CCNA Crisc Risk Assessment Questions

Preventive controls aim to stop the risk event from occurring; patching is a classic preventive control.

The reduction from 20 to 8 indicates the controls are effective in reducing risk.

Detective controls identify risk events that have occurred. Intrusion detection systems (IDS) monitor network traffic for malicious activity and alert administrators.

Qualitative risk analysis using heat maps is quick to perform and easy to communicate to stakeholders, making it the primary advantage. The other options are not primary advantages of this method.

Annualized benefit = reduction in ALE - annual control cost. Reduction in ALE = $150k - $30k = $120k. Benefit = $120k - $20k = $100k.

Transferring risk shifts the financial consequences to a third party, such as through outsourcing or insurance.

Secondary loss includes indirect costs like reputational damage, loss of customer trust, and share price impact.

The cost of implementing additional controls exceeds the potential financial loss from regulatory fines, making mitigation economically inefficient. Transferring the risk through cyber insurance is the most appropriate option because it shifts the financial impact of the fines to an insurer, aligning with cost-benefit analysis principles in risk management.

When a risk is within appetite, the appropriate response is to accept it, with formal documentation and sign-off by the risk owner.

Control effectiveness is a combination of design adequacy and operating effectiveness. Additionally, the control's ability to address the specific risk (relevance) is important. Frequency alone does not determine effectiveness.

Operating effectiveness means the control has been tested and consistently produces the intended result in practice. Even if a control is well-designed, it may fail during actual operation due to misconfiguration, human error, or environmental changes. Testing confirms that the control functions as designed under real conditions, which is the definitive indicator of operating effectiveness.

Qualitative risk analysis using heat maps is quick and easy to communicate to stakeholders, making it a common initial assessment tool.

Configuring access controls is a preventive control because it proactively restricts unauthorized users from accessing the financial application, reducing the likelihood of a security incident. By enforcing least privilege and authentication mechanisms, it directly mitigates the risk of exploitation of the outdated software by limiting who can interact with it.

Option B is correct because the inherent risk score provides a baseline measure of risk without considering controls, which is essential for prioritizing which risks require immediate attention. This score is typically calculated as a product of likelihood and impact, and it helps the team focus on the most severe potential threats first.

IDS detects ongoing attacks (detective), backup restoration helps recover after an incident (corrective).

Residual risk is the level of risk that remains after controls have been implemented and their effectiveness has been factored in. In this scenario, the firewall and intrusion detection system are controls that reduce the inherent risk, but some risk (e.g., from zero-day exploits or misconfigurations) will persist, which is the residual risk.

FAIR components include Loss Event Frequency (LEF), Threat Event Frequency (TEF), Vulnerability, and Loss Magnitude. Annualized Loss Expectancy (ALE) is a derived metric, not a direct component. Single Loss Expectancy is a component of ALE but not a separate FAIR component.

When a risk falls within the organization's risk appetite, the most appropriate action is to formally accept it. The risk owner must document the risk and obtain formal sign-off to ensure accountability and auditability, as required by the risk management framework. This aligns with the principle that risks within appetite do not require additional treatment beyond formal acceptance.

Preventive controls are designed to stop a risk event from occurring in the first place. For example, implementing a firewall rule to block unauthorized inbound traffic reduces the likelihood of a network intrusion. This aligns with the CRISC definition of preventive controls as proactive measures that reduce the probability of a risk scenario.

A WAF reduces the likelihood of successful exploitation by inspecting and filtering HTTP/HTTPS traffic for common attack patterns such as SQL injection and cross-site scripting (XSS). It blocks malicious payloads before they reach the application, directly lowering the probability that a vulnerability will be exploited. This aligns with the risk mitigation strategy of reducing threat exposure.

Transfer involves shifting risk to a third party, such as through outsourcing with contractual liability transfer and insurance.

Cyber insurance and outsourcing with contractual liability transfer are classic examples of risk transfer. Accepting, avoiding, and mitigating are not transfer.

The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.

A 5×5 heat map is a qualitative risk assessment tool that uses ordinal scales (e.g., low, medium, high) for likelihood and impact. Its primary advantage is that it requires less data and time to implement compared to quantitative methods, which demand detailed financial data and complex calculations. This makes it practical for rapid, high-level IT risk prioritization when precise data is unavailable.

