CCNA Information Security Risk Management Questions

Residual risk above tolerance cannot simply be left; the risk owner must decide. Either obtain formal management approval to accept the elevated exposure or apply further controls to bring it within tolerance, preserving accountability and documented risk ownership.

The board's risk appetite and tolerance levels provide the criteria for evaluating and treating risks. Aligning treatment with appetite requires first understanding what the board deems acceptable. This step ensures that subsequent risk assessments and control decisions are consistent with organizational objectives and regulatory constraints. It is the foundational step before any analysis or control implementation in the new region.

Interim compensating controls reduce exposure immediately while the strategic control is deployed. Privileged access reviews, session logging, and least privilege directly address insider misuse of privileged accounts at low cost. This approach balances risk reduction with the budget and timeline constraints and demonstrates due diligence to regulators.

Annualised loss expectancy multiplies single loss expectancy by annualised rate of occurrence. A $2 million loss every five years gives an exposure factor of 0.2 per year, yielding $400,000. This satisfies the policy's quantitative requirement by expressing expected annual loss in monetary terms, enabling direct comparison against control costs.

Risk identification establishes which threats, vulnerabilities and assets fall within scope, feeding every later stage. This satisfies the framework requirement by ensuring exposures are discovered and recorded before analysis, treatment or monitoring can meaningfully occur.

ALE is derived by multiplying single loss expectancy by annualised rate of occurrence: $10,000 × 0.5 = $5,000. This quantifies the expected yearly financial loss from server failure, giving management a monetary figure for comparing against the cost of countermeasures.

Compensating controls reduce the likelihood and impact of exploitation during the transition period without halting store operations. Segmentation limits lateral movement from compromised terminals, and enhanced monitoring improves detection. This balances continuity with risk reduction and provides the board with a defensible interim position while the permanent remediation is completed.

Threat identification enumerates the sources and actors capable of exploiting vulnerabilities, forming the input that lets assessors determine which risks apply to each asset. Without it, likelihood estimates and subsequent risk calculations lack any credible basis.

This entry pairs a threat actor with a weakness in the offboarding process and a potential data loss impact, which makes it a valid risk. It should be captured with likelihood, impact, and a risk owner so that controls such as behavior monitoring, least privilege, and rapid deprovisioning can be evaluated. It is not a control, because it describes what could go wrong rather than what is already in place.

Threat likelihood is a core component of inherent risk.

Validation tests the model's conceptual soundness, data quality and assumptions against realised losses, while sensitivity analysis identifies which inputs drive the 40% underestimation. Peer review alone does not detect calibration drift, so this directly addresses the board's accuracy concern.

Residual risk equals inherent risk adjusted by control effectiveness. Partially effective controls on a high inherent risk likely leave residual risk above the mandated medium ceiling, so acceptance breaches risk appetite and additional controls are required.

Compensating controls (network segmentation, strict POS hardening, enhanced monitoring) reduce exposure from the unpatched OS while a phased upgrade preserves store operations and spreads cost, directly satisfying the stem's dual constraint of risk reduction and business continuity.

SLE equals asset value times exposure factor: $2,000,000 × 0.25 = $500,000. ALE equals SLE times ARO: $500,000 × 0.5 = $250,000. This satisfies the stem's quantitative inputs, yielding the expected annual loss from that risk.

A change in vendor ownership can alter legal jurisdiction, data handling practices, and breach notification obligations, so the risk manager must first assess the resulting risk to the organization. This assessment informs whether to renegotiate, add controls, or exit the relationship. Treating the acquisition as a trigger for reassessment aligns with continuous third-party risk management and gives decision-makers the facts they need.

The customer database is the most critical asset because it contains sensitive personal and payment card information. A breach of this data can lead to severe financial penalties, reputational damage, and legal liability. Regulations such as PCI DSS and GDPR impose strict requirements on protecting such data. Therefore, the database should be the primary focus of risk assessment and protection efforts.

Compensating controls change the risk picture, so the CISO must reassess residual risk. Network segmentation and enhanced monitoring may reduce likelihood or impact, but only a formal residual risk assessment can show whether the remaining risk is within tolerance. That assessment then informs whether to accept, further treat or escalate the risk, ensuring decisions are based on evidence rather than assumption.

Risk acceptance decisions must be based on a valid cost-benefit analysis and approved by the authority whose level matches the risk. The security manager should verify the analysis and escalate for acceptance. This ensures due diligence and proper governance. Only after validation and authorization should the risk be marked as accepted in the register. This step is critical before any acceptance is finalized.

Least privilege restricts each account to the permissions its role requires, shrinking the attack surface and limiting blast radius if credentials are compromised. It is a preventive administrative control that lowers inherent risk rather than transferring or accepting it.

