CCNA IT Risk Assessment Questions

Patching removes the vulnerable code path entirely, stopping exploitation before it can occur, which is the defining mechanism of a preventive control. This directly satisfies the stem's requirement for the control type most effective at preventing exploitation of the identified web application vulnerability.

The controls demonstrably lower risk from critical to medium, satisfying the stem's inherent-to-residual reduction. Residual risk of 8 reflects the remaining exposure after control operation, confirming effectiveness rather than mere existence. This axis—measured risk reduction—distinguishes effective controls from implemented-but-ineffective ones.

An intrusion detection system monitors network traffic and raises alerts on suspicious activity, satisfying the detective control requirement of identifying events after they occur. Unlike preventive controls such as firewalls, which block traffic, it detects and reports intrusions without stopping them, providing the visibility CRISC expects for detection.

Risk registers must be updated to reflect changes in the internal and external environment. A new regulation can alter likelihood, impact, or risk appetite, making prior assessments obsolete. If the register is stale, treatment plans and resource allocations may be misdirected. Escalation ensures the committee can direct reassessment and realign risk responses with current conditions.

A 5×5 heat map plots likelihood against impact using ordinal scales, so assessors assign ratings without quantitative data or modelling. This makes results fast to produce and readily understood by executives and business stakeholders, satisfying the need to communicate IT risk posture quickly across the organisation.

Residual risk is the remaining risk after controls have been implemented. After deploying EDR tools and network segmentation, the risk of a malware attack is reduced but not eliminated. The re-evaluated risk level is therefore the residual risk, which reflects the effectiveness of the controls.

Outsourcing with contractual penalties shifts financial loss from security breaches to the cloud provider. Transfer moves risk to a third party via contract, unlike avoid, mitigate or accept. The penalties clause confirms the loss is borne externally, satisfying the transfer definition.

Lost business from reputation damage is a secondary loss because it is a consequential, stakeholder-driven effect rather than the direct primary loss from the threat event itself. FAIR separates these: primary loss hits the affected asset, while secondary loss captures reactions such as customer defection, satisfying the stem's requirement for a secondary-loss example.

This approach integrates the vulnerability severity with the organization's control environment (IDS, patching) and real-world threat data (exploits in the wild) to produce a contextual risk rating. It aligns with CRISC's emphasis on business-relevant risk assessment. The analyst can then prioritize remediation based on actual risk exposure rather than raw severity.

Acceptance is the appropriate treatment when a risk falls within the organisation's defined risk appetite, since no further mitigation is justified. Formal sign-off preserves accountability and creates an audit trail, satisfying the stem's requirement that the risk owner document the decision rather than transfer, avoid or mitigate it.

The threat component identifies the actor or event that can exploit a vulnerability to cause harm. An external attacker with exfiltration capability is precisely that actor, and pairing it with the unencrypted PII vulnerability produces a complete risk statement. This is the element a risk analyst must document to describe who or what could cause the loss event.

Design adequacy examines whether the firewall rule set, architecture and coverage are capable of mitigating the identified risk if operating as intended. This satisfies the stem's effectiveness assessment because a control with flawed or incomplete design cannot deliver the required protection, regardless of how reliably it runs day to day.

Operating effectiveness is demonstrated when testing confirms the control functions as designed throughout the review period, not merely that it exists. Design adequacy addresses whether the control is suitably constructed; testing evidences actual consistent operation, satisfying the auditor's effectiveness criterion.

A 5x5 likelihood-impact matrix maps risks to qualitative ratings using predefined scales, requiring no quantitative data or modelling. This makes assessment fast and produces a visual heat map that stakeholders readily interpret, satisfying the need for efficient communication.

Separation of duties ensures that no single individual can execute and confirm a trade, which directly reduces the likelihood of unauthorized or fraudulent trading. By requiring a second person to confirm trades, the control prevents a trader from acting alone. This is the most effective preventive control for reducing the likelihood of unauthorized trading activity in this scenario.

The shared jump server creates a bridge between the corporate IT and OT networks. If an attacker compromises the IT network, they can use the jump server to pivot into the OT environment, bypassing the segmentation. This significantly increases the likelihood of ransomware spreading to OT. The jump server is the most critical factor because it directly enables lateral movement across the security boundary.

Access controls prevent unauthorized access.

When a vulnerability has a known exploit and no patch is available, implementing compensating controls like enhanced monitoring, intrusion detection, and network isolation can reduce the likelihood or impact of exploitation. This is the most immediate and practical response to mitigate risk while awaiting a patch. It directly addresses the exposure without requiring a permanent fix.