Risk transfer effectiveness depends on policy coverage, residual risk after transfer, and cost-benefit. Likelihood reduction is not directly applicable as transfer does not reduce likelihood.

Acceptance requires formal documentation and sign-off by the risk owner, acknowledging the risk within appetite.

Control effectiveness is assessed based on design adequacy (whether the control is properly designed) and operating effectiveness (whether it works as intended).

In FAIR, Loss Event Frequency (LEF) is directly influenced by the probability that a threat actor will successfully exploit a vulnerability. Vulnerability severity (how easily a vulnerability can be exploited) is a key component of the 'Vulnerability' factor in FAIR's decomposition, which feeds into LEF. Even with high threat capability and severe impact, if vulnerability is low (strong patching), LEF remains low because the attack is unlikely to succeed.

A 5×5 heat map often uses 'Critical' for the highest risk level (5×5).

Transfer involves shifting risk to a third party, such as through insurance or outsourcing with liability transfer.

A 5x5 heat map is a qualitative risk analysis technique that uses ordinal scales for likelihood and impact to derive risk ratings.

In the FAIR framework, loss event frequency (LEF) is calculated as the product of threat event frequency (TEF) and vulnerability (V). Given TEF = 10 per year and V = 0.3, LEF = 10 × 0.3 = 3 per year. This represents the expected number of loss events per year, accounting for the probability that a threat event will actually result in a loss.

Risk ranking by inherent risk score and cost-benefit analysis of controls are key factors in prioritization.

Option C is correct because residual risk is calculated by applying control effectiveness as a percentage reduction to inherent risk. This is the standard formula used in risk management frameworks: Residual Risk = Inherent Risk × (1 - Control Effectiveness). If control effectiveness is 0.8 (80%), then only 20% of the inherent risk remains, reflecting the portion not mitigated by controls.

Residual risk is the risk that remains after management has implemented risk responses and assessed the effectiveness of existing controls. It is calculated by considering the inherent risk (risk without controls) and the risk reduction provided by controls, factoring in control gaps or weaknesses. Option D correctly captures this definition by emphasizing the assessment of control effectiveness.

Risk avoidance means stopping the activity that introduces the risk.

Avoidance involves eliminating the activity that creates the risk, such as decommissioning a system.

In the FAIR model, Loss Event Frequency (LEF) is the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This represents how often a threat agent successfully exploits a weakness, making option B correct. The formula is LEF = TEF × Vuln, where Vulnerability is the probability that a threat event will result in a loss.

Inherent risk score (A) is correct because residual risk is calculated by considering the inherent risk level and the effectiveness of controls in reducing that risk. Since the inherent risk is very high due to high threat frequency and vulnerability, this baseline score must be factored into the residual risk calculation to determine the remaining risk after controls are applied.

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given SLE = $50,000 and ARO = 0.2, the ALE is $50,000 × 0.2 = $10,000. This aligns with the FAIR framework's quantitative risk analysis formula.

Incident response team expenses (C) are direct costs because they are immediate, quantifiable outlays incurred specifically to respond to and mitigate a risk event. Similarly, customer notification costs (E) are direct costs as they represent mandatory, traceable expenditures for informing affected parties, often required by regulations like GDPR or HIPAA. These costs are directly attributable to the incident and can be precisely measured.

Qualitative risk analysis using heat maps is subjective and results are not comparable across different organizations due to varying risk appetites and cultural interpretations.

Qualitative analysis is subjective and relies on ordinal scales, making results not directly comparable across different organizations.

FAIR decomposes risk into threat event frequency, vulnerability, and loss magnitude. These are the main input factors for calculating risk.

Prioritization should be based on the risk level (score) and the cost-benefit analysis of controls to ensure efficient resource allocation.

Operational downtime (B) is a direct consequence of a ransomware attack, as encryption of critical systems halts business processes, leading to lost productivity and revenue. This category is essential for impact assessment because it quantifies the duration and scope of service disruption, which directly affects operational continuity.

Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

When a risk manager decides to accept a risk because the cost of controls exceeds the potential loss, the risk treatment option is risk acceptance. This requires formal acknowledgment and sign-off by the risk owner, who is accountable for the risk and must document the decision, typically in a risk register, to ensure governance and auditability.