Escalation for formal acceptance is driven by residual risk, not inherent risk, because implemented controls already reduce exposure. Only when the remaining exposure breaches the tolerance thresholds set by executive management does the risk require a decision at board level. Risks sitting inside appetite are managed by line management under delegated authority, so this criterion correctly routes decisions to the body empowered to accept them.

Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk. EDR detects and responds to malicious activity, thereby reducing the chance of successful POS malware or limiting its damage. The organization is taking action to lower the risk to an acceptable level. This is a classic example of mitigation.

The risk owner is accountable for identifying, assessing and managing risks within their business unit, owning the response decision and residual exposure. This satisfies the stem's requirement, distinguishing them from security staff who advise and from senior management who set appetite.

The board policy requires escalation of residual risk above 12 for a formal treatment decision. The CISO's role is to provide the risk committee with sufficient information to choose among treatment options. Presenting the risk with options, costs, and impacts enables informed decision-making and complies with the established governance threshold, making this the most appropriate first action.

Assessing the launch against the new regulatory requirements gives leadership a factual view of the exposure, and presenting treatment options with business impact lets them make an informed risk-based decision. This respects the business unit's objectives while ensuring that regulatory risk is identified, evaluated, and consciously accepted or mitigated by the accountable owners.

ISO 27005 sequences risk identification before risk analysis. Having identified the vulnerability, the organisation must next estimate the likelihood of exploitation and the resulting impact, which produces the risk level used for subsequent evaluation and treatment decisions.

An independent audit report, such as SOC 2 Type II, provides validated evidence that the provider's controls operated effectively over a period. It covers security, availability, and confidentiality criteria and is issued by a third-party auditor. This gives the organization reliable assurance for risk assessment and vendor management, far more than self-attestations or marketing claims.

A gap assessment maps existing controls to regulatory requirements and prioritizes remediation by risk, showing executives exactly where exposure exists and how it will be addressed. This aligns security investment with compliance obligations and provides a defensible, measurable plan. It demonstrates that the program is driven by both regulatory need and business risk rather than by technology preferences.

After corrective controls are implemented, a residual risk assessment determines what risk remains, confirming whether treatment reduced exposure to an acceptable level or whether further action, transfer or acceptance is required before closing the change management gap.

TLS encryption for data in transit directly closes the identified HIPAA gap, protecting ePHI as it crosses the internet between endpoints. It is the specific technical safeguard addressing the audit finding, and is prioritised because unencrypted transmission is an active, ongoing breach exposure.

Quantitative risk assessment uses numerical data, such as monetary values and probabilities, to calculate expected losses. This provides an objective and consistent basis for comparing risks across business units. Senior management can use metrics like annualized loss expectancy (ALE) to prioritize investments. While quantitative methods require more data and effort, they meet the requirement for objectivity and comparability better than qualitative scales.

Subtracting the $300,000 annual control cost from the $2,000,000 in loss reduction ($2,400,000 ALE minus $400,000 residual ALE) yields a net benefit of $1,700,000 per year. This cost-benefit figure directly demonstrates that the investment produces a positive return, which is the clearest financial justification for the executive committee.

Qualitative assessment ranks risks using descriptive scales such as high, medium and low, drawing on expert judgement rather than numeric values. It satisfies the stem by being one of the two recognised risk assessment approaches, suiting scenarios where precise monetary estimates are impractical.

A risk aggregation model quantifies cumulative impact across correlated low-likelihood, low-impact risks, exposing the combined exposure that siloed assessments miss. Enterprise-level controls then address that aggregate exposure, satisfying the stem's requirement to manage risks whose significance emerges only collectively rather than individually.

The current annualized loss expectancy is 0.04 × $4,000,000 = $160,000, and after the project it is 0.01 × $4,000,000 = $40,000, giving an expected annual risk reduction of $120,000. Because the $900,000 project cost exceeds a single year's benefit, the manager must weigh multi-year benefit, risk appetite, regulatory requirements, and non-quantifiable impacts before recommending the investment. This is a sound risk-treatment analysis.

Compensating controls directly address the unpatched vulnerabilities without requiring remediation the legacy system cannot support, reducing likelihood while preserving daily payment operations. Because the system is critical and cannot be patched, mitigation through alternative safeguards satisfies the risk-reduction requirement better than avoidance, transfer, or acceptance.

Risk assessment results give senior management the likelihood and business impact figures needed to decide whether to accept, transfer, mitigate or avoid each risk. Communication therefore exists to support informed risk acceptance decisions at the level holding accountability for organisational risk.