The SOC 2 Type II report must cover the specific trust services criteria and processes relevant to payroll processing for the report to reduce residual risk. If the report excludes key systems or controls, the high inherent risk may remain largely unmitigated. Evaluating the scope ensures that the independent assurance actually addresses the risks identified in the assessment, making it the most critical factor.

Higher inherent risks typically get higher priority.

An IDS monitors activity and raises alerts after or during an event, making it detective rather than preventive. It identifies intrusions without blocking them, which is the defining characteristic of detective controls as opposed to preventive, corrective or compensating types.

A bridge letter addresses the period between the report end date and the current date, and an updated report covering the new region provides evidence for the changed environment. Reviewing both lets the practitioner evaluate whether controls continued to operate and whether the migration introduced new risks. This is the most direct way to restore assurance without duplicating the vendor's audit work.

Residual risk is what remains after existing controls are applied to an inherent risk. The firewall and intrusion detection system reduce the high inherent level, so the recalculated figure reflects control effectiveness rather than the untreated exposure.

Loss Event Frequency is a core FAIR factor, combining Threat Event Frequency and Vulnerability to express how often loss events occur. It satisfies the stem's requirement for a direct model component, sitting on the frequency axis of risk, which FAIR quantifies as Loss Event Frequency multiplied by Loss Magnitude.

ALE is calculated as single loss expectancy (SLE) multiplied by annualized rate of occurrence (ARO). Here SLE is $800,000 and ARO is 0.25 (once every four years), so ALE = $800,000 × 0.25 = $200,000. This is the expected annual loss from the ransomware risk and is the correct value for prioritizing treatment options.

A parent-child structure clusters risks that stem from the same root cause while retaining each entry's likelihood, impact, owner, and treatment. This reduces the apparent volume of top-level entries without losing the granularity needed for treatment and monitoring. It maintains traceability and supports aggregation for reporting to the board, which is exactly what the CISO needs here.

This is correct because network segmentation with restrictive firewall rules prevents exploitation attempts from reaching the unpatched terminals and limits lateral movement, directly lowering the likelihood that a known vulnerability is successfully exploited. It is a preventive control that reduces exposure even when patching is not feasible on the legacy point-of-sale devices.

This is correct because consistent, well-documented rating criteria allow different business units to apply the same scales in comparable ways, and recording the evidence behind each rating gives auditors a clear rationale to review. It directly supports both comparability across units and traceability of assessment judgments for the trading platform risk register.

Acceptance is a deliberate decision, so the risk owner must record the risk in the risk register with its acceptance rationale and obtain formal sign-off. This creates an auditable trail proving the risk was knowingly accepted within the organisation's stated risk appetite, satisfying governance and accountability requirements.

Ransomware affecting health records typically triggers statutory notification and penalty exposure under health privacy regulations, and these costs can dwarf the ransom itself. Including them makes the magnitude estimate reflect legal and compliance consequences rather than only restoration effort. This directly addresses the scenario's concern about undercounting loss dimensions beyond direct recovery.

Preventive controls act before an event occurs, blocking or deterring it to lower likelihood. Detective and corrective controls address discovery or recovery after the fact, so they reduce impact rather than probability, which the stem specifically asks about.

Liability clauses and cyber insurance shift the financial consequence of payroll errors to the vendor and insurer, while the organisation retains operational responsibility. This is risk transfer, satisfying the stem's high inherent risk mitigated through contractual and insurance mechanisms rather than avoidance or reduction.

Cyber insurance transfers the financial impact of a realised risk to the insurer in exchange for premiums, leaving the organisation to bear only deductibles and uncovered losses. This satisfies the stem's requirement for a valid risk transfer mechanism, since the monetary consequence, not the risk itself, is shifted.

A 5×5 heat map plots likelihood against impact using ordinal ratings, so it needs no quantitative loss data or statistical modelling. This satisfies the scenario's need for a fast, low-data qualitative assessment, though it sacrifices precision.

The skill level and motivation of a threat actor directly influence the probability that a vulnerability will be exploited. A highly skilled and motivated attacker is more likely to identify and successfully exploit weaknesses. This factor is a core component of threat likelihood estimation in risk assessments, as it reflects the capability and intent of potential adversaries.

Comparing premium against expected loss establishes whether transferring the risk is economically rational. This satisfies the stem's evaluation requirement by testing cost-effectiveness: if premiums approach or exceed probable losses, retention or mitigation may deliver better value than insurance.

Risk acceptance requires the risk owner to formally sign off, documenting accountability for the decision to tolerate the risk without added controls. This satisfies the requirement that acceptance be authorised at the appropriate level, since the risk falls within the stated risk appetite.

Operating effectiveness verifies the control performs consistently as designed over the review period, through testing evidence such as samples, logs or observations. Combined with design adequacy, it establishes whether the control genuinely mitigates the risk within the key process.

