Scenario practice questions

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

Trap 1: $25,000

Dividing SLE by ARO produces $25,000, but ALE is SLE multiplied by ARO, giving $100,000. It is tempting because the two figures invite division, yet that operation yields a per-incident average, not the annualised expected loss the formula defines.

Trap 2: $50,000

Returning the SLE unchanged ignores the ARO of 2, so the annualised figure is understated; ALE is SLE multiplied by ARO, giving $100,000. It is tempting because SLE is the headline loss figure, yet ALE must aggregate expected occurrences across the year.

Trap 3: $200,000

Multiplying SLE by 4 rather than the stated ARO of 2 overstates the result; ALE is SLE ($50,000) times ARO (2), giving $100,000. It is tempting because larger products feel conservative, yet the calculation must use the given frequency exactly.

A
$25,000
Why it fails: Dividing SLE by ARO produces $25,000, but ALE is SLE multiplied by ARO, giving $100,000. It is tempting because the two figures invite division, yet that operation yields a per-incident average, not the annualised expected loss the formula defines.
B
$50,000
Why it fails: Returning the SLE unchanged ignores the ARO of 2, so the annualised figure is understated; ALE is SLE multiplied by ARO, giving $100,000. It is tempting because SLE is the headline loss figure, yet ALE must aggregate expected occurrences across the year.
C
$200,000
Why it fails: Multiplying SLE by 4 rather than the stated ARO of 2 overstates the result; ALE is SLE ($50,000) times ARO (2), giving $100,000. It is tempting because larger products feel conservative, yet the calculation must use the given frequency exactly.
D
$100,000
Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence: $50,000 × 2 = $100,000. This quantifies the expected yearly loss for the scenario, giving risk practitioners the figure used to compare against the cost of proposed controls.

Question 2mediummultiple choice

During a risk assessment for a new financial application, the risk manager identifies that the application processes sensitive customer data and is accessible from the internet. Which of the following is the MOST appropriate risk scenario to document?

Trap 1: The application has several unpatched vulnerabilities that increase…

Unpatched vulnerabilities describe a contributing condition rather than a risk scenario, which should pair a threat event with the asset and its business impact. It is tempting because vulnerability findings feel concrete and actionable; documenting them as scenarios suits vulnerability management tracking, not the risk register's event-and-impact structure.

Trap 2: The application will implement multi-factor authentication to…

Multi-factor authentication is a planned control, not a risk scenario, so recording it documents a mitigation rather than the exposure being assessed. It is tempting because MFA genuinely reduces unauthorised-access likelihood; it belongs in the risk response or control description, not in the scenario statement itself.

Trap 3: The application must comply with PCI DSS requirements for data…

PCI DSS compliance is a regulatory obligation, not a risk scenario describing a threat event and its impact. It is tempting because the application handles payment data, so the standard genuinely applies; compliance requirements belong in control objectives or requirement mapping, whereas scenarios articulate what could happen and the resulting business consequence.

A
The application has several unpatched vulnerabilities that increase the likelihood of a security incident.
Why it fails: Unpatched vulnerabilities describe a contributing condition rather than a risk scenario, which should pair a threat event with the asset and its business impact. It is tempting because vulnerability findings feel concrete and actionable; documenting them as scenarios suits vulnerability management tracking, not the risk register's event-and-impact structure.
B
The application will implement multi-factor authentication to prevent unauthorized access.
Why it fails: Multi-factor authentication is a planned control, not a risk scenario, so recording it documents a mitigation rather than the exposure being assessed. It is tempting because MFA genuinely reduces unauthorised-access likelihood; it belongs in the risk response or control description, not in the scenario statement itself.
C
An attacker could exploit weak authentication mechanisms to gain unauthorized access and exfiltrate customer data, resulting in regulatory fines and reputational damage.
This scenario names the asset, threat vector, exploited weakness, and business impact — internet-facing weak authentication leading to exfiltration, fines, and reputational damage. That structure satisfies risk scenario documentation requirements better than generic vulnerability statements.
D
The application must comply with PCI DSS requirements for data protection.
Why it fails: PCI DSS compliance is a regulatory obligation, not a risk scenario describing a threat event and its impact. It is tempting because the application handles payment data, so the standard genuinely applies; compliance requirements belong in control objectives or requirement mapping, whereas scenarios articulate what could happen and the resulting business consequence.

Question 3hardmultiple choice

A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?

Trap 1: Event

An event is the occurrence or incident itself — the ransomware detonation — not the actor behind it. It is tempting because scenarios often pivot on the event, and naming the threat event feels central, but the template's actor element (threat actor/initiator) is what identifies who launches the attack.

Trap 2: Threat type

Threat type classifies the nature of the threat, not the actor initiating it; the template's threat actor or actor element names the initiating entity. Threat type is tempting because it also describes the attack, and it would be correct when categorising the method rather than identifying who acts.

Trap 3: Asset/Resource

Asset/Resource identifies what is targeted or affected, not who initiates the attack. It is tempting because ransomware scenarios must name the impacted asset, and asset value drives risk, but the initiating entity is the threat actor element, not the resource being attacked.

