Information Security Risk Management practice questions

Mitigate the risk by conducting regular vendor audits.

Why it fails: Mitigation reduces but does not eliminate risk; may still exceed appetite.

Transfer the risk by requiring vendors to have cyber insurance.

Why it fails: Insurance addresses financial impact but not the risk of breach itself.

Accept the risk because third-party risks are unavoidable.

Why it fails: Acceptance is not appropriate when risk appetite is low.

Risk of unauthorized external access to internal services.

Why it fails: The ACL permits outgoing traffic, not incoming.

Risk of denial-of-service attacks from internal hosts.

Why it fails: DoS would require specific attack vectors, not just outbound rules.

Risk of IP spoofing attacks from the inside network.

Why it fails: ACLs do not inherently allow spoofing; spoofing depends on other factors.

Change the password policy to require 12-character passwords.

Why it fails: Strong passwords help but do not prevent repeated attempts.

Increase logging verbosity to capture more details.

Why it fails: More logging does not mitigate the attack.

Disable SSH access and use console only.

Why it fails: Overly restrictive, impacting productivity.

Accept the risk because the likelihood is only moderate

Why it fails: Acceptance is not appropriate when the risk exceeds appetite and remediation is possible.

Reassess the risk with a higher risk appetite threshold

Why it fails: Changing the threshold to match the risk is not a valid risk management practice.

Transfer the risk by purchasing cyber insurance

Why it fails: Insurance transfers financial impact but does not reduce the inherent risk level.

Risk mitigation by implementing compensating controls

Why it fails: Compensating controls are a form of mitigation, but the question says the system cannot be patched; however, compensating controls can still reduce risk. The key is that the vulnerability cannot be fixed, so mitigation may not be fully effective. The best answer is acceptance if no controls are cost-effective.

Risk transfer through cyber insurance

Why it fails: Insurance transfers financial risk but not operational risk; the vulnerability remains.

Risk avoidance by decommissioning the system

Why it fails: Decommissioning would avoid risk but is not acceptable because the system is critical.

Document the risk in the risk register and accept it

Why it fails: Documentation alone is not sufficient; escalation is needed for high residual risk.

Immediately perform a new risk assessment

Why it fails: A new assessment may be done later, but the immediate action is to escalate and consider additional controls.

Identify assets and threats

Why it fails: Identifying assets and threats is the first activity of risk assessment, not a phase-matching answer in itself; the stem asks which lifecycle phase each activity belongs to. Listing assets and threats would be the correct activity when scoping a risk assessment, but here it must map to phase A, not stand alone.

Determine risk level

Why it fails: Determine risk level is also part of Risk Assessment, as it involves analyzing and evaluating the identified risks.

Select controls to reduce risk

Why it fails: Selecting controls to reduce risk belongs to Risk Treatment, not Risk Assessment, which covers identification, analysis and evaluation. It is tempting because control selection follows assessment logically, and would be correct when matching activities to the treatment phase of the lifecycle.

Monitor risk over time

Why it fails: Monitoring risk over time belongs to the Risk Monitoring phase, not Risk Assessment, which covers identifying assets and threats and determining risk levels. It is tempting because continuous monitoring feels integral to assessment, and it would be the right match if the activity were tracking control effectiveness after treatment.

Vulnerability scanning

Why it fails: Vulnerability scanning is a tool used within risk assessment, not a component of the program itself.

Incident response

Why it fails: Incident response is a separate process, not a component of risk management.

Planning, then Scope definition, then Execution, then Documentation, then Reporting

Why it fails: This is incorrect because planning cannot precede scope definition; the scope defines what the audit covers, and planning depends on that scope.

Scope definition, then Planning, then Reporting, then Execution, then Documentation

Why it fails: This is incorrect because reporting should occur after execution and documentation; reporting before execution would mean there is no audit evidence to report.

Scope definition, then Execution, then Planning, then Documentation, then Reporting

Why it fails: This is incorrect because execution must be guided by a plan; performing audit activities without a plan leads to inefficiency and missing key controls.

Digital Signature: Ensures confidentiality of data

Why it fails: Incorrect — digital signatures provide authentication and non-repudiation, not confidentiality. Confidentiality is ensured by encryption.

Public Key Infrastructure (PKI): Uses a single shared key for both encryption and decryption

Why it fails: Incorrect — PKI is a framework for managing digital certificates and public-key encryption, not symmetric encryption. A single shared key describes symmetric encryption.

Financial audit

Why it fails: A financial audit examines monetary controls and reporting accuracy, not threat exposure to information assets. It tempts because auditors do surface control weaknesses, but its scope is financial statement assurance, whereas risk identification requires asset, threat and vulnerability analysis.

Penetration testing

Why it fails: Penetration testing validates exploitable weaknesses in a live environment, but it is an assessment technique, not a risk-identification method covering the full risk landscape. It tempts because it genuinely uncovers vulnerabilities, yet risk identification draws on asset inventories, threat intelligence and structured workshops.

OCTAVE Allegro methodology

Why it fails: OCTAVE Allegro produces qualitative, practice-based ratings rather than monetary loss figures, so it cannot compute annual loss expectancy from numerical probabilities. It suits self-directed information asset risk workshops where business managers rank relative priorities without financial quantification.

NIST SP 800-30 Revision 1 risk assessment process

Why it fails: NIST SP 800-30 Rev 1 supports qualitative, semi-quantitative and quantitative assessment, but its core output is risk ratings and likelihood-impact tables, not a prescribed ALE calculation from monetary values and numerical probabilities. It fits general-purpose federal risk assessments rather than a purely quantitative ALE model.

