CCNA Crisc Risk Assessment Questions

The annualized loss expectancy (ALE) is calculated as SLE × ARO. With SLE constant at $2 million and the new ARO reduced to 0.1, the new ALE is $2,000,000 × 0.1 = $200,000. This reflects the residual risk after the control is implemented.

The reduction from high to medium indicates that controls are partially effective in reducing risk, but not completely.

Option B is correct because cost-benefit analysis ensures that the resources invested in controls are justified by the reduction in risk, which is a core principle of risk management. Without this analysis, an organization might over-invest in low-impact risks or under-invest in high-impact ones, leading to inefficient allocation of budget and effort.

Acceptance requires that the risk is within the organization's risk appetite and that the risk owner formally documents and signs off the acceptance. It is not appropriate if controls are available or if the risk exceeds appetite.

Loss Event Frequency (LEF) in FAIR is directly influenced by the probability that a threat agent will act against a vulnerability. Increasing the vulnerability severity makes the application more susceptible to exploitation, thereby raising the likelihood of a loss event occurring, even if the threat actor has low capability.

In FAIR, Loss Magnitude (LM) is the sum of Primary Loss (direct costs) and Secondary Loss (indirect costs) resulting from a loss event.

Outsourcing shifts the risk of managing the data center to a third party, which is risk transfer. Contractual liability may also be transferred.

Avoidance involves eliminating the activity that creates the risk, thus removing the risk entirely.

In a 5x5 heat map, risk rating is typically the product or sum of likelihood and impact. With likelihood 4 and impact 5, the product is 20, which falls in the critical category.

Corrective controls respond to and recover from risk events. Incident response procedures are corrective because they address incidents after they occur.

Option C is correct because qualitative risk analysis using a 5×5 heat map is designed to be quick to perform and easy to communicate visually to non-technical stakeholders. The color-coded matrix (e.g., red for high risk, green for low risk) allows immediate understanding of risk priorities without requiring complex calculations, making it ideal for initial risk assessments and board-level reporting.

Residual risk is the risk remaining after controls are applied. To calculate it, you must know the inherent risk level (the risk before controls) and then assess how effectively controls reduce that risk. Control design adequacy and operating effectiveness determine how much the inherent risk is mitigated, directly impacting the residual risk calculation.

Risk prioritization is primarily based on the level of risk (inherent or residual) to allocate resources to the most critical risks. Ease of mitigation, cost, and business unit preference are secondary.

Qualitative analysis is subjective and results may not be comparable across different organizations due to varying risk appetites and interpretations.

In FAIR, Loss Event Frequency (LEF) is calculated as Threat Event Frequency (TEF) multiplied by Vulnerability (V).

Control adequacy is determined by assessing both design adequacy and operating effectiveness, which together reduce inherent risk to the desired residual risk level.

In the FAIR model, Threat Event Frequency (TEF) is the component that estimates how often, within a given timeframe, a threat agent (such as a hacker or malware) will initiate an action against an asset. This directly matches the question's definition of 'probable frequency that a threat agent will act against an asset.' TEF is a primary input for calculating Loss Event Frequency (LEF) and ultimately risk.

Quantitative analysis often produces uncertainty ranges, making results less precise than they appear, and requiring careful interpretation.

FAIR defines LEF = Threat Event Frequency (TEF) multiplied by Vulnerability (Vuln).

Option C (Avoid) is correct because risk avoidance involves discontinuing the activity or process that gives rise to the risk. In IT risk management, this means removing the vulnerable system, decommissioning a service, or ceasing a business function entirely to eliminate the risk exposure. For example, if an organization decides to shut down a legacy FTP server to avoid the risk of data interception, it is applying the avoid treatment.

Preventive controls aim to prevent risk events from happening, e.g., access controls, encryption.

Mitigation involves implementing controls to reduce likelihood (training reduces susceptibility) or impact (filtering reduces successful attacks).

Control effectiveness can be measured as reduction in risk score. Inherent 25 to residual 10 is a 60% reduction (15/25). This indicates controls are moderately effective, but not extremely.

Qualitative analysis is quicker and easier to communicate because it uses ordinal scales (e.g., high/medium/low) rather than numerical data.

An intrusion detection system (IDS) monitors network traffic for suspicious activity and generates alerts when it detects potential threats. This is a detective control because it identifies and reports security incidents after they occur, rather than preventing them. IDS alerts provide visibility into ongoing or past attacks, enabling incident response.

FAIR: LEF = TEF × V = 10 × 0.5 = 5 events/year. ALE = LEF × LM = 5 × $50,000 = $250,000.

Transferring risk to a third party through insurance is a classic risk transfer strategy.

Preventive controls aim to stop risk events. Access controls, encryption, and change management are preventive. Logs are detective, backup restoration is corrective.

The risk owner should formally document the risk acceptance decision and obtain approval from management as per policy.

Residual risk is the risk remaining after controls are applied. It is calculated by adjusting inherent risk for control effectiveness (design adequacy and operating effectiveness).

The FAIR framework calculates ALE as Threat Event Frequency × Vulnerability × (Primary Loss + Secondary Loss). Here, 2 × 0.3 × ($500,000 + $200,000) = 2 × 0.3 × $700,000 = $420,000. This correctly accounts for the probability of a successful attack and the total loss per incident.

