A company has implemented a new security control to mitigate a risk. According to the risk management process, what should happen next?

The risk is automatically transferred to the IT department

The risk assessment is repeated from scratch

The risk register is updated and the control's effectiveness is monitored

The risk is considered closed and no further action is needed

A company has a risk with a likelihood of 10% and an impact of $5 million. The cost to mitigate the risk is $400,000. The company's risk tolerance is $500,000. What should the company do?

Mitigate the risk because the ALE exceeds the mitigation cost

Avoid the risk by discontinuing the activity

Transfer the risk because the impact is too high

Accept the risk because the ALE is below the risk tolerance

A manufacturing company is conducting a risk assessment. They have identified that a fire in the server room could destroy critical production data. In this scenario, what is the asset?

The lack of a fire suppression system

Which of the following best describes a vulnerability in the context of risk identification?

The likelihood that a threat will occur

A weakness in a system or control that could be exploited

A potential event that could cause harm

The impact of a security incident on the organization

A risk manager needs to communicate a high-risk finding to different stakeholders. The IT team wants technical details, while the executive board wants a business impact summary. What is the best approach?

Only communicate with the IT team

Avoid communicating the risk until it is resolved

Send the same detailed report to both groups

Tailor the communication to each audience's needs

LPI Security Essentials

Domain 1Objective 2

021.2 Risk Assessment and Management (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 1)

Part of the 021 Security Concepts domain, which makes up ~15% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

Questions 1–5

1application · medium
A company has implemented a new security control to mitigate a risk. According to the risk management process, what should happen next?
Select an answer first
2expert · hard
A company has a risk with a likelihood of 10% and an impact of $5 million. The cost to mitigate the risk is $400,000. The company's risk tolerance is $500,000. What should the company do?
Select an answer first
3application · easy
A manufacturing company is conducting a risk assessment. They have identified that a fire in the server room could destroy critical production data. In this scenario, what is the asset?
Select an answer first
4foundation · easy
Which of the following best describes a vulnerability in the context of risk identification?
Select an answer first
5expert · medium
A risk manager needs to communicate a high-risk finding to different stakeholders. The IT team wants technical details, while the executive board wants a business impact summary. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-ESSENTIALS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “SECURITY-ESSENTIALS” is a trademark of its owner, used for identification only.