Sample questions
Security Compliance RiskDifficulty 2
A team scores security risks using risk_score = likelihood (1-5) × impact (1-5). Vulnerability A has likelihood 2 and impact 5. Vulnerability B has likelihood 5 and impact 2. Both compute to a risk_score of 10. What is the correct interpretation of this equal score?
- aThe equal score hides different risk profiles — A is rare-but-severe, B is frequent-but-minor — so treatment should track the driving factor.✓
- bBoth carry the identical numeric score, so they can safely be handed the same mitigation plan without looking at which factor produced the number.
- cThe equal score means both findings should be assigned to the same on-call team, since the score alone determines ownership routing.
- dMultiplying likelihood by impact is invalid whenever the two individual factors differ between findings, even if the product happens to match.
Explanation:A risk score is a comparison aid, not a full description of the risk. Two findings can land on the same number for very different reasons — one driven by severe-but-rare impact, the other by frequent-but-minor impact — and those reasons should shape which control (e.g., hardening a rare failure path vs. rate-limiting a frequent one) gets prioritized.
Security Compliance RiskDifficulty 1
What does 'risk' mean conceptually in a security context?
- aThe certainty that a specific attack will occur against the system at some point in the future.
- bThe potential for loss when a threat exploits a vulnerability, generally weighed by likelihood and impact together.✓
- cAny deviation from an internal company policy document, regardless of whether it enables actual harm.
- dThe purchase cost of the security tooling a team has chosen to deploy across its systems.
Explanation:Risk is not certainty of harm, nor is it simply a policy deviation or a tool's price tag. It is the potential for loss when a threat exploits a vulnerability, and it is meaningfully described by combining how likely that is with how bad the outcome would be.
Security Compliance RiskDifficulty 3
A team places findings on a likelihood/impact matrix. One finding is low-likelihood, high-impact — a rare but catastrophic failure of the backup-restore process. Another is high-likelihood, low-impact — frequent failed logins with no meaningful downstream consequence. How should the team compare these two when deciding priority?
- aThe high-likelihood, low-impact finding should always be handled first, since anything that happens often automatically outranks anything rare.
- bThe low-likelihood, high-impact finding can be dropped from the backlog entirely, since rare events are not worth planning for.
- cBoth need context-specific evaluation — a rare catastrophic risk can outrank a frequent minor one, so likelihood alone shouldn't decide.✓
- dImpact should be ignored whenever likelihood is low, because a low likelihood factor dominates the overall ranking by itself.
Explanation:A likelihood/impact matrix is meant to surface trade-offs, not to let one axis auto-decide the answer. A rare event that could be catastrophic (e.g., an unrecoverable backup failure) can reasonably outrank a frequent but low-consequence nuisance, so both dimensions need to be weighed together rather than picking a winner from one axis alone.
Security Compliance RiskDifficulty 2
An organization identifies a risk and formally decides to add no additional control, documenting the decision along with a named residual-risk owner. Which risk treatment category does this represent, and how does it differ from mitigation?
- aMitigation — because writing down the decision itself is a control that reduces the impact of the underlying risk.
- bAvoidance — because documenting the decision removes the activity that was the source of the risk in the first place.
- cTransfer — because putting the decision in writing shifts responsibility for the outcome onto whoever signs the document.
- dAcceptance — the risk is knowingly retained without reducing likelihood or impact, unlike mitigation.✓
Explanation:Documenting a decision to take no further action, with an accountable owner, is the definition of risk acceptance: the risk is knowingly retained as-is. Mitigation, by contrast, actively reduces likelihood or impact through additional controls — the two are distinct even though both can be legitimate outcomes of a risk assessment.
Security Compliance RiskDifficulty 2
A company depends on a legacy internal tool with a known vulnerability that cannot be patched in the near term. Instead of fixing it, the company purchases a cyber-insurance policy covering losses from a breach of that specific tool. Which risk treatment category best describes this action?
- aTransfer — the financial consequence shifts to a third party while the vulnerability itself remains unchanged.✓
- bMitigation — because paying a premium reduces the technical likelihood that the vulnerability will ever be exploited.
- cAvoidance — because insurance removes the activity that created the vulnerability from the system entirely.
- dAcceptance — because the company has decided the vulnerability is not worth budgeting anything toward addressing.
Explanation:Buying insurance does not change the vulnerability's likelihood or eliminate the activity — the tool remains exploitable exactly as before. What changes is who bears the financial consequence if it is exploited, which is the defining trait of risk transfer, distinct from mitigation, avoidance, or acceptance.
Security Compliance RiskDifficulty 1
Which action is the clearest example of risk avoidance?
- aPurchasing insurance that pays out in the event of a data breach affecting customer records.
- bDiscontinuing the feature entirely, since that removes the underlying risk source altogether.✓
- cAdding a network firewall rule that reduces the exposure of an internal service.
- dFormally documenting and accepting a known low-severity risk that remains in the system.
Explanation:Avoidance means eliminating the activity that creates the risk in the first place — here, dropping the feature removes the risk source entirely. Insurance is transfer, a firewall rule is mitigation, and documenting acceptance is acceptance — each is a distinct treatment category.