021.2 Risk Assessment and Management (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   After analyzing risks, an organization decides which risks to address first. What is this process called?

   • ARisk evaluation and prioritization
   • BRisk identification
   • CRisk treatment
   • DRisk monitoring
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which risk analysis method uses numerical values to estimate the likelihood and impact of a risk?

   • AQualitative analysis
   • BRoot cause analysis
   • CQuantitative analysis
   • DSWOT analysis
   Reveal Solution Discussion Select an answer first
4. 8application · medium · select all that apply

   A company is identifying risks for its new cloud-based customer relationship management (CRM) system. Which of the following are examples of threats? (Select all that apply.)

   • AA ransomware attack
   • BLack of multi-factor authentication
   • CA misconfigured cloud storage bucket
   • DAn insider with malicious intent
   • EA phishing campaign targeting employees
   Check answers Discussion Select an answer first
5. 9foundation · easy

   During the risk identification phase, which of the following would be considered an asset?

   • AA firewall misconfiguration
   • BA database containing customer records
   • CA disgruntled employee
   • DA phishing email
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of a risk assessment in an organization?

   • ATo replace the need for security policies and procedures
   • BTo guarantee that all security incidents are prevented
   • CTo identify, analyze, and evaluate risks to inform decisions on how to manage them
   • DTo assign blame when a security incident occurs
   Reveal Solution Discussion Select an answer first