SSCP · topic practice

Risk Identification, Monitoring and Analysis practice questions

Q: How should I use these Risk Identification, Monitoring and Analysis practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Risk Identification, Monitoring and Analysis questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Risk Identification, Monitoring and Analysis domain.

Practise Systems Security Certified Practitioner SSCP Risk Identification, Monitoring and Analysis practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Risk Identification, Monitoring and Analysis

Practice 10 questions Browse domain →

What the exam tests

What to know about Risk Identification, Monitoring and Analysis

Risk Identification, Monitoring and Analysis questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Risk Identification, Monitoring and Analysis exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Risk Identification, Monitoring and Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full VPN explanation →

A security analyst notices repeated failed login attempts from a single IP address on the VPN gateway. The analyst adjusts the threshold for account lockout and enables geo-ip blocking. This activity is part of which risk management process?

Trap 1: Risk identification

Risk identification is the initial step of recognizing threats; here the threat was already identified and controls were adjusted.

Trap 2: Risk assessment

Risk assessment quantifies and prioritizes risk; this scenario involves response to an ongoing event.

Trap 3: Risk reporting

Risk reporting communicates risk to stakeholders; the analyst took direct action without necessarily reporting first.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Risk identification
Why wrong: Risk identification is the initial step of recognizing threats; here the threat was already identified and controls were adjusted.
B
Risk assessment
Why wrong: Risk assessment quantifies and prioritizes risk; this scenario involves response to an ongoing event.
C
Risk reporting
Why wrong: Risk reporting communicates risk to stakeholders; the analyst took direct action without necessarily reporting first.
D
Risk monitoring
Adjusting controls based on observed events is a core risk monitoring activity.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full NAT/PAT explanation →

During a quarterly risk review, a hospital's security team identifies that legacy medical devices cannot be patched and run outdated operating systems. Which risk treatment strategy is most appropriate for these devices?

Trap 1: Remediate by applying vendor patches

Legacy devices often have no patches available; this is not feasible.

Trap 2: Retire and replace all devices immediately

Replacing all devices may be too costly or disruptive; a risk-based approach is more practical.

Trap 3: Transfer the risk by purchasing cyber insurance

Insurance transfers financial impact but does not reduce the likelihood of a breach.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Remediate by applying vendor patches
Why wrong: Legacy devices often have no patches available; this is not feasible.
B
Implement compensating controls such as network segmentation and strict access control
Compensating controls mitigate the risk without changing the device itself.
C
Retire and replace all devices immediately
Why wrong: Replacing all devices may be too costly or disruptive; a risk-based approach is more practical.
D
Transfer the risk by purchasing cyber insurance
Why wrong: Insurance transfers financial impact but does not reduce the likelihood of a breach.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

Trap 1: Technical vulnerability indicator

A technical vulnerability would be a weakness in software or hardware, not user activity.

Trap 2: Error log indicator

Error logs record system errors; this is a user activity log.

Trap 3: Configuration drift indicator

Configuration drift refers to changes in system settings, not user actions.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Technical vulnerability indicator
Why wrong: A technical vulnerability would be a weakness in software or hardware, not user activity.
B
User behavior risk indicator
The unusual access pattern is a behavioral indicator of potential insider threat or compromise.
C
Error log indicator
Why wrong: Error logs record system errors; this is a user activity log.
D
Configuration drift indicator
Why wrong: Configuration drift refers to changes in system settings, not user actions.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

An organization wants to identify risks related to a new cloud-based customer relationship management (CRM) system. Which approach would best identify threats and vulnerabilities specific to this system?

Trap 1: Run a vulnerability scan on the CRM

Vulnerability scanning finds known vulnerabilities but may miss design-level threats.

Trap 2: Execute a business impact analysis (BIA)

BIA assesses criticality and recovery priorities, not threats.