A shared taxonomy and calibrated scales ensure that a 'high likelihood' means the same thing in the finance unit as in the plant operations unit, making assessments comparable across the enterprise and allowing aggregation into an organizational risk profile. Without this consistency, ratings from different units cannot be meaningfully combined or trended.

A gap analysis is the logical first step because it identifies where the current program falls short of the legal requirements. Without understanding the gaps, the CISO cannot prioritize investments, assign resources or develop a credible compliance roadmap. The analysis provides the factual basis for all subsequent decisions, ensuring that remediation efforts target actual deficiencies rather than assumptions.

Data classification identifies which records fall under each jurisdiction's data protection laws, and role-based access controls enforce least privilege across those categories. This satisfies the low-residual-risk appetite by limiting exposure of regulated personal data held in the multinational CRM.

Translating security risk into business impact, such as revenue loss, regulatory penalty, or service disruption, and recording it on the enterprise's common scales allows ERM to compare and aggregate it with other risk types. This integration supports enterprise prioritization and gives executives a coherent view of total risk exposure.

A risk assessment identifies assets, threats and vulnerabilities, establishing the baseline that every later decision depends on. Without it, control selection, treatment options and programme scope lack justification, making it the appropriate initial step for this firm after its ransomware loss.

Parameterised queries separate SQL code from user-supplied data, and input validation rejects malformed input, eliminating the injection vector itself. This directly addresses the identified insufficient input validation, removing the high-likelihood risk rather than transferring or accepting it.

Residual risk is the exposure that persists once controls have been applied, since no safeguard eliminates every threat or vulnerability entirely. This directly satisfies the stem's requirement to describe risk remaining after treatment, distinguishing it from inherent risk, which exists before any mitigation is implemented.

The deductible is the amount the organization must pay before the insurer covers the remaining loss. Since the $400,000 incident is within the $1 million policy limit and the claim is approved, the organization pays only the $50,000 deductible. The insurer covers the remaining $350,000, assuming no exclusions apply.

ALE equals SLE multiplied by ARO: $50,000 × 0.2 = $10,000. The control costs $12,000 annually while reducing expected loss to $2,500, a $7,500 benefit, so it is not cost-justified. Accepting the risk is therefore the most cost-effective response.

A defined, consistently applied scoring scale ensures that likelihood and impact ratings mean the same thing across business units and jurisdictions. This enables aggregation, comparison, and prioritization at the enterprise level. Without a common scale, risk results become subjective and cannot be reliably combined, undermining the bank's ability to manage risk holistically and report accurately to regulators and the board.

Conducting a third-party risk assessment obtains evidence of the vendor's controls, certifications, and breach history, replacing unclear posture with documented findings. That evidence supports contract terms, remediation demands, or termination decisions affecting sensitive data exposure.

Risk management programmes require governance sponsorship to allocate budget, enforce policy and resolve cross-functional conflicts. Absent senior management support, assessments stall, treatment plans go unfunded, and business units treat risk activities as optional rather than mandated.

Stronger access controls restrict who can reach personal data, directly lowering the probability of another unauthorised disclosure. Mitigation addresses the likelihood dimension the question specifies, unlike acceptance, avoidance or transfer, which do not reduce recurrence.

Deploying a virtual patch and increasing monitoring reduces the likelihood that the vulnerability will be successfully exploited while the organization works toward a permanent fix. The risk source still exists, but compensating controls lower the exposure to an acceptable level. This is the defining characteristic of mitigation: reducing likelihood or impact through controls rather than eliminating, transferring, or simply accepting the exposure.

The board has defined a clear risk tolerance threshold, so the CISO's first duty is to determine whether the assessed risk exceeds that threshold and, if so, present treatment options that bring residual risk within tolerance. This aligns security decisions with business objectives and gives the board the comparative information it needs to approve a treatment strategy.

Assigning a risk owner establishes clear accountability for managing each risk. The owner ensures that treatment plans are executed, residual risk is monitored, and status is reported. Without ownership, risks may languish without action or oversight. This is a fundamental requirement for an effective risk register and supports governance and auditability.

When residual risk exceeds the documented risk appetite, the gap is a governance issue that must be escalated to the risk owners and senior management who set the appetite. They are accountable for deciding whether to fund additional controls, accept the deviation, or change business plans. Informing them first ensures the decision is made at the appropriate authority level.

When an approved treatment is not progressing, the residual risk is higher than the committee believed when it accepted the plan. The security manager's first duty is to restore accurate risk visibility by updating the register and informing the same governance body that approved the treatment. This keeps decision-makers able to re-evaluate acceptance, reallocate resources, or approve interim compensating controls based on current facts.

