Define How Security Controls Contribute to Business Operating Cost and Offsetting Risk. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a cost-benefit analysis of a security control, which of the following best represents the 'benefit' side of the equation?

   • AThe total cost of implementing the control
   • BThe number of security incidents avoided
   • CThe reduction in annualized loss expectancy (ALE)
   • DThe time required to implement the control
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A company is considering a new access control system that costs $50,000 per year. The system is expected to reduce the annual expected loss from unauthorized access from $200,000 to $20,000. What is the net benefit of this control per year?

   • A$150,000
   • B$180,000
   • C$230,000
   • D$130,000
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is evaluating a new security control that costs $200,000/year. The control is expected to reduce the annualized loss expectancy (ALE) from $600,000 to $200,000. However, the control will also require employees to spend an additional 30 minutes per week on security-related tasks, which the company estimates costs $50,000/year in lost productivity. What is the RETURN ON INVESTMENT (ROI) of this control?

   • A25%
   • B175%
   • C75%
   • D100%
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Deploying endpoint detection and response (EDR) software to detect and contain malware infections is an example of which risk offset mechanism?

   • ARisk acceptance
   • BRisk reduction
   • CRisk avoidance
   • DRisk transfer
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is implementing a new security information and event management (SIEM) solution. The direct costs include the software license ($80,000/year) and hardware ($20,000/year). The indirect costs include the time security analysts spend tuning the SIEM and responding to alerts, estimated at 1 FTE ($100,000/year). The SIEM is expected to reduce the annual expected loss from $300,000 to $100,000. What is the NET financial benefit of the SIEM?

   • A$100,000 net benefit
   • B$200,000 net benefit
   • C$0 net benefit (break-even)
   • D$100,000 net loss
   Reveal Solution Discussion Select an answer first