Trap 3: Conduct a qualitative risk assessment using a generic framework

Generic frameworks may not capture cloud-specific threats.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Run a vulnerability scan on the CRM
Why wrong: Vulnerability scanning finds known vulnerabilities but may miss design-level threats.
B
Execute a business impact analysis (BIA)
Why wrong: BIA assesses criticality and recovery priorities, not threats.
C
Perform a threat modeling exercise such as STRIDE
Threat modeling is tailored to the system's architecture and identifies relevant threats.
D
Conduct a qualitative risk assessment using a generic framework
Why wrong: Generic frameworks may not capture cloud-specific threats.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

After a security incident, the CISO asks for a report detailing which assets were affected, the attack vector, and the financial impact. Which of the following best describes this report?

Trap 1: Incident response plan

An incident response plan outlines procedures, not a report of a specific incident.

Trap 2: Risk register

A risk register is a list of identified risks, not a post-incident analysis.

Trap 3: Business impact analysis (BIA)

BIA is conducted before an incident to determine criticality.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Lessons learned report
A lessons learned report captures post-incident details and improvements.
B
Incident response plan
Why wrong: An incident response plan outlines procedures, not a report of a specific incident.
C
Risk register
Why wrong: A risk register is a list of identified risks, not a post-incident analysis.
D
Business impact analysis (BIA)
Why wrong: BIA is conducted before an incident to determine criticality.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

A financial institution uses a quantitative risk analysis to evaluate a new online payment system. The asset value is $5 million, the exposure factor is 40%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Trap 1: $800,000

This might result from miscalculating SLE as AV × ARO.

Trap 2: $2,000,000

This is the SLE, not the ALE.

Trap 3: $2,500,000

This might be AV × ARO.

Study all Risk Identification, Monitoring and Analysis common traps →

A
$1,000,000
Correct calculation: SLE = $5M × 0.4 = $2M; ALE = $2M × 0.5 = $1M.
B
$800,000
Why wrong: This might result from miscalculating SLE as AV × ARO.
C
$2,000,000
Why wrong: This is the SLE, not the ALE.
D
$2,500,000
Why wrong: This might be AV × ARO.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

Trap 1: Manual log review

Manual review might detect it, but the question implies automated detection; UEBA is the typical technique.

Trap 2: Vulnerability scanning

Vulnerability scanning identifies technical weaknesses, not behavioral anomalies.

Trap 3: Threat intelligence feeds

Threat intelligence provides external threat data, not internal behavioral analysis.

Study all Risk Identification, Monitoring and Analysis common traps →

A
User and entity behavior analytics (UEBA)
UEBA detects deviations from normal behavior, such as login from unusual location.
B
Manual log review
Why wrong: Manual review might detect it, but the question implies automated detection; UEBA is the typical technique.
C
Vulnerability scanning
Why wrong: Vulnerability scanning identifies technical weaknesses, not behavioral anomalies.
D
Threat intelligence feeds
Why wrong: Threat intelligence provides external threat data, not internal behavioral analysis.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?

Trap 1: Threat

A threat is a potential cause of harm (e.g., a hacker), not a weakness.

Trap 2: Risk

Risk is the combination of likelihood and impact; this condition is a vulnerability.

Trap 3: Exploit

An exploit is a specific attack that takes advantage of a vulnerability.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Threat
Why wrong: A threat is a potential cause of harm (e.g., a hacker), not a weakness.
B
Risk
Why wrong: Risk is the combination of likelihood and impact; this condition is a vulnerability.
C
Exploit
Why wrong: An exploit is a specific attack that takes advantage of a vulnerability.
D
Vulnerability
The missing backup is a weakness that could lead to data loss.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Risk Identification, Monitoring and Analysis explanation →

Which TWO of the following are primary purposes of a risk register?

Trap 1: Record network traffic logs

Network logs are stored in SIEM or log management systems.

Trap 2: Store vulnerability scan results

Vulnerability scan results are typically stored in a separate tool or report.