A
Event
Why it fails: An event is the occurrence or incident itself — the ransomware detonation — not the actor behind it. It is tempting because scenarios often pivot on the event, and naming the threat event feels central, but the template's actor element (threat actor/initiator) is what identifies who launches the attack.
B
Threat type
Why it fails: Threat type classifies the nature of the threat, not the actor initiating it; the template's threat actor or actor element names the initiating entity. Threat type is tempting because it also describes the attack, and it would be correct when categorising the method rather than identifying who acts.
C
Actor
The ISACA risk scenario template separates threat actor, threat event, asset, and consequence. The actor element names the party initiating the attack, such as an external ransomware group, distinguishing it from the event or impact fields.
D
Asset/Resource
Why it fails: Asset/Resource identifies what is targeted or affected, not who initiates the attack. It is tempting because ransomware scenarios must name the impacted asset, and asset value drives risk, but the initiating entity is the threat actor element, not the resource being attacked.

Question 4hardmultiple choice

A company's risk appetite statement says it is willing to accept moderate levels of operational risk but has low tolerance for compliance risk. During risk identification, which of the following scenarios should be IMMEDIATELY escalated to senior management?

Trap 1: A planned system upgrade may cause two hours of downtime during…

Planned downtime inside a maintenance window is routine operational risk, explicitly accepted at moderate levels by the risk appetite statement. It tempts because availability impact feels urgent, yet no compliance obligation is breached, so immediate senior management escalation is not warranted.

Trap 2: A vendor is late in delivering a software patch for a low-severity…

A late patch for a low-severity bug is an operational issue within the company's stated moderate operational risk appetite, so it does not trigger immediate escalation. It tempts because vendor delays sound like compliance exposure, but no regulatory obligation is breached here.

Trap 3: An employee mistakenly deletes a non-critical test database

Deleting a non-critical test database is a contained operational error matching the accepted moderate operational risk appetite. It tempts because data loss sounds severe, but the database is non-critical and no compliance requirement is implicated, so immediate escalation is unnecessary.

A
A planned system upgrade may cause two hours of downtime during maintenance window
Why it fails: Planned downtime inside a maintenance window is routine operational risk, explicitly accepted at moderate levels by the risk appetite statement. It tempts because availability impact feels urgent, yet no compliance obligation is breached, so immediate senior management escalation is not warranted.
B
A vendor is late in delivering a software patch for a low-severity bug
Why it fails: A late patch for a low-severity bug is an operational issue within the company's stated moderate operational risk appetite, so it does not trigger immediate escalation. It tempts because vendor delays sound like compliance exposure, but no regulatory obligation is breached here.
C
A new cloud service may inadvertently expose customer PII due to misconfiguration
Misconfiguration exposing customer PII breaches data-protection obligations, so it sits squarely in the low-tolerance compliance category rather than the moderate operational risk the company accepts. That mismatch with the stated risk appetite triggers immediate escalation to senior management, since regulatory penalties and notification duties cannot be absorbed within the accepted operational threshold.
D
An employee mistakenly deletes a non-critical test database
Why it fails: Deleting a non-critical test database is a contained operational error matching the accepted moderate operational risk appetite. It tempts because data loss sounds severe, but the database is non-critical and no compliance requirement is implicated, so immediate escalation is unnecessary.

Question 5hardmultiple choice

After a control self-assessment (CSA) workshop, business units reported that 80% of controls are operating effectively. However, internal audit's recent testing indicates a 30% control failure rate. What is the BEST explanation for this discrepancy?

Trap 1: The audit was conducted three months after the CSA, and controls…

Timing alone cannot explain a 30% failure rate; degradation over three months would be gradual, not a systematic gap between self-reported and independently tested results. It is tempting because control decay is real, and it would be the best explanation if audit testing showed a modest decline since the CSA.

Trap 2: CSA participants lacked adequate training on what constitutes a…

Inadequate training is a contributing factor, but the stem's 80% versus 30% split points to self-assessment bias, where business units overrate their own controls. It is tempting because untrained assessors do misjudge failures, and it would be correct if evidence showed participants consistently misapplied failure definitions.

Trap 3: The CSA covered a different scope of controls than the audit.

Scope differences would produce incomparable populations, yet the stem presents both figures as covering the same controls, so this does not explain the gap. It is tempting because misaligned CSA and audit universes do cause apparent discrepancies, and it would be correct if the two exercises genuinely assessed different control sets.

A
The audit was conducted three months after the CSA, and controls may have degraded.
Why it fails: Timing alone cannot explain a 30% failure rate; degradation over three months would be gradual, not a systematic gap between self-reported and independently tested results. It is tempting because control decay is real, and it would be the best explanation if audit testing showed a modest decline since the CSA.
B
CSA participants may have a biased perception of control effectiveness, while audit uses objective evidence.
CSA workshops rely on business units self-reporting, which introduces optimism bias and limited sampling, whereas internal audit tests controls against objective evidence such as transaction logs. That difference in evidence quality, not control design, explains the 80% versus 30% gap.
C
CSA participants lacked adequate training on what constitutes a control failure.
Why it fails: Inadequate training is a contributing factor, but the stem's 80% versus 30% split points to self-assessment bias, where business units overrate their own controls. It is tempting because untrained assessors do misjudge failures, and it would be correct if evidence showed participants consistently misapplied failure definitions.
D
The CSA covered a different scope of controls than the audit.
Why it fails: Scope differences would produce incomparable populations, yet the stem presents both figures as covering the same controls, so this does not explain the gap. It is tempting because misaligned CSA and audit universes do cause apparent discrepancies, and it would be correct if the two exercises genuinely assessed different control sets.