When a risk is within appetite, it may be formally accepted with sign-off.

Disaster recovery plan execution (B) is a corrective control because it is activated after a disruptive event to restore normal operations. It directly addresses the impact of an incident by executing predefined procedures to recover systems and data, thereby correcting the damage caused by the outage or disaster.

Option C is correct because the risk owner must formally acknowledge and accept the residual risk after the decision to accept has been made. This sign-off demonstrates that the risk owner is aware of the remaining exposure and agrees to the risk acceptance, which is a key governance step in the risk management process. Without this sign-off, the acceptance is not formally recognized, and accountability remains unclear.

Residual risk is the risk remaining after controls are applied, calculated by adjusting inherent risk for control effectiveness.

A preventive control is designed to stop a risk event from occurring by implementing barriers or safeguards before the event can happen. For a high-risk process, this might include access control lists (ACLs) on a firewall that block unauthorized traffic, or input validation routines in an application that reject malformed data before it can trigger a buffer overflow. By proactively eliminating the threat vector, preventive controls reduce the likelihood of the risk event to zero for the protected path.

Residual risk = inherent risk adjusted for control effectiveness. If controls are well-designed but not operating effectively, they fail to reduce risk as intended, leading to high residual risk.

Preventive controls aim to stop a risk event from occurring. Access controls prevent unauthorized access, and encryption prevents data from being read if exfiltrated. Log monitoring is detective, and backup restoration is corrective.

In the FAIR framework, Annualized Loss Expectancy (ALE) is calculated as ARO × SLE. ARO (Annualized Rate of Occurrence) is a direct component of ALE, representing the expected number of loss events per year. This is a core part of the quantitative risk analysis formula used in FAIR.

Risk score = 3 × 4 = 12, which falls in the high range (12-25).

A 5x5 heat map uses ordinal scales (e.g., 1–5) for likelihood and impact, which are subjective categories rather than precise numerical values. This places it in qualitative risk analysis, where risks are ranked by descriptive labels (e.g., Low, Medium, High) without monetary or statistical quantification.

An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for signs of malicious behavior or policy violations and generates alerts when such patterns are detected. Unlike preventive controls, an IDS does not block or stop the attack in real time; it only identifies and reports the incident for subsequent investigation and response.

Acceptance is a formal decision to tolerate a risk within appetite, with documented sign-off.

The FAIR framework calculates ALE as TEF × Vulnerability × Loss Magnitude. Here, 10 × 0.2 × $500,000 = $1,000,000. This correctly incorporates the vulnerability factor (0.2) as a probability of threat success, yielding the expected annual loss.

FAIR defines LEF = Threat Event Frequency × Vulnerability (probability that a threat event results in a loss event).

Qualitative analysis is quick and easy to communicate, while quantitative is more objective but data-intensive.

LEF is the product of Threat Event Frequency (TEF) and Vulnerability (V), representing how often a loss event is expected to occur.

On a 5×5 matrix, High likelihood × Medium impact typically results in a High risk rating (e.g., 4×3 = 12, which is often in the high range).

Encryption prevents unauthorized access, making it preventive.

Qualitative analysis is subjective and not comparable across organizations due to lack of standardized scales.

Prioritization should consider the risk level and the cost-benefit of controls to ensure efficient use of resources.

Operational impacts include system downtime and productivity loss. Financial impacts like fines and reputation are separate categories.

Quantitative analysis provides objective, financially meaningful results that can be compared across organizations.

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Indirect financial impacts include lost business, reputation damage, and opportunity costs.

ALE = ARO × SLE = 0.5 × $200,000 = $100,000. This means the expected annual loss from this risk is $100,000.

A reduction from 25 to 9 indicates controls are effective in reducing risk. High inherent risk does not automatically mean high residual risk; controls can reduce it significantly.

Incident response and recovery costs are direct financial costs. Lost business and reputational damage are indirect costs.

FAIR splits Loss Magnitude into primary loss (direct costs) and secondary loss (indirect costs). Primary loss includes incident response and recovery; secondary loss includes reputation and lost business.

In a typical 5x5 risk heat map, the overall risk rating is determined by the intersection of likelihood and impact values. With likelihood 4 and impact 5, the cell falls in the 'Critical' zone (commonly defined as likelihood 4-5 and impact 4-5). This aligns with the convention where 5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational, making D the correct answer.

Residual risk = Inherent risk × (1 - Control effectiveness). Control effectiveness = 0.6. Residual risk = 20 × 0.4 = 8.

Quantitative analysis requires detailed data and is time-consuming, which can be a significant limitation.

Risk treatment prioritization must balance the cost of controls against the expected reduction in risk. A cost-benefit analysis ensures that the selected controls provide a net positive value, preventing over-investment in low-impact risks or under-investment in high-impact ones. This aligns with the ISACA Risk IT Framework, which emphasizes that risk treatment decisions should be economically justified.

Direct financial losses include costs directly incurred from the incident, such as incident response and recovery, and notification costs. Lost business and reputation damage are indirect costs.