Trap 3: Provide a checklist for compliance audits

A compliance checklist is a different artifact.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Track the status of risk treatment plans
The risk register tracks mitigation actions and their progress.
B
Document identified risks and their characteristics
This is a core purpose of a risk register.
C
Record network traffic logs
Why wrong: Network logs are stored in SIEM or log management systems.
D
Store vulnerability scan results
Why wrong: Vulnerability scan results are typically stored in a separate tool or report.
E
Provide a checklist for compliance audits
Why wrong: A compliance checklist is a different artifact.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full Risk Identification, Monitoring and Analysis explanation →

Which THREE of the following are common techniques for identifying risks?

Trap 1: Penetration testing

Penetration testing identifies vulnerabilities, not risks in a broad sense; it's a later step.

Trap 2: Quantitative risk analysis

Quantitative analysis assesses already identified risks; it's not an identification technique.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Stakeholder interviews
Interviews with knowledgeable individuals are a key identification technique.
B
Penetration testing
Why wrong: Penetration testing identifies vulnerabilities, not risks in a broad sense; it's a later step.
C
SWOT analysis
SWOT (Strengths, Weaknesses, Opportunities, Threats) helps identify risks.
D
Quantitative risk analysis
Why wrong: Quantitative analysis assesses already identified risks; it's not an identification technique.
E
Brainstorming sessions
Brainstorming with stakeholders is a classic risk identification technique.

Full breakdown with real-world context →

Question 11easymulti select

Read the full Risk Identification, Monitoring and Analysis explanation →

Which TWO of the following are examples of key risk indicators (KRIs)?

Trap 1: Total number of employees

Employee count alone is not a risk indicator.

Trap 2: Average user satisfaction score

User satisfaction is not a direct security risk indicator.

Trap 3: Number of security incidents this quarter

This is a lagging indicator, not a leading KRI.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Number of unpatched critical vulnerabilities
A high number indicates higher risk of exploitation.
B
Total number of employees
Why wrong: Employee count alone is not a risk indicator.
C
Percentage of systems with antivirus disabled
High percentage indicates increased malware risk.
D
Average user satisfaction score
Why wrong: User satisfaction is not a direct security risk indicator.
E
Number of security incidents this quarter
Why wrong: This is a lagging indicator, not a leading KRI.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. A security analyst reviews these logs from a server. What immediate risk is most indicated by this log pattern?

Exhibit

Refer to the exhibit.

Oct 15 09:23:45 server01 sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 09:23:46 server01 sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 09:23:47 server01 sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 09:23:48 server01 sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 09:23:49 server01 sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2

Trap 1: Insider threat from user root

The source IP is likely external; internal root would not need to brute-force.

Trap 2: Malware infection on the server

No evidence of malware in these logs.

Trap 3: Misconfigured SSH settings allowing root login

While root login may be misconfigured, the immediate risk is the ongoing attack.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Insider threat from user root
Why wrong: The source IP is likely external; internal root would not need to brute-force.
B
Active brute-force attack against the SSH service
Multiple failed attempts in quick succession indicate a brute-force attempt.
C
Malware infection on the server
Why wrong: No evidence of malware in these logs.
D
Misconfigured SSH settings allowing root login
Why wrong: While root login may be misconfigured, the immediate risk is the ongoing attack.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. Which risk is most directly introduced by this policy?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example-bucket",
      "Principal": "*"
    }
  ]
}

Trap 1: Unauthorized deletion of objects

No delete actions are granted.

Trap 2: Lack of encryption at rest

The policy does not address encryption; it's a separate control.

Trap 3: Inability to audit access

CloudTrail can still log access; the policy doesn't prevent auditing.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Unauthorized deletion of objects
Why wrong: No delete actions are granted.
B
Lack of encryption at rest
Why wrong: The policy does not address encryption; it's a separate control.
C
Inability to audit access
Why wrong: CloudTrail can still log access; the policy doesn't prevent auditing.
D
Exposure of bucket contents to the public
The ListBucket action with Principal "*" allows anyone to enumerate objects.

