Risk Identification, Assessment and Mitigation CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of risk assessment in security testing?

   • ATo inform stakeholders about the security testing results
   • BTo implement security controls to eliminate all risks
   • CTo identify all possible vulnerabilities in the system
   • DTo evaluate identified risks by determining their likelihood and impact to prioritize them
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is managing risks for a cloud-based application. They have identified a risk of unauthorized access to customer data due to misconfigured cloud storage. The team has implemented encryption and access controls, but the risk is still not fully mitigated. What additional step should the team take?

   • AImplement continuous monitoring and auditing of cloud storage configurations.
   • BAvoid the risk by moving the application to on-premises infrastructure.
   • CTransfer the risk to the cloud provider by signing a new SLA.
   • DAccept the residual risk because the controls have reduced it sufficiently.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security tester identifies a risk in a web application where user input is not properly sanitized, leading to a SQL injection vulnerability. The organization's risk appetite is moderate. Which mitigation strategy is the most effective in reducing the risk?

   • AAdd input validation and use parameterized queries to prevent SQL injection.
   • BTrain developers on secure coding practices.
   • CImplement a Web Application Firewall (WAF) to filter malicious input.
   • DDocument the risk and accept it because the likelihood of exploitation is low.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security tester needs to communicate the results of a risk assessment to a non-technical project sponsor. What is the most effective approach?

   • AShare the raw data from the risk assessment without any interpretation
   • BPresent the risks using business-oriented language and focus on potential business impact
   • CAvoid discussing risks that are difficult to explain to prevent confusion
   • DProvide a detailed list of all technical vulnerabilities with CVSS scores
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security tester is evaluating the risk of a phishing attack on employees. The likelihood of an employee falling for a phishing email is high, and the impact of a successful attack is moderate. The organization has a moderate risk appetite. What is the most appropriate risk treatment?

   • AAvoid the risk by disabling email for all employees.
   • BTransfer the risk by purchasing cyber insurance.
   • CMitigate the risk by implementing security awareness training and email filtering.
   • DAccept the risk because the impact is only moderate.
   Reveal Solution Discussion Select an answer first