Encryption at rest ensures that data stored in the repository is encrypted, so if an attacker gains access, they cannot read the data without the decryption key. This directly reduces the impact of a breach because the confidentiality of the data is preserved. It does not prevent the breach itself, but it mitigates the consequences, such as intellectual property theft or regulatory penalties. This is a classic impact-reducing control.

Risk characterization begins with identifying the relevant threats (hardware failure, loss of key personnel), vulnerabilities (no vendor patches, no documentation), and business impact (transaction outages, reconciliation errors). Only after these elements are articulated can the firm assess likelihood and impact and select a treatment. Jumping to quantification or control selection before identification would leave critical exposure drivers unexamined and produce an incomplete risk picture.

Purchasing cyber insurance shifts the financial consequence of a breach to an insurer for a premium, which is risk transfer. This satisfies the stem because the organisation retains the threat but not the loss burden, distinguishing transfer from mitigation, avoidance or acceptance.

Risk mitigation reduces the likelihood or impact of a risk through controls. For ransomware, layered controls like offline backups, security awareness training, and endpoint detection can significantly reduce the chance of a successful attack and enable rapid recovery. Given the high likelihood and severe impact, mitigation is the most practical strategy to protect patient safety and meet regulatory requirements without halting essential operations.

A 5x5 heat map plots likelihood and impact using ordinal rating scales rather than monetary values, which is the defining mechanism of qualitative risk analysis. It satisfies the scenario's constraint of subjective, expert-driven ranking, unlike quantitative analysis, which requires numerical data such as annualised loss expectancy.

Security awareness training helps mitigate insider threats and reduces the likelihood of successful phishing or social engineering attacks, which are common vectors for malware. It is a preventive control that addresses the human factor. For POS systems, training employees on secure practices and threat recognition is essential. This action directly addresses the identified threats, especially insider theft and malware. It complements technical controls.

A risk map (heat map) plots risks on a matrix of likelihood and impact, enabling the firm to visually identify which risks fall into high-priority zones. This helps allocate limited resources to the most significant risks first, aligning with the goal of prioritizing risk response. It does not quantify exact losses or replace detailed analysis, but it is a key tool for communicating and prioritizing risk.

This is correct because the unpatched weakness in the portal is a flaw or gap that a threat actor could exploit. In risk assessment, vulnerability represents the internal weakness that, combined with a threat and its potential impact, creates risk. It is the condition that enables the threat actor's capability and intent to translate into a successful DDoS amplification against the customer portal.

In FAIR, loss event frequency derives from threat event frequency multiplied by vulnerability, so 10 × 0.3 yields 3 loss events per year. This satisfies the stem's quantitative requirement, converting ten annual threat events into the subset that actually becomes losses given the 0.3 vulnerability rate.

Expected annual loss combines an estimated loss magnitude with an estimated frequency, producing a monetary value that can be compared and summed across risks. Even rough ranges give management a defensible basis for ranking by financial exposure. This directly answers the goal of focusing resources where potential loss is greatest, and it aligns with quantitative risk analysis techniques used in CRISC.

Cost-benefit analysis weighs each control's implementation expense against the risk reduction it delivers, revealing where treatment gives the greatest return. This satisfies the stem's prioritisation requirement by ensuring resources target risks where mitigation is economically justified rather than merely highest-scoring.

The number of attempted intrusions per month is a direct measure of threat event frequency. A higher number of attempts increases the likelihood that one will succeed, assuming the vulnerability exists. This is a key input in quantitative risk analysis models like FAIR, where threat event frequency is estimated from historical data or industry trends. It directly affects the probability of a breach.

Residual risk is the exposure that remains after controls have been implemented and their effectiveness assessed. It reflects what is left once mitigation is accounted for, distinguishing it from inherent risk, which exists before any controls are applied.

Storing backups on the same network share as the primary data means ransomware can encrypt both, eliminating the recovery benefit. The control is not effective in reducing impact. Thus, the residual risk remains high. This is a common pitfall in backup strategies; best practice is to keep offline or immutable backups. The risk practitioner should identify this as a control weakness and recommend remediation.

Decommissioning the legacy system removes the risk's source entirely, so no residual likelihood or impact remains. Avoidance is the only treatment that eliminates exposure rather than reducing or transferring it, satisfying the stem's high-likelihood, high-impact constraint.

A risk register entry without an accountable owner or review date cannot support monitoring, treatment decisions, or escalation, because no one is responsible and the data may be stale. Confirming ownership and setting a review cadence is the foundational fix that makes every other register attribute usable. This directly matches the missing fields described in the scenario.