Full breakdown with real-world context →

Question 14hardmultiple choice

Open the full VLAN trunking answer →

You are the security analyst for a mid-sized e-commerce company that processes credit card payments. The company uses a legacy payment application on a Windows Server 2012 R2 system, which is scheduled for decommission in six months. The server is isolated in a separate VLAN with strict firewall rules allowing only outbound HTTPS to the payment processor and inbound management from a jump box on a different subnet. During a routine vulnerability scan, you discover that the server is missing over 50 critical patches, including one for a remote code execution vulnerability (CVE-2023-XXXX) that is being actively exploited in the wild. The server cannot be patched because the vendor stopped support and patches are not available. The company's risk appetite is low due to PCI DSS requirements. You need to recommend a course of action that balances risk reduction with business continuity. What should you do?

Trap 1: Immediately decommission the server and migrate to the new payment…

This would stop payment processing, causing significant business disruption.

Trap 2: Apply the vendor's hotfix from an unofficial source to patch the…

Unofficial patches may introduce new vulnerabilities and are not recommended.

Trap 3: Accept the risk and purchase additional cyber insurance to cover…

Insurance transfers financial risk but does not prevent a breach that could compromise customer data and PCI compliance.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Implement additional compensating controls such as an application-layer firewall, disable all unnecessary services, restrict outbound traffic to only the payment processor IP, enable detailed logging, and accelerate the migration
Compensating controls reduce risk while allowing continued operation until decommission.
B
Immediately decommission the server and migrate to the new payment system, accepting a temporary outage
Why wrong: This would stop payment processing, causing significant business disruption.
C
Apply the vendor's hotfix from an unofficial source to patch the vulnerability
Why wrong: Unofficial patches may introduce new vulnerabilities and are not recommended.
D
Accept the risk and purchase additional cyber insurance to cover potential losses
Why wrong: Insurance transfers financial risk but does not prevent a breach that could compromise customer data and PCI compliance.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

You are a risk analyst at a healthcare organization. The organization recently deployed a new electronic health records (EHR) system. During the first month of operation, the IT helpdesk received multiple reports from doctors that the system becomes unresponsive for 10-15 seconds several times a day. The EHR vendor attributes this to insufficient database connection pooling, but the organization's system administrator notes that the database server's CPU and memory utilization never exceed 30%. The organization has a risk management policy that requires any system with availability <99.5% to be treated as a high risk. Based on initial data, the system has been unavailable for about 0.1% of the time (excluding planned maintenance). However, doctors report that the brief unresponsiveness is causing frustration and potential misdiagnosis due to interrupted workflows. You need to recommend a risk treatment approach. What should you do?

Trap 1: Accept the current risk because the system meets the 99.5%…

Accepting without understanding the clinical impact may ignore patient safety risks.

Trap 2: Reduce the risk by implementing a load balancer and additional…

The issue is likely a software configuration problem (connection pooling), not capacity.

Trap 3: Document the system as high risk and require immediate remediation,…

The availability metric is within acceptable range; hardware may not solve the issue.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Accept the current risk because the system meets the 99.5% availability threshold
Why wrong: Accepting without understanding the clinical impact may ignore patient safety risks.
B
Reduce the risk by implementing a load balancer and additional application servers
Why wrong: The issue is likely a software configuration problem (connection pooling), not capacity.
C
Document the system as high risk and require immediate remediation, such as upgrading the database server hardware
Why wrong: The availability metric is within acceptable range; hardware may not solve the issue.
D
Conduct a deeper analysis to quantify the impact of these brief outages on clinical workflows and patient safety, then reassess risk
A deeper analysis will clarify the true risk level before deciding on treatment.

Full breakdown with real-world context →

Question 16mediumdrag order

Review the full routing breakdown →

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediumdrag order

Read the full Risk Identification, Monitoring and Analysis explanation →

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediummatching

Read the full Risk Identification, Monitoring and Analysis explanation →

Match each security control type to its example.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Firewall

IDS

Backup restoration

Warning signs

Question 19mediummatching

Read the full Risk Identification, Monitoring and Analysis explanation →

Match each security policy type to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines proper use of resources

Requirements for password strength

Categorizes data sensitivity

Procedures for handling breaches

Question 20mediummultiple choice

Read the full Risk Identification, Monitoring and Analysis explanation →

A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?