Question 6mediummulti select

Which TWO of the following are valid risk scenarios that should be documented during IT risk identification?

Trap 1: The organization must comply with GDPR requirements for data…

This is a compliance obligation, not a risk scenario.

Trap 2: The database server has not been patched for critical…

This is a vulnerability without a threat actor or impact.

Trap 3: The IT department will implement multi-factor authentication to…

This is a control, not a risk scenario.

A
An employee may inadvertently share confidential data via email due to lack of data classification training.
This is a risk scenario with threat, vulnerability, and impact.
B
The organization must comply with GDPR requirements for data protection.
Why it fails: This is a compliance obligation, not a risk scenario.
C
An external attacker may exploit weak password policies to gain access to the email system and exfiltrate sensitive data.
This is a complete risk scenario.
D
The database server has not been patched for critical vulnerabilities.
Why it fails: This is a vulnerability without a threat actor or impact.
E
The IT department will implement multi-factor authentication to reduce the risk of unauthorized access.
Why it fails: This is a control, not a risk scenario.

Question 7easymultiple choice

An organization uses a third-party SaaS provider for payroll processing. Which of the following is the BEST technique to identify risks associated with this vendor?

Trap 1: Request a penetration test report from the vendor

A penetration test report addresses exploitable vulnerabilities in the vendor's infrastructure, not the breadth of payroll-processing risks such as data handling, subprocessors or contractual controls. It is tempting because penetration testing genuinely evidences security assurance, and would suit a scenario demanding proof of technical hardening rather than enterprise risk identification.

Trap 2: Check online user reviews and ratings

Public reviews reflect subjective user sentiment and cannot evidence the vendor's control environment, so they fail to identify payroll-specific risks like data residency or subprocessor exposure. They are tempting because reputation screening is quick and free, and would be reasonable for shortlisting consumer software, not for formal vendor risk assessment.

Trap 3: Read the vendor's marketing materials and case studies

Marketing materials and case studies are vendor-authored promotional content, so they omit control gaps and incident history. They are tempting because they are readily available, but vendor risk identification requires independent evidence such as SOC 2 reports or completed security questionnaires.

A
Request a penetration test report from the vendor
Why it fails: A penetration test report addresses exploitable vulnerabilities in the vendor's infrastructure, not the breadth of payroll-processing risks such as data handling, subprocessors or contractual controls. It is tempting because penetration testing genuinely evidences security assurance, and would suit a scenario demanding proof of technical hardening rather than enterprise risk identification.
B
Check online user reviews and ratings
Why it fails: Public reviews reflect subjective user sentiment and cannot evidence the vendor's control environment, so they fail to identify payroll-specific risks like data residency or subprocessor exposure. They are tempting because reputation screening is quick and free, and would be reasonable for shortlisting consumer software, not for formal vendor risk assessment.
C
Read the vendor's marketing materials and case studies
Why it fails: Marketing materials and case studies are vendor-authored promotional content, so they omit control gaps and incident history. They are tempting because they are readily available, but vendor risk identification requires independent evidence such as SOC 2 reports or completed security questionnaires.
D
Review the vendor's SOC 2 Type II report and conduct an on-site assessment
A SOC 2 Type II report provides independent evidence over time that the vendor's controls operate effectively, while an on-site assessment verifies actual implementation. Together they identify payroll-processing risks the vendor's self-reported claims would miss.

Question 8hardmultiple choice

A company has a low risk appetite but high risk tolerance. Which of the following scenarios is consistent with this situation?

Trap 1: The company avoid controls and accepts high risk

Avoiding controls and accepting high risk breaches the low-appetite requirement to keep exposure minimal. It is tempting because high tolerance permits accepting risk, and would be correct where appetite is also high, allowing controls to be skipped in pursuit of objectives.

Trap 2: The company has aggressive growth targets and accepts any IT risk

Accepting any IT risk contradicts a low risk appetite, which demands minimal risk exposure. It is tempting because aggressive growth with high tolerance sounds consistent, and would fit a company with high appetite and high tolerance, not the low-appetite scenario described.

Trap 3: The company invests minimally in controls and has low residual risk

Minimal control investment yielding low residual risk is internally inconsistent; low appetite requires strong controls. It is tempting because low residual risk appears to satisfy low appetite, and would be correct if the company genuinely tolerated little risk rather than tolerating high exposure.

A
The company avoid controls and accepts high risk
Why it fails: Avoiding controls and accepting high risk breaches the low-appetite requirement to keep exposure minimal. It is tempting because high tolerance permits accepting risk, and would be correct where appetite is also high, allowing controls to be skipped in pursuit of objectives.
B
The company invests heavily in cybersecurity controls but accepts some residual risk
Risk appetite is the level of risk the organisation is willing to pursue, while tolerance is the acceptable deviation from that appetite. Heavy investment in controls reflects low appetite, and accepting residual risk shows tolerance for variation within limits.
C
The company has aggressive growth targets and accepts any IT risk
Why it fails: Accepting any IT risk contradicts a low risk appetite, which demands minimal risk exposure. It is tempting because aggressive growth with high tolerance sounds consistent, and would fit a company with high appetite and high tolerance, not the low-appetite scenario described.
D
The company invests minimally in controls and has low residual risk
Why it fails: Minimal control investment yielding low residual risk is internally inconsistent; low appetite requires strong controls. It is tempting because low residual risk appears to satisfy low appetite, and would be correct if the company genuinely tolerated little risk rather than tolerating high exposure.