Qualitative analysis with a defined likelihood and impact scale suits the limited historical data and the two-week window, because it relies on calibrated expert judgment rather than statistical loss data. It still produces a defensible, repeatable ranking of ERP risks when the scales and calibration criteria are documented, meeting the executives' need for prioritized results quickly.

ISACA defines risk appetite and tolerance as core programme components: they express how much risk the organisation is willing to pursue or retain, and they bound every subsequent assessment, treatment and acceptance decision within the risk management framework.

The RTO of 4 hours exceeds the 2-hour MTD, so the system cannot recover within tolerable downtime. Reducing the RTO to 1 hour through automation brings recovery inside the MTD, directly satisfying the stem's constraint and closing the gap.

Applying the vendor patch reduces the likelihood that the vulnerability can be exploited, which lowers the overall risk exposure while the business activity continues. This is the defining characteristic of risk mitigation: implementing controls to reduce likelihood or impact. Patching is a classic preventive control within a vulnerability management program.

A named risk owner is essential because risk treatment requires accountability. Without an owner, remediation actions may stall, and no one is responsible for monitoring changes in likelihood or impact. The owner ensures that the risk is assessed, treated and reported appropriately, and provides a clear point of contact for auditors and management. This element directly supports decision-making and follow-through.

Risk appetite is a strategic statement of how much risk the organization is willing to accept in pursuit of its goals. It guides decision-making by setting boundaries for risk-taking and helps ensure that security investments align with business objectives. It is broader than tolerance and provides the context within which specific tolerances and thresholds are defined.

Risk scenarios with likelihood and impact ratings translate identified threats into structured, comparable entries, letting the report rank exposures objectively. This satisfies the best-practise requirement that a risk assessment report quantify and prioritise risk rather than merely list assets or controls.

Business impact analysis ranks assets by the operational, financial and regulatory harm their compromise would cause. This satisfies the prioritisation criterion by tying assessment effort to consequence severity, ensuring the most critical assets receive attention first rather than being ranked by convenience or cost.

Implementing MFA reduces the likelihood of exploitation by adding a second authentication factor, lowering the inherent risk while retaining the activity. Mitigation treats risk through controls rather than transferring, avoiding or accepting it, matching the risk owner's decision.

Stale assessments no longer reflect current threats, vulnerabilities or asset values, so the recorded risk profile diverges from reality. This noncompliance with the annual review requirement directly satisfies the stem's consequence: decisions are made on outdated data, misdirecting controls and remediation funding.

The risk treatment process begins with validating the identified risk and prioritizing it using criteria such as likelihood, impact, and alignment with risk appetite. Only after the risk is confirmed and ranked can appropriate treatment options be evaluated. This ensures resources are directed to the most significant risks first and that treatment decisions are justified and consistent.

Dedicated HSMs place cryptographic key custody under the organisation's control, while contractual region restrictions enforce data residency, directly addressing both identified gaps. Because the board's low risk appetite demands mitigation to an acceptable level, these controls reduce the CSP-dependent risks rather than merely accepting or transferring them.

Assigning an owner, documenting inherent and residual ratings, and linking to the affected process or asset makes the register actionable. Ratings show how controls change exposure, and linkage enables prioritization based on business impact. Without these elements, the register becomes a list that cannot drive treatment decisions or accountability in an OT context where safety and availability matter.

The risk owner's refusal exceeds their delegated authority because the risk appetite statement permits moderate residual risk only with CRO approval. Escalating to the risk management committee routes the accept, mitigate or defer decision to the body mandated to resolve it.

Where further reduction costs $1 million and exceeds the expected benefit, the risk owner accepts the residual risk with formal senior management sign-off. This satisfies the stem's constraint of a low risk appetite against an uneconomic control.

Risk appetite and tolerance define the amount and type of risk the organization is willing to accept in pursuit of its objectives. Treatment decisions must align with these thresholds. Without this context, a control decision may be inappropriate even if technically sound. This makes risk appetite and tolerance the primary factor guiding whether to accept, mitigate, transfer, or avoid the risk.

A KRI tracks measurable metrics against defined thresholds, so deviations signal rising risk exposure before losses materialise. This satisfies the stem's focus on primary purpose: providing early warning that lets management act ahead of an incident rather than reporting it afterwards.

Risk assessment results map each security project to the business risks it mitigates, so prioritisation directs spending toward initiatives protecting the most critical objectives. This satisfies the stem's requirement of aligning security investment with business goals.

Every risk must have an accountable owner and a documented response, such as mitigate, transfer, avoid, or accept. The owner ensures follow-through, and the response defines the intended treatment. Without these, the register becomes a list of issues rather than a managed risk portfolio, and senior management cannot assign accountability or track remediation progress effectively.