Trap 1: Risk remediation by changing all user passwords

Remediation is less immediate and may not prevent the current attack from the same IP.

Trap 2: Risk transfer

Transferring risk via insurance does not stop the immediate threat.

Trap 3: Risk acceptance

Acceptance would mean tolerating the ongoing attack, which is not prudent.

Study all Risk Identification, Monitoring and Analysis common traps →

A
Risk mitigation by blocking the IP address
Blocking the source IP mitigates the ongoing brute-force attempt.
B
Risk remediation by changing all user passwords
Why wrong: Remediation is less immediate and may not prevent the current attack from the same IP.
C
Risk transfer
Why wrong: Transferring risk via insurance does not stop the immediate threat.
D
Risk acceptance
Why wrong: Acceptance would mean tolerating the ongoing attack, which is not prudent.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Risk Identification, Monitoring and Analysis sessions

Start a Risk Identification, Monitoring and Analysis only practice session

Every question in these sessions is drawn from the Risk Identification, Monitoring and Analysis domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Risk Identification, Monitoring and Analysis questions →Mixed SSCP session

Frequently asked questions

What does the SSCP exam test about Risk Identification, Monitoring and Analysis?: Risk Identification, Monitoring and Analysis questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Risk Identification, Monitoring and Analysis questions in a focused session?: Yes — the session launcher on this page draws every question from the Risk Identification, Monitoring and Analysis domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SSCP topics?: Use the topic links above to move to related areas, or go back to the SSCP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SSCP exam covers. They are not copied from any real exam or dump site.

Risk Identification, Monitoring and Analysis only

10 questions 20 questions 30 questions 50 questions

Mixed SSCP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SSCP questions Risk Identification, Monitoring and Analysis domain overview SSCP exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Risk Identification, Monitoring and Analysis practice questions

What to know about Risk Identification, Monitoring and Analysis

Common Risk Identification, Monitoring and Analysis exam traps

Risk Identification, Monitoring and Analysis questions

A security analyst notices repeated failed login attempts from a single IP address on the VPN gateway. The analyst adjusts the threshold for account lockout and enables geo-ip blocking. This activity is part of which risk management process?

During a quarterly risk review, a hospital's security team identifies that legacy medical devices cannot be patched and run outdated operating systems. Which risk treatment strategy is most appropriate for these devices?

A SOC analyst reviews an alert for a user who downloaded a large amount of data from a sensitive database at 3:00 AM. The user's manager confirms the user was not on call. Which type of risk indicator is this activity best described as?

An organization wants to identify risks related to a new cloud-based customer relationship management (CRM) system. Which approach would best identify threats and vulnerabilities specific to this system?

After a security incident, the CISO asks for a report detailing which assets were affected, the attack vector, and the financial impact. Which of the following best describes this report?

A financial institution uses a quantitative risk analysis to evaluate a new online payment system. The asset value is $5 million, the exposure factor is 40%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

A security team discovers that an employee's credentials were used to access the HR database from an unrecognized IP address in a foreign country. The employee is currently in the office. Which risk identification technique is most directly responsible for detecting this anomaly?

During a risk assessment, the team identifies that a critical database server is not included in the backup schedule. Which risk term best describes this condition?

Which TWO of the following are primary purposes of a risk register?

Which THREE of the following are common techniques for identifying risks?

Which TWO of the following are examples of key risk indicators (KRIs)?

Refer to the exhibit. A security analyst reviews these logs from a server. What immediate risk is most indicated by this log pattern?

Exhibit

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. Which risk is most directly introduced by this policy?

Exhibit

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag and drop the steps for properly disposing of a hard drive containing sensitive data into the correct order.

Match each security control type to its example.

Match each security policy type to its purpose.

A security analyst notices a sudden increase in failed login attempts from a single IP address across multiple user accounts. Which risk response strategy is most appropriate to implement immediately?

Track your progress over time

Start a Risk Identification, Monitoring and Analysis only practice session

Related SSCP topic practice pages