The Role of Risk Assessment in Security Testing CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the main goal of risk-based test design?

   • ATo design tests that cover every possible input combination
   • BTo ensure all tests are automated
   • CTo design tests that are independent of the risk assessment
   • DTo create tests that specifically target the highest-priority risks
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security test plan is being developed for a new online banking system. The risk assessment identified that the highest risk is a man-in-the-middle (MITM) attack on the login process. The testing team has limited time. How should the test plan prioritize the testing activities?

   • ASkip testing the login process because it is already protected by SSL/TLS
   • BTest all features equally to ensure comprehensive coverage
   • CFocus the majority of testing effort on the login process to verify protection against MITM attacks
   • DTest the login process last because it is the most complex
   Reveal Solution Discussion Select an answer first
4. 13expert · hard · select all that apply

   A security analyst is performing a risk analysis for a new customer relationship management (CRM) system. The analyst has identified several risks and must determine which ones require immediate mitigation. The organization's risk criteria state that any risk with a likelihood rating of 3 or higher (on a scale of 1-5) and an impact rating of 4 or higher (on a scale of 1-5) requires immediate mitigation. Which of the following risks meet this criterion? (Select all that apply.)

   • ARisk 1: Likelihood = 4, Impact = 5
   • BRisk 5: Likelihood = 1, Impact = 1
   • CRisk 4: Likelihood = 5, Impact = 3
   • DRisk 3: Likelihood = 3, Impact = 4
   • ERisk 2: Likelihood = 2, Impact = 5
   Check answers Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of risk evaluation?

   • ATo identify all possible threats and vulnerabilities in the system
   • BTo compare analyzed risks against predefined criteria to decide which need treatment
   • CTo calculate the exact financial loss of every identified risk
   • DTo implement security controls to reduce risk levels
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is assessing the risk of a vulnerability in its customer database. The vulnerability could allow an attacker to access customer credit card numbers. The cost to fix the vulnerability is $100,000. The potential financial loss from a breach, including fines and legal fees, is estimated at $500,000. The company's risk appetite is low. Which risk treatment option is most appropriate?

   • AMitigate the risk by fixing the vulnerability
   • BAvoid the risk by discontinuing the use of the customer database
   • CTransfer the risk by purchasing cyber insurance
   • DAccept the risk because the cost of fixing it is high
   Reveal Solution Discussion Select an answer first