The Role of Risk Assessment in Security Testing CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In risk analysis, what two factors are combined to determine the level of risk?

   • AAsset value and threat capability
   • BControl effectiveness and residual risk
   • CLikelihood and impact
   • DVulnerability severity and exploitability
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A project manager asks the security testing team to start testing a new application immediately, without performing a risk assessment. The team lead explains that a risk assessment is necessary before testing begins. What is the primary reason for conducting a risk assessment before security testing?

   • ATo satisfy regulatory compliance requirements that mandate risk assessments for all applications
   • BTo determine the exact number of test cases that will be needed
   • CTo identify and prioritize the areas of the application that pose the highest risk, so testing resources are used effectively
   • DTo ensure that all possible vulnerabilities are found during testing
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a direct benefit of integrating risk assessment into test planning?

   • AIt eliminates the need for regression testing
   • BIt reduces the need for security testing expertise
   • CIt ensures testing is performed in the most efficient order
   • DIt guarantees that all security defects are found
   Reveal Solution Discussion Select an answer first
5. 19expert · hard · select all that apply

   A company is evaluating risk treatment options for several identified risks. The company has a moderate risk appetite and a limited budget for security improvements. Which of the following are valid risk treatment options that the company could apply? (Select all that apply.)

   • ATransfer the risk by purchasing cyber insurance
   • BAvoid the risk by discontinuing the business process that introduces the risk
   • CIgnore the risk because it is unlikely to occur
   • DMitigate the risk by implementing security controls to reduce the likelihood or impact
   • EAccept the risk by documenting it and taking no further action
   Check answers Discussion Select an answer first
6. 20foundation · easy

   Which risk treatment option involves taking action to reduce the likelihood or impact of a risk?

   • AAcceptance
   • BTransfer
   • CMitigation
   • DAvoidance
   Reveal Solution Discussion Select an answer first