Question 9mediummultiple choice

An organization is implementing a new cloud-based customer relationship management (CRM) system. Which of the following risk categories would BEST describe the risk of the CRM system failing to meet performance expectations?

Trap 1: Compliance risk

Compliance risk covers failure to meet laws, regulations or contractual obligations; poor performance against expectations breaches no external mandate. It is tempting because cloud CRM involves data protection duties, and would be correct when the risk is regulatory breach, such as mishandling customer personal data.

Trap 2: Strategic risk

Strategic risk concerns misalignment with business objectives or market direction, not whether a deployed system delivers expected throughput or response times. It is tempting because a failed CRM could undermine business goals, and would be correct when the risk is choosing the wrong product or market strategy.

Trap 3: Reputational risk

Reputational risk is the downstream consequence of an adverse event, not the category describing a system failing to meet performance expectations. It is tempting because visible CRM failures damage customer trust, and would be correct when assessing the impact of a publicly known outage or data breach.

A
Compliance risk
Why it fails: Compliance risk covers failure to meet laws, regulations or contractual obligations; poor performance against expectations breaches no external mandate. It is tempting because cloud CRM involves data protection duties, and would be correct when the risk is regulatory breach, such as mishandling customer personal data.
B
Strategic risk
Why it fails: Strategic risk concerns misalignment with business objectives or market direction, not whether a deployed system delivers expected throughput or response times. It is tempting because a failed CRM could undermine business goals, and would be correct when the risk is choosing the wrong product or market strategy.
C
Operational risk
Operational risk covers losses from inadequate or failed internal processes, people and systems. A CRM failing to meet performance expectations is a service delivery failure within live operations, not a credit, market or strategic risk, so operational risk is the appropriate category.
D
Reputational risk
Why it fails: Reputational risk is the downstream consequence of an adverse event, not the category describing a system failing to meet performance expectations. It is tempting because visible CRM failures damage customer trust, and would be correct when assessing the impact of a publicly known outage or data breach.

Question 10hardmultiple choice

A risk assessment for a cloud migration project identifies that the cloud provider does not support encryption keys managed by the customer. Which of the following risk scenarios is MOST directly related to this finding?

Trap 1: Service availability disruption

Availability disruption stems from outages, capacity or redundancy failures, none of which the key-management finding describes. Losing customer-managed keys concerns confidentiality and control of data at rest, so availability is the wrong risk axis here.

Trap 2: Data loss due to misconfiguration

Misconfiguration causes exposure through settings errors, not through the absence of customer-managed keys. The finding concerns who controls and holds the encryption keys, so the directly related scenario is loss of control over data at rest, not accidental misconfiguration.

Trap 3: Non-compliance with data residency requirements

Data residency concerns where data is stored geographically, which the provider's key-management limitation does not affect. The finding is about who controls encryption keys, so residency compliance is unrelated; key custody, not location, is the issue.

A
Service availability disruption
Why it fails: Availability disruption stems from outages, capacity or redundancy failures, none of which the key-management finding describes. Losing customer-managed keys concerns confidentiality and control of data at rest, so availability is the wrong risk axis here.
B
Data loss due to misconfiguration
Why it fails: Misconfiguration causes exposure through settings errors, not through the absence of customer-managed keys. The finding concerns who controls and holds the encryption keys, so the directly related scenario is loss of control over data at rest, not accidental misconfiguration.
C
Unauthorized access by cloud provider employees
Without customer-managed keys, the provider holds and can access the encryption keys, so provider personnel could decrypt stored data. This scenario directly addresses the loss of key custody identified in the finding, making insider access at the provider the most direct consequence.
D
Non-compliance with data residency requirements
Why it fails: Data residency concerns where data is stored geographically, which the provider's key-management limitation does not affect. The finding is about who controls encryption keys, so residency compliance is unrelated; key custody, not location, is the issue.

Question 11hardmultiple choice

During a risk assessment of a legacy system, the assessor finds that no control is currently in place. The inherent risk level is 'critical'. The residual risk will be:

Trap 1: Medium

Residual risk reflects risk remaining after controls; with no control in place, nothing reduces the critical inherent risk, so it cannot drop to medium. Medium would apply only where existing controls partially mitigate a critical or high inherent exposure.

Trap 2: High

With no control in place, residual risk equals inherent risk, so the rating must remain critical rather than drop to high. High would be tempting where a control exists but only partially mitigates the risk, reducing exposure from critical to high. Here nothing reduces it, so any downgrade misstates the actual exposure.

Trap 3: Low

Residual risk cannot fall below inherent risk without controls; with none in place, the critical rating stands unchanged. Low would be correct only where implemented controls had demonstrably reduced a critical inherent risk to that level.