Qualitative risk assessment using risk matrices

Why it fails: Risk matrices map likelihood and impact onto ordinal scales, producing qualitative rankings that cannot yield monetary annual loss expectancy. They suit rapid triage and communication where numerical probability data and asset values are unavailable or unnecessary.

Risk transfer by purchasing cyber insurance

Why it fails: Insurance transfers the financial consequence but leaves the vulnerable legacy system processing cardholder data, so the 30% annual likelihood persists. Transfer is correct for low-frequency, high-severity risks you cannot economically reduce; here remediation at $500,000 is cheaper than the $600,000 annualised loss exposure.

Risk acceptance because the probability is low

Why it fails: A 30% annual probability is not low, and acceptance leaves a $600,000 annualised loss exposure against a $500,000 remediation cost. Acceptance suits risks below tolerance where treatment costs exceed expected loss; this exposure exceeds that threshold and involves cardholder data.

Risk avoidance by decommissioning the legacy system

Why it fails: Decommissioning removes the business capability entirely, which the stem never requires; the numbers favour remediation, since $500,000 is below the $600,000 annualised loss expectancy. Avoidance suits scenarios where no control can reduce likelihood or impact to an acceptable level, or where the process itself is dispensable.

Risk amplification

Why it fails: Risk amplification is not a recognised response; the standard set comprises mitigate, transfer, avoid and accept. It is tempting because risk can legitimately be increased deliberately — accepting greater exposure to pursue higher return — but that is still classified as risk acceptance, not a separate response.

Risk neutralization

Why it fails: Not a standard response.

Risk retention

Why it fails: Retention is a valid response, so it cannot be one of the two incorrect options; accepting a risk and funding any resulting loss is legitimate where exposure falls within appetite. Selecting it here misreads the question, which asks for valid responses, not invalid ones.

192.168.10.25

Why it fails: Prioritisation must follow the scan's severity and asset criticality data, not an arbitrary address. This host may carry only low-risk findings, so remediating it first diverts effort from the genuinely exposed system. It would be the right focus only if its findings and business impact ranked highest.

All hosts should be equally prioritized

Why it fails: Risk mitigation ranks findings by severity, exploitability and asset criticality, so treating every host identically ignores the scan's own scoring. Resources would be spread across low-risk systems while critical exposures wait. Equal prioritisation suits environments where all hosts share identical exposure and value.

192.168.10.30

Why it fails: Selection depends on the scan's severity ratings and the asset's business criticality, not on which address appears in the results. This host may hold only minor findings, so patching it first leaves the highest-risk system exposed. It would be correct only if its findings ranked top.

HighlyConfidential handling requirements

Why it fails: Salary data carries a lower classification than HighlyConfidential, so that tier's controls were not the minimum breached. HighlyConfidential typically covers trade secrets or regulated data whose exposure triggers stricter handling. Applying it here overstates the classification and misidentifies which requirement the email actually violated.

Internal handling requirements

Why it fails: Internal handling permits circulation within the organisation, yet salaries must not reach all staff indiscriminately. The breach concerns a more restrictive tier than Internal. Internal requirements would be the answer only for material intended for every employee, such as a policy notice.

Public handling requirements

Why it fails: Public classification imposes no handling restrictions, so nothing could be violated by disclosure. Salary information is confidential, not public. Public requirements would apply only to information already approved for unrestricted release, such as published marketing material or press statements.

Segmentation of network zones

Why it fails: Segmentation of network zones is a mitigating control that limits lateral movement, not a risk. It would be the correct answer if the question asked which control reduces blast radius, rather than which architectural weakness creates exposure.

Admin access via VPN and jump host

Why it fails: Admin access via VPN and jump host is a controlled, auditable pathway, not inherently the significant risk. It would be correct if the stem showed unmanaged credentials or no logging; the architecture's actual exposure lies elsewhere.

Use of TLS 1.3 for encryption

Why it fails: TLS 1.3 is a current, secure transport protocol and mitigates rather than introduces risk, so it cannot be the most significant risk in the architecture. It is tempting because encryption protects data in transit, which would be the correct control when the scenario's concern is interception or eavesdropping on network traffic.

FAIR

Why it fails: FAIR quantifies loss event frequency and magnitude in monetary terms, so it addresses the quantitative half but lacks a prescribed qualitative governance or regulatory compliance structure spanning business units. It suits organisations needing defensible financial risk quantification, not a blended compliance-driven framework.

OCTAVE

Why it fails: OCTAVE is an asset-driven, self-directed information security risk assessment method for internal teams; it does not deliver the regulatory compliance mapping or enterprise-wide quantitative aggregation the institution requires. It fits organisations seeking a lightweight, workshop-based assessment of their own information assets.

NIST SP 800-30

Why it fails: NIST SP 800-30 provides a generic risk assessment process, not a financial-sector regulatory compliance framework or a quantitative/qualitative balancing methodology. It suits federal agencies and general organisations needing a flexible assessment guide, not institutions requiring prescriptive regulatory alignment.

Number of successful phishing simulations

Why it fails: Successful phishing simulations measure control effectiveness, not risk exposure, so they function as a key performance indicator of awareness training. They tempt because phishing metrics feel security-relevant, but a KRI must track likelihood or impact of a risk event, such as the number of unpatched internet-facing hosts.

Number of vendors with SOC 2 reports

Why it fails: Counting vendors with SOC 2 reports measures assurance coverage, a control or compliance metric rather than a forward-looking risk indicator. It tempts because third-party risk is in scope, yet a KRI would track exposure such as the number of critical vendors lacking current attestation or with unresolved findings.

Percentage of employees completing security training

Why it fails: Training completion percentage measures control implementation, making it a key performance indicator of the awareness programme, not a KRI. It tempts because human error drives incidents, but a KRI tracks risk movement, for example the number of employees failing phishing tests or repeat policy violations.