In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Qualitative analysis is subjective; different stakeholders may interpret likelihood and impact differently based on their perspectives. The risk owner's judgment may be biased by existing controls.

Deploying an intrusion prevention system (IPS) is a risk mitigation measure because it actively monitors and blocks malicious traffic targeting the vulnerability, reducing the likelihood of exploitation. Implementing a security patch directly removes the vulnerability, thereby reducing both the likelihood and impact of a potential attack. Both actions modify the risk by applying technical controls to lower the residual risk level.

When an organization stops a business activity that creates high-risk exposure, it is applying the risk avoidance treatment option. This is a deliberate decision to eliminate the risk entirely by discontinuing the associated process, system, or operation, rather than attempting to reduce or transfer the residual risk. In IT risk management, avoidance is often chosen when the cost or impact of mitigation exceeds the benefit of the activity, or when the risk level is intolerable under any control scenario.

Transferring risk to a third party, such as an insurance company, is a risk transfer strategy. The insurance company assumes the financial risk in exchange for premiums.

In FAIR, Loss Event Frequency = Threat Event Frequency × Vulnerability.

The Factor Analysis of Information Risk (FAIR) framework is the most commonly used quantitative risk analysis framework for calculating Annualized Loss Expectancy (ALE) because it provides a structured, probabilistic approach to decompose risk into loss event frequency and loss magnitude. Unlike qualitative frameworks, FAIR enables precise ALE computation by modeling threat event frequency, vulnerability, and probable loss, making it the standard for quantitative IT risk assessments in the CRISC domain.

LEF = Threat Event Frequency (TEF) × Vulnerability (V).

In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is calculated as the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This reflects that the frequency of loss events depends on how often a threat event occurs and the probability that the threat event will result in a loss, which is the vulnerability component. The multiplication captures the dependency: even if threats are frequent, low vulnerability reduces LEF, and vice versa.

Inherent risk considers likelihood and impact without controls.

Control operating effectiveness is necessary to calculate residual risk because it measures how well a control actually reduces risk in practice. Even if a control is well-designed, poor implementation or maintenance can leave residual risk higher than expected. This aligns with the CRISC formula: Residual Risk = Inherent Risk × (1 - Control Effectiveness).

Threat actor capability and motivation are factors in likelihood assessment.

In a 5×5 matrix, likelihood 4 and impact 5 give a product of 20, which is typically in the 'critical' range. Common thresholds: 1-5 low, 6-10 medium, 11-15 high, 16-25 critical.

An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for malicious actions or policy violations and generates alerts when such events occur. Unlike preventive controls, an IDS does not block or stop the attack; it detects and reports it after the fact, enabling incident response.

The movement from 'High' inherent risk to 'Medium' residual risk indicates that the implemented controls have reduced the risk level by one step on the 5x5 heat map, but have not eliminated it entirely. Since the residual risk is still 'Medium' rather than 'Low' or 'Very Low', the controls are only partially effective—they mitigate some of the risk but do not bring it down to the organization's target risk appetite or tolerance level.

Risk avoidance means avoiding the risk by discontinuing the activity that generates it.

Direct financial costs include incident response, recovery, and notification costs.

Residual risk is inherent risk adjusted for control effectiveness. Weak operating effectiveness means controls are not fully effective, so residual risk remains relatively high.

Cyber insurance is a form of risk transfer, where the financial impact of a loss is shifted to the insurer.

Residual risk is the risk remaining after controls are applied, and it should be within the risk appetite.

Comprehensive impact assessment includes financial, operational, regulatory, and reputational categories. The question asks for three, and the correct ones are financial, regulatory, and reputational (or operational, any three of the four are acceptable; here we choose financial, regulatory, and reputational).

Detective controls are designed to detect incidents after they happen.

The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). Given ALE = $500,000 and SLE = $100,000, the ARO is $500,000 / $100,000 = 5. This means the data breach is expected to occur 5 times per year.

Transfer shifts risk to a third party, such as an insurance company.

Risk prioritization should balance the risk level (high vs low) and the cost-benefit of controls. High risks with cost-effective controls should be prioritized.