A
Medium
Why it fails: Residual risk reflects risk remaining after controls; with no control in place, nothing reduces the critical inherent risk, so it cannot drop to medium. Medium would apply only where existing controls partially mitigate a critical or high inherent exposure.
B
Critical
Residual risk equals inherent risk when no control exists, because nothing reduces the likelihood or impact. With inherent risk rated critical, the residual risk remains critical, satisfying the stem's condition that no control is currently in place.
C
High
Why it fails: With no control in place, residual risk equals inherent risk, so the rating must remain critical rather than drop to high. High would be tempting where a control exists but only partially mitigates the risk, reducing exposure from critical to high. Here nothing reduces it, so any downgrade misstates the actual exposure.
D
Low
Why it fails: Residual risk cannot fall below inherent risk without controls; with none in place, the critical rating stands unchanged. Low would be correct only where implemented controls had demonstrably reduced a critical inherent risk to that level.

Question 12mediummultiple choice

After a security incident, an organization discovers that a critical database was accessed by an unauthorized user due to weak authentication controls. As part of the IT risk assessment process, which step should have identified this vulnerability?

Trap 1: Risk treatment

Risk treatment selects and implements controls to modify identified risk; it acts after identification, so it cannot discover weak authentication. It is tempting because remediation follows assessment, but it would be correct only once the vulnerability had been identified and evaluated as exceeding the organisation's risk tolerance.

Trap 2: Risk monitoring

Risk monitoring tracks known risks and control performance over time; it does not discover an unassessed weakness such as weak authentication. It is tempting because monitoring follows assessment, but it would be correct only for detecting changes in already-identified risks, not for initially surfacing this vulnerability.

Trap 3: Risk evaluation

Risk evaluation compares assessed risk against tolerance to decide whether treatment is needed; it operates on risks already identified, so it cannot surface weak authentication controls. It is tempting because it precedes treatment decisions, but it would be correct only once the vulnerability had already been found and analysed.

A
Risk treatment
Why it fails: Risk treatment selects and implements controls to modify identified risk; it acts after identification, so it cannot discover weak authentication. It is tempting because remediation follows assessment, but it would be correct only once the vulnerability had been identified and evaluated as exceeding the organisation's risk tolerance.
B
Risk monitoring
Why it fails: Risk monitoring tracks known risks and control performance over time; it does not discover an unassessed weakness such as weak authentication. It is tempting because monitoring follows assessment, but it would be correct only for detecting changes in already-identified risks, not for initially surfacing this vulnerability.
C
Risk identification
Risk identification systematically uncovers threats, vulnerabilities and existing controls before incidents occur, so weak authentication on the critical database would have been surfaced here. It satisfies the stem's requirement to determine which assessment step should have detected the vulnerability, preceding risk analysis and evaluation, which merely assess likelihood and impact of already-identified risks.
D
Risk evaluation
Why it fails: Risk evaluation compares assessed risk against tolerance to decide whether treatment is needed; it operates on risks already identified, so it cannot surface weak authentication controls. It is tempting because it precedes treatment decisions, but it would be correct only once the vulnerability had already been found and analysed.

Question 13mediummultiple choice

A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?

Trap 1: Denial of service due to excessive login attempts.

Brute-force attempts target credential guessing; lockout-driven denial of service is a secondary availability nuisance, not the exposure of medical records. Denial of service would be prioritised where uptime of a clinical or patient-facing service is the asset at risk.

Trap 2: Insufficient encryption of data in transit.

Brute-force attempts exploit authentication, not transport; encryption in transit is unaffected by repeated login failures. Insufficient transport encryption would be the priority where traffic is intercepted on the network path, such as unencrypted portal sessions over public Wi-Fi.

Trap 3: Phishing attacks targeting portal users.

Phishing deceives users into surrendering credentials, but the scenario describes automated brute-force attempts against the login endpoint, not user deception. Phishing would be prioritised where email is the primary attack vector and user awareness is the control gap.

A
Denial of service due to excessive login attempts.
Why it fails: Brute-force attempts target credential guessing; lockout-driven denial of service is a secondary availability nuisance, not the exposure of medical records. Denial of service would be prioritised where uptime of a clinical or patient-facing service is the asset at risk.
B
Unauthorized access to patient medical records.
Brute-force attempts threaten credential compromise, and success grants access to patient medical records, causing privacy breach, regulatory penalties and clinical harm. This scenario carries the highest impact and likelihood, so it warrants prioritisation over lesser availability or nuisance risks.
C
Insufficient encryption of data in transit.
Why it fails: Brute-force attempts exploit authentication, not transport; encryption in transit is unaffected by repeated login failures. Insufficient transport encryption would be the priority where traffic is intercepted on the network path, such as unencrypted portal sessions over public Wi-Fi.
D
Phishing attacks targeting portal users.
Why it fails: Phishing deceives users into surrendering credentials, but the scenario describes automated brute-force attempts against the login endpoint, not user deception. Phishing would be prioritised where email is the primary attack vector and user awareness is the control gap.

Question 14hardmultiple choice

A company identifies a high inherent risk in its online payment system. After implementing a Web Application Firewall (WAF) and conducting quarterly penetration tests, the residual risk is assessed as medium. Which of the following best explains the relationship between inherent risk, controls, and residual risk?

