A company has a limited security budget and must choose between mitigating two risks. Risk A has a likelihood of 20% and an impact of $1,000,000. Risk B has a likelihood of 80% and an impact of $100,000. The mitigation for Risk A costs $150,000, and for Risk B costs $60,000. Which risk should be prioritized based on cost-benefit analysis?

Risk B, because the cost-benefit ratio is more favorable

Risk A, because the potential impact is higher

Both equally, because they have the same ALE

Risk A, because the ALE is higher

What is the main purpose of prioritizing risks during risk evaluation?

To assign blame for risk-related incidents

To document risks for regulatory compliance only

To ensure that the most significant risks receive attention first

In the context of organizational security, what does a risk assessment primarily help an organization to do?

Guarantee compliance with all legal and regulatory requirements

Provide a one-time snapshot of security posture that never needs updating

Eliminate all vulnerabilities from its systems

Make informed decisions about how to allocate resources to manage risks

Which of the following is typically included in a risk register entry?

The personal details of all employees

The risk description, likelihood, impact, and treatment plan

The source code of all applications

The organization's financial statements

A risk manager is updating the organization's risk register after a quarterly review. A previously identified risk has been fully mitigated by a new firewall. What is the most appropriate action for the risk register?

Update the risk status to 'closed' and note the mitigation

Move the risk to a separate 'accepted risks' list

Leave the entry unchanged until the next annual review

LPI Security Essentials

Domain 1Objective 2

021.2 Risk Assessment and Management (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 6)

Part of the 021 Security Concepts domain, which makes up ~15% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

Questions 26–30

26expert · hard
A company has a limited security budget and must choose between mitigating two risks. Risk A has a likelihood of 20% and an impact of $1,000,000. Risk B has a likelihood of 80% and an impact of $100,000. The mitigation for Risk A costs $150,000, and for Risk B costs $60,000. Which risk should be prioritized based on cost-benefit analysis?
Select an answer first
27foundation · easy
What is the main purpose of prioritizing risks during risk evaluation?
Select an answer first
28foundation · easy
In the context of organizational security, what does a risk assessment primarily help an organization to do?
Select an answer first
29foundation · easy
Which of the following is typically included in a risk register entry?
Select an answer first
30application · medium
A risk manager is updating the organization's risk register after a quarterly review. A previously identified risk has been fully mitigated by a new firewall. What is the most appropriate action for the risk register?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SECURITY-ESSENTIALS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “SECURITY-ESSENTIALS” is a trademark of its owner, used for identification only.