Network segmentation and the absence of external connectivity directly reduce the attack surface and limit the pathways an attacker could use to reach the vulnerable platform. Even with a high exploitability score, the likelihood of exploitation drops because the threat actor cannot easily access the asset. This is the primary factor that lowers likelihood in this scenario.

FAIR derives Loss Event Frequency from how often threat agents act against the asset, multiplied by the probability those actions succeed given existing controls. Vulnerability here is the percentage of threat events that become loss events, not a separate control rating.

Residual risk is based on inherent risk reduced by controls.

SLE is $2,000,000 × 0.40 = $800,000. ALE = SLE × ARO = $800,000 × 0.25 = $200,000. This represents the expected annual loss from this specific risk before any controls are applied, which is the correct quantitative output for prioritizing the risk against other assessed risks.

Multiplying SLE by ARO yields the annualised loss expectancy: $50,000 × 0.2 = $10,000. This satisfies the stem's requirement to quantify expected yearly loss for the risk, giving decision-makers the cost baseline needed to compare against control costs during risk response prioritisation.

A manual, single-person approval bottleneck is a process vulnerability because it creates delay, human error, and a single point of failure in patch deployment. This weakness exists in the organization's procedures and can be exploited indirectly by attackers who rely on slow patching windows. Recording it enables the risk team to recommend automation, segregation of duties, and service-level targets for patch cycles.

A 5x5 heat map relies on ordinal scales whose labels and thresholds each organisation defines differently, so ratings reflect assessor judgement rather than calibrated measurement. This satisfies the stem's focus on the primary limitation: scores cannot be meaningfully benchmarked across organisations, undermining consistent enterprise-wide risk comparison.

Subjectivity and lack of comparability are key limitations.

FAIR estimates loss event frequency from threat event frequency and vulnerability, combined with loss magnitude, to quantify risk in monetary terms. Vulnerability is one of the three primary factors, representing the probability a threat event becomes a loss.

Risk level and cost-benefit analysis directly satisfy the prioritisation constraint by ranking treatments against both exposure magnitude and the economics of mitigation. Residual risk reduction per unit of spend determines sequencing, ensuring limited resources target the highest-impact exposures first rather than addressing every identified risk equally.

Correct; operational impact affects productivity.

An IDS monitors network traffic and raises alerts on suspicious activity, satisfying the detective control requirement of identifying incidents after they occur. Unlike preventive controls such as firewalls, which block traffic, or corrective controls, it provides visibility and evidence, enabling timely response to potential intrusions.

Risk acceptance demands documented accountability, so formal sign-off by the risk owner satisfies the stem's requirement. The owner holds authority over the affected asset and bears residual loss, making their approval the control that legitimises accepting the risk rather than treating it. Without that signature, acceptance is unowned and unenforceable.

Likelihood is one of the two axes in a qualitative risk assessment, paired with impact, to derive the overall risk rating. It expresses the probability that a given threat will exploit a vulnerability, directly satisfying the stem's requirement for the elements used to determine that rating.

A natural disaster causing a data center outage is a threat event. It can lead to loss of availability of the HR system. Even though the cloud provider may have controls, the organization should consider this threat as part of its risk assessment, especially for critical systems. It is an external event with potential business impact.

Qualitative assessment rates likelihood and impact using judgement-based scales rather than measurable frequencies, so the owner's confidence in perimeter defences becomes an unverified subjective input. This subjectivity is the limitation, since no objective data validates the low-likelihood claim despite the catastrophic impact.

An intrusion prevention system actively blocks detected malicious traffic inline, reducing the likelihood or impact of exploitation. This lowers residual risk while retaining the vulnerability, which is the defining mechanism of risk mitigation rather than avoidance, transfer or acceptance.

Risk avoidance eliminates the exposure entirely by discontinuing the activity that generates it, rather than transferring, mitigating or accepting the risk. Stopping the business activity removes both the likelihood and impact, which is the defining characteristic of the avoid treatment option.

Granular risk entries preserve the unique threat, vulnerability, and impact profile of each scenario. Unauthorized access, data corruption, and denial of service have different causes, likelihoods, and consequences, and they demand different controls. Keeping them separate lets the risk manager assign accurate ratings, target treatment effectively, and track residual risk for each scenario rather than averaging unrelated exposures into a single misleading figure.

Purchasing cyber insurance shifts the financial consequence of a breach to a third party, which is risk transfer. The organisation retains the risk itself but compensates for losses through the insurer, rather than avoiding, mitigating or accepting it.

Loss Event Frequency decomposes into Threat Event Frequency and Vulnerability, so Threat Event Frequency is a direct LEF input. It measures how often threat agents act against the asset, which then combines with vulnerability to yield loss event frequency.