Scenario practice questions

Detailed results of control testing

Why wrong: Control testing results are part of control assessments.

Cost-benefit analysis of risk responses

Why wrong: Cost-benefit analysis is performed during risk response selection.

Rewrite the order matching engine in a memory-safe language

Why wrong: Rewriting the code removes the vulnerability, which is remediation, not a compensating control.

Deploy a Web Application Firewall (WAF) to block malicious payloads

Why wrong: A WAF is a preventive control that blocks attacks but does not compensate for the vulnerability; it's a separate security layer.

Enable detailed logging for all order matching transactions

Why wrong: Logging is detective and helps in forensics but does not reduce the likelihood or impact of the vulnerability.

Risk avoidance by decommissioning the system

Why wrong: Avoidance is too extreme; the system is critical.

Risk transfer through cyber insurance

Why wrong: Insurance covers financial loss but not operational downtime.

Risk acceptance because mitigation is too costly

Why wrong: Acceptance is not appropriate due to high downtime costs.

Quantitative risk assessment using ALE and SLE

Why wrong: Quantitative assessment requires reliable numerical data, which may be unavailable for insider threats.

Application of the COSO ERM framework

Why wrong: COSO ERM is an enterprise risk management framework, not specific to IT risk assessment.

Control self-assessment (CSA) against ISO 27001

Why wrong: CSA is a control evaluation, not a risk assessment technique.

Segregation of duties

Why wrong: Segregation of duties is a control, not an identification technique.

Risk acceptance

Why wrong: Risk acceptance is a risk response, not identification.

$1,000,000

Why wrong: Overestimates benefit by excluding all costs.

$950,000

Why wrong: Incorrect calculation of net benefit.

$800,000

Why wrong: Ignores annual maintenance costs.

Vulnerability scanning and penetration testing

Why wrong: These identify vulnerabilities, not financial impact.

Annualized Loss Expectancy (ALE) calculation based on past incidents

Why wrong: Past incidents may not be representative.

Failure Mode and Effects Analysis (FMEA)

Why wrong: FMEA is more about failure modes.

Denial of service due to excessive login attempts.

Why wrong: DoS is a concern but typically less impactful than data exposure.

Insufficient encryption of data in transit.

Why wrong: Encryption is a control issue, not the direct risk scenario from brute-force.

Phishing attacks targeting portal users.

Why wrong: The incident is brute-force, not phishing.

Phishing attack that captured user credentials

Why wrong: No evidence of phishing; the attack is direct login attempts.

Insider threat from a legitimate user

Why wrong: The attempts are from an external IP targeting admin.

Denial of service attack on the authentication server

Why wrong: The pattern is not a flood of traffic; it's login attempts.

Avoid

Why wrong: Avoiding would discontinue the activity, which is likely too drastic.

Accept

Why wrong: Acceptance is not appropriate when likelihood is high and controls can be enhanced.

Transfer

Why wrong: Transferring (e.g., insurance) may be considered but does not address the root cause.

Compliance violation with industry regulations

Why wrong: While lack of segmentation may violate best practices, the immediate operational risk from unauthorized network access outweighs compliance concerns in the identification phase.

Loss of data integrity due to tampering with sensor measurements

Why wrong: Although possible, the immediate threat from uncontrolled external traffic and vendor access is more likely to enable network breach than sensor manipulation.

Physical damage to equipment due to unsafe actuator commands

Why wrong: Physical damage is a potential impact, but the current evidence points to network exploitation as the more direct and probable risk.

Employee surveys

Why wrong: Employee surveys may not have visibility into supply chain partners.

Financial audit reports

Why wrong: Financial audits address financial controls, not supply chain risks.

Review of standard risk checklists

Why wrong: Checklists are limited to known risks.

Request a penetration test report from the vendor

Why wrong: Pen test covers only technical controls and may have scope limits.

Check online user reviews and ratings

Why wrong: User reviews are subjective and not systematic.

Read the vendor's marketing materials and case studies

Why wrong: Marketing materials are not objective.

To calculate the exact financial loss

Why wrong: Quantification may follow but is not the primary goal.

To satisfy regulatory compliance

Why wrong: Compliance is a benefit but not the primary purpose.

To create a business continuity plan

Why wrong: BCP uses risk assessment output but is a separate activity.

The company avoid controls and accepts high risk

Why wrong: Low appetite would not allow high risk acceptance without controls.

The company has aggressive growth targets and accepts any IT risk

Why wrong: That indicates high risk appetite, not low.

The company invests minimally in controls and has low residual risk

Why wrong: Minimal investment would likely result in high residual risk, conflicting with low appetite.

Probability

Why wrong: Probability is a measurement, not a component.

Control

Why wrong: Controls are risk treatments, not part of the scenario.

The application has several unpatched vulnerabilities that increase the likelihood of a security incident.

Why wrong: This describes a vulnerability but not a complete risk scenario (missing threat and impact).

The application will implement multi-factor authentication to prevent unauthorized access.

Why wrong: This is a control, not a risk scenario.

The application must comply with PCI DSS requirements for data protection.

Why wrong: This is a compliance obligation, not a risk scenario.

The control failure occurred but was not recorded.

Why wrong: Contradicts 100% effectiveness.

The monitoring frequency was insufficient to detect the breach.

Why wrong: Breach went undetected for three months; monitoring might be periodic.

The control monitoring logs were tampered with.

Why wrong: No evidence of tampering.

Historical incident review

Why wrong: Historical review is backward-looking and may miss novel risks.

Delphi technique

Why wrong: Delphi technique gathers expert opinions but is less proactive for emerging risks.

Peer benchmarking

Why wrong: Benchmarking compares current state, not emerging risks.

Medium

Why wrong: Medium would require some controls.

High

Why wrong: Inherent risk is critical, not high.

Low

Why wrong: Low would require strong controls.