Trap 1: Inherent risk is the risk after controls are applied, while…

The definitions are reversed: inherent risk is assessed before controls, residual risk after. It is tempting because both terms describe the same asset's risk, so swapping their order can appear plausible, yet the stem's WAF and penetration tests clearly reduce inherent to residual.

Trap 2: Residual risk equals inherent risk minus the total cost of controls…

Residual risk is the risk remaining after controls reduce likelihood or impact, not a monetary subtraction of control costs. It is tempting because control expenditure is a real input to cost-benefit analysis, but it never arithmetically offsets inherent risk.

Trap 3: Inherent risk and residual risk are independent; residual risk is…

Residual risk derives from inherent risk modified by implemented controls, not from threat intelligence alone; the two are directly related. It is tempting because threat intelligence informs risk assessments, but it cannot independently determine residual risk without reference to inherent exposure and controls.

A
Residual risk is the inherent risk adjusted for the effectiveness of controls in reducing likelihood and impact.
Inherent risk is the exposure before controls; residual risk is what remains after controls reduce likelihood or impact. The WAF and penetration tests lowered the high inherent risk to medium, demonstrating that adjustment relationship directly.
B
Inherent risk is the risk after controls are applied, while residual risk is the risk before controls.
Why it fails: The definitions are reversed: inherent risk is assessed before controls, residual risk after. It is tempting because both terms describe the same asset's risk, so swapping their order can appear plausible, yet the stem's WAF and penetration tests clearly reduce inherent to residual.
C
Residual risk equals inherent risk minus the total cost of controls implemented.
Why it fails: Residual risk is the risk remaining after controls reduce likelihood or impact, not a monetary subtraction of control costs. It is tempting because control expenditure is a real input to cost-benefit analysis, but it never arithmetically offsets inherent risk.
D
Inherent risk and residual risk are independent; residual risk is determined solely by threat intelligence.
Why it fails: Residual risk derives from inherent risk modified by implemented controls, not from threat intelligence alone; the two are directly related. It is tempting because threat intelligence informs risk assessments, but it cannot independently determine residual risk without reference to inherent exposure and controls.

Question 15easymultiple choice

A smart manufacturing company has deployed hundreds of IoT sensors and actuators across its production line. These devices are connected directly to the corporate network without any segmentation and communicate using unencrypted protocols. A third-party vendor manages all IoT devices and has administrative access from their own network. Recently, the IT team detected unusual outbound traffic from the IoT segment to unknown IP addresses on the internet. The risk manager is leading a risk identification workshop. Based on this scenario, what is the most critical risk to the organization that should be identified and documented?

Trap 1: Compliance violation with industry regulations

Regulatory non-compliance is a downstream consequence of the unsegmented, unencrypted architecture, not the active threat the outbound traffic reveals. It is tempting because unencrypted industrial protocols do breach standards, but compliance exposure would be the primary risk only where a specific regulation directly governs those devices.

Trap 2: Loss of data integrity due to tampering with sensor measurements

Tampering with sensor readings is a plausible consequence, but the observed outbound traffic to unknown IP addresses evidences an established external channel, making network compromise and data exfiltration the immediate critical risk. Integrity tampering would be the priority where manipulated measurements were actually detected.

Trap 3: Physical damage to equipment due to unsafe actuator commands

Unsafe actuator commands require an attacker already controlling the devices; the detected outbound traffic to unknown IPs indicates command-and-control or exfiltration, which is the active, evidenced risk. Physical damage is tempting because actuators can cause harm, but that scenario fits only where tampering is confirmed.

A
Unauthorized remote access to the corporate network via the IoT devices
Unsegmented IoT devices with vendor administrative access and unencrypted protocols create a direct path into the corporate network, so the most critical risk is unauthorised remote access. This satisfies the stem's constraint by addressing the exposure that enables the detected anomalous outbound traffic.
B
Compliance violation with industry regulations
Why it fails: Regulatory non-compliance is a downstream consequence of the unsegmented, unencrypted architecture, not the active threat the outbound traffic reveals. It is tempting because unencrypted industrial protocols do breach standards, but compliance exposure would be the primary risk only where a specific regulation directly governs those devices.
C
Loss of data integrity due to tampering with sensor measurements
Why it fails: Tampering with sensor readings is a plausible consequence, but the observed outbound traffic to unknown IP addresses evidences an established external channel, making network compromise and data exfiltration the immediate critical risk. Integrity tampering would be the priority where manipulated measurements were actually detected.
D
Physical damage to equipment due to unsafe actuator commands
Why it fails: Unsafe actuator commands require an attacker already controlling the devices; the detected outbound traffic to unknown IPs indicates command-and-control or exfiltration, which is the active, evidenced risk. Physical damage is tempting because actuators can cause harm, but that scenario fits only where tampering is confirmed.

Question 16mediummultiple choice

During a solution architecture review, the Architecture Review Board (ARB) identifies that a new application communicates with a legacy system using plain text over a public network. Which risk treatment option is MOST appropriate?

Trap 1: Transfer the risk to a third-party vendor

Transferring to a vendor does not remove the plain-text exposure; the organisation still relies on the legacy link, and liability rarely shifts fully. Transfer suits insurable or contractual losses, such as outsourcing a service with indemnities, not an architectural flaw needing encryption.

