021.2 Risk Assessment and Management (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A risk register lists a risk with a likelihood of 'medium' and impact of 'high'. The risk owner has implemented a control that reduces the likelihood to 'low'. What should be updated in the risk register?

   • AThe likelihood rating and the residual risk rating
   • BNothing, because the risk is now mitigated
   • COnly the likelihood rating
   • DThe impact rating, because it is affected by the control
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A company decides to stop offering a service that carries an unacceptably high risk of legal liability. Which risk treatment strategy is being applied?

   • ARisk mitigation
   • BRisk transfer
   • CRisk acceptance
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following correctly represents the typical order of steps in the risk management lifecycle?

   • AMonitoring and review → Risk identification → Risk treatment → Risk analysis → Risk evaluation
   • BRisk identification → Risk analysis → Risk evaluation → Risk treatment → Monitoring and review
   • CRisk treatment → Risk evaluation → Risk analysis → Risk identification → Monitoring and review
   • DRisk analysis → Risk identification → Risk treatment → Risk evaluation → Monitoring and review
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A risk assessment has identified a critical vulnerability in a customer-facing application. The risk manager needs to communicate this to the executive board. What is the most effective approach?

   • ASummarize the risk in business terms, including potential financial and reputational impact
   • BWait until the risk is fully mitigated before informing the board
   • CPresent a detailed technical report with all vulnerability scan results
   • DEmail the raw CVSS scores to the board
   Reveal Solution Discussion Select an answer first
6. 25application · easy

   A company is identifying risks for its new remote work policy. Which of the following is a vulnerability?

   • AA hacker exploiting a weak password
   • BThe loss of a laptop
   • CA phishing attack targeting remote workers
   • DEmployees using personal devices without encryption
   Reveal Solution Discussion Select an answer first