Risk Identification, Assessment and Mitigation CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is assessing risks for a legacy system that processes credit card payments. The system is scheduled to be replaced in 12 months. A critical vulnerability is found that could allow attackers to steal card data. The team has limited resources and must decide how to handle this risk. The organization's risk appetite is low, but the cost of a full remediation is high and could delay the replacement project. What is the most appropriate risk treatment?

   • AAccept the risk because the system will be replaced soon.
   • BApply compensating controls, such as network segmentation and enhanced monitoring, to reduce the risk to an acceptable level.
   • CImmediately decommission the legacy system to eliminate the risk.
   • DTransfer the risk to a third-party payment processor by outsourcing the payment processing.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A security tester is performing risk identification for a new online banking application. Which of the following is an example of a threat that should be considered?

   • AAn attacker using phishing to steal customer credentials
   • BThe customer database containing sensitive personal information
   • CA firewall misconfiguration that allows unauthorized network access
   • DThe application being accessible over the internet
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester is performing a risk identification activity for a new online banking system. The system will handle sensitive financial data and be accessible via the internet. Which of the following is the most comprehensive approach to identify potential security risks?

   • ARun an automated vulnerability scanner against the system and fix all identified vulnerabilities.
   • BAnalyze the system's code for security flaws using static analysis tools.
   • CReview the system architecture and list all possible threats and vulnerabilities that could affect the system's assets.
   • DInterview the system administrators to ask about past security incidents.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team has identified a high-risk vulnerability in a customer-facing application. The team has proposed a mitigation plan that will require significant downtime and cost. The business stakeholders are hesitant to approve the plan because it will impact revenue. What is the best way for the security team to communicate the risk and gain approval?

   • ADownplay the risk to avoid alarming stakeholders and get quick approval.
   • BPresent the technical details of the vulnerability and the proposed mitigation to the stakeholders.
   • CExplain the potential business impact of not mitigating the risk, such as data breach costs, regulatory fines, and reputational damage.
   • DImplement the mitigation without approval because the risk is too high.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is developing a customer-facing web application that will store personal data. During a security review, the team identifies a vulnerability in the authentication module that could allow account takeover. The likelihood of exploitation is assessed as high, and the impact is also high. The team has limited resources and must address multiple risks. What should the team do first?

   • ACalculate the risk level and compare it with the organization's risk appetite to determine whether it requires immediate mitigation.
   • BImmediately deploy a patch to fix the authentication vulnerability, even if it has not been fully tested.
   • CDocument the risk in the risk register and assign a risk owner to monitor it, but do not take immediate action.
   • DImplement a compensating control, such as multi-factor authentication, to reduce the risk while a permanent fix is developed.
   Reveal Solution Discussion Select an answer first