Trap 2: Accept the risk because the legacy system cannot be changed

Acceptance leaves credentials and data exposed on a public network, which the ARB should not tolerate when encryption or a private path is feasible. Acceptance is valid only for low-impact risks where treatment cost exceeds the loss, not for fixable plain-text transmission.

Trap 3: Decommission the legacy system immediately

Immediate decommissioning of the legacy system would remove the plain-text transmission risk, but it fails the scenario because no alternative system or migration plan is specified; the ARB review identifies a communication vulnerability, not that the legacy system itself is obsolete. This option is tempting because decommissioning is a definitive risk-avoidance treatment for an end-of-life system, and it would be correct if the legacy system had a documented replacement already in production and the business had approved its retirement.

A
Require encryption (e.g., TLS) for the communication
TLS encrypts data in transit, directly removing the plain-text exposure over the public network that the ARB flagged. Encryption is a preventive control that reduces likelihood, which suits an architectural review where the risk is interception of credentials or sensitive payloads.
B
Transfer the risk to a third-party vendor
Why it fails: Transferring to a vendor does not remove the plain-text exposure; the organisation still relies on the legacy link, and liability rarely shifts fully. Transfer suits insurable or contractual losses, such as outsourcing a service with indemnities, not an architectural flaw needing encryption.
C
Accept the risk because the legacy system cannot be changed
Why it fails: Acceptance leaves credentials and data exposed on a public network, which the ARB should not tolerate when encryption or a private path is feasible. Acceptance is valid only for low-impact risks where treatment cost exceeds the loss, not for fixable plain-text transmission.
D
Decommission the legacy system immediately
Why it fails: Immediate decommissioning of the legacy system would remove the plain-text transmission risk, but it fails the scenario because no alternative system or migration plan is specified; the ARB review identifies a communication vulnerability, not that the legacy system itself is obsolete. This option is tempting because decommissioning is a definitive risk-avoidance treatment for an end-of-life system, and it would be correct if the legacy system had a documented replacement already in production and the business had approved its retirement.

Question 17hardmultiple choice

A risk analyst is assessing a critical application's inherent risk. After implementing controls, the residual risk is calculated as high. The analyst determines that the control design is adequate but operating effectiveness is poor. Which factor most likely explains the high residual risk?

Trap 1: Control design is inadequate

The stem states the control design is adequate, so inadequate design cannot be the cause; residual risk remains high because the controls are not operating as designed. Design adequacy is tempting because weak design commonly drives high residual risk, but that scenario is explicitly excluded here.

Trap 2: Risk appetite was misstated

Risk appetite is the tolerance threshold used to judge whether a given exposure is acceptable; it does not alter control operation, so a misstated appetite cannot cause poor operating effectiveness. It is tempting because appetite shapes risk decisions, but here the controls are designed adequately and merely failing to run as intended.

Trap 3: Inherent risk is too low

Inherent risk is the exposure before controls; if it were too low, residual risk would fall rather than stay high. The option is tempting because inherent risk feeds the residual calculation, but the stem attributes the high residual to poor operating effectiveness of otherwise adequate controls.

A
Control design is inadequate
Why it fails: The stem states the control design is adequate, so inadequate design cannot be the cause; residual risk remains high because the controls are not operating as designed. Design adequacy is tempting because weak design commonly drives high residual risk, but that scenario is explicitly excluded here.
B
Control operating effectiveness is poor
Residual risk reflects inherent risk after controls operate, not merely after they are designed. Adequate design with poor operating effectiveness means controls fail to mitigate in practise, so the high residual risk is explained by ineffective operation rather than design weakness.
C
Risk appetite was misstated
Why it fails: Risk appetite is the tolerance threshold used to judge whether a given exposure is acceptable; it does not alter control operation, so a misstated appetite cannot cause poor operating effectiveness. It is tempting because appetite shapes risk decisions, but here the controls are designed adequately and merely failing to run as intended.
D
Inherent risk is too low
Why it fails: Inherent risk is the exposure before controls; if it were too low, residual risk would fall rather than stay high. The option is tempting because inherent risk feeds the residual calculation, but the stem attributes the high residual to poor operating effectiveness of otherwise adequate controls.

Question 18hardmultiple choice

A risk manager is using the FAIR model to quantify cyber risk. After analyzing a ransomware scenario, the probable loss event frequency (LEF) is estimated at 0.2 per year, and the probable loss magnitude (LM) is $5 million. What is the annualized loss expectancy (ALE) in this scenario?

Trap 1: $500,000

This figure treats loss magnitude as though it were $2.5 million, or divides the correct product again. ALE is LEF multiplied by LM, giving $1 million here; $500,000 corresponds to a frequency of 0.1 or a magnitude of $2.5 million, neither of which the scenario states.

Trap 2: $250,000

This halves the correct result, implying a loss magnitude of $1.25 million rather than the stated $5 million. Multiplying LEF 0.2 by LM $5 million yields $1 million annualised; $250,000 would require a frequency of 0.05 at that magnitude.

