanning for the rest
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A risk has a high likelihood of occurring but a very low impact. How should this risk typically be prioritized?

   • AAs the highest priority because it is likely to occur
   • BAs a lower priority compared to a risk with moderate likelihood and high impact
   • CAs the lowest priority because impact is low
   • DAs a medium priority regardless of impact
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security tester is asked to perform a risk assessment for a small startup that has limited historical data on security incidents. The startup wants a quick, cost-effective assessment that provides a relative ranking of risks. Which risk analysis approach should the tester recommend?

   • AQualitative risk analysis
   • BFormal risk assessment using ISO 27005
   • CQuantitative risk analysis
   • DSemi-quantitative risk analysis
   Reveal Solution Discussion Select an answer first