Trap 3: $5,000,000

ALE is LEF multiplied by LM: 0.2 × $5 million = $1 million. Quoting the raw loss magnitude ignores the 0.2 annual frequency, overstating expected yearly loss fivefold. It is tempting because $5 million is the single-event figure the scenario supplies, and it would be the correct answer if the question asked for loss magnitude rather than annualised expectancy.

A
$500,000
Why it fails: This figure treats loss magnitude as though it were $2.5 million, or divides the correct product again. ALE is LEF multiplied by LM, giving $1 million here; $500,000 corresponds to a frequency of 0.1 or a magnitude of $2.5 million, neither of which the scenario states.
B
$250,000
Why it fails: This halves the correct result, implying a loss magnitude of $1.25 million rather than the stated $5 million. Multiplying LEF 0.2 by LM $5 million yields $1 million annualised; $250,000 would require a frequency of 0.05 at that magnitude.
C
$5,000,000
Why it fails: ALE is LEF multiplied by LM: 0.2 × $5 million = $1 million. Quoting the raw loss magnitude ignores the 0.2 annual frequency, overstating expected yearly loss fivefold. It is tempting because $5 million is the single-event figure the scenario supplies, and it would be the correct answer if the question asked for loss magnitude rather than annualised expectancy.
D
$1,000,000
Multiplying loss event frequency (0.2) by loss magnitude ($5 million) yields $1,000,000 annualised loss expectancy, satisfying the FAIR requirement to express risk as a monetary annual figure. This correctly applies the ALE formula, giving the risk manager a quantified basis for comparing the ransomware scenario against other risks.

Question 19mediummulti select

When developing realistic risk scenarios, which THREE components are essential according to the ISACA risk scenario template?

Trap 1: Mitigation cost

Mitigation cost is a treatment decision input, not a scenario component; ISACA's template pairs threat type, threat event, asset, vulnerability, and impact with likelihood and velocity. Costing controls is tempting during business case work, but scenario construction describes what could happen, not what remediation would cost.

Trap 2: Detection speed

Detection speed measures monitoring capability, not scenario structure; the template requires threat, asset or vulnerability, and impact or consequence, plus likelihood and velocity. Detection metrics belong in control effectiveness assessments, so this is tempting when evaluating SOC maturity rather than building risk scenarios.

A
Threat actor
The threat actor is the party who could exploit a vulnerability or trigger the event. Naming a specific actor — insider, criminal group, nation-state — grounds the scenario in a realistic capability and intent, which is essential for estimating likelihood within the ISACA risk scenario template.
B
Asset/resource
The asset or resource is the IT component, data or process that the threat event would affect. Identifying it precisely anchors the scenario to something the organisation values, enabling the business impact and likelihood estimates the ISACA risk scenario template requires.
C
Mitigation cost
Why it fails: Mitigation cost is a treatment decision input, not a scenario component; ISACA's template pairs threat type, threat event, asset, vulnerability, and impact with likelihood and velocity. Costing controls is tempting during business case work, but scenario construction describes what could happen, not what remediation would cost.
D
Threat event
The threat event is the specific occurrence — such as data exfiltration or ransomware encryption — that links a threat actor to an asset. It is the pivotal component that converts a general threat into a describable scenario, as the ISACA template requires.
E
Detection speed
Why it fails: Detection speed measures monitoring capability, not scenario structure; the template requires threat, asset or vulnerability, and impact or consequence, plus likelihood and velocity. Detection metrics belong in control effectiveness assessments, so this is tempting when evaluating SOC maturity rather than building risk scenarios.

Question 20hardmulti select

Which THREE of the following are typical components of a risk scenario?

Trap 1: Probability

Probability is a risk factor, not a scenario component; a scenario pairs a threat with an asset and a consequence. It is tempting because likelihood estimates are central to risk analysis, and probability would be correct when quantifying how often a given scenario is expected to occur.

Trap 2: Control

A control is a response that modifies risk, not a component used to describe it. Risk scenarios are built from asset, threat, vulnerability, event and consequence; controls appear only after assessment, when selecting treatment. It tempts because controls are central to risk management and would be the correct focus when evaluating whether existing mitigations adequately reduce an identified risk.

A
Impact
Impact quantifies the consequence if the risk event occurs, expressed in financial, operational or regulatory terms. It is a core component of a risk scenario, alongside the threat source and the event itself, enabling consistent comparison and prioritisation.
B
Threat source
The threat source identifies who or what could exploit a vulnerability, such as an external attacker, insider or natural event. Naming it anchors the scenario to a realistic cause, which is essential for assessing likelihood and selecting proportionate risk responses.
C
Probability
Why it fails: Probability is a risk factor, not a scenario component; a scenario pairs a threat with an asset and a consequence. It is tempting because likelihood estimates are central to risk analysis, and probability would be correct when quantifying how often a given scenario is expected to occur.
D
Vulnerability
A vulnerability is a weakness in an asset or control that a threat can exploit, so it forms one leg of the risk scenario triad alongside threat and impact. Naming it lets analysts assess how likely an adverse event is and which existing safeguards need strengthening.
E
Control
Why it fails: A control is a response that modifies risk, not a component used to describe it. Risk scenarios are built from asset, threat, vulnerability, event and consequence; controls appear only after assessment, when selecting treatment. It tempts because controls are central to risk management and would be the correct focus when evaluating whether existing mitigations adequately reduce an identified risk.