Risk Management Quiz: Can You Score Every Threat?

1. What is the purpose of a Business Impact Analysis (BIA)?

To identify which business functions are most critical

To calculate insurance premiums

To eliminate all operational risks

To test disaster recovery plans

2. The practice of identifying and documenting all organizational assets for risk management purposes is called:

Asset inventory

Risk mapping

Threat analysis

Vulnerability scanning

3. Which control type is designed to prevent security incidents from occurring?

Preventive

Detective

Corrective

Compensating

4. What is Single Loss Expectancy (SLE)?

The cost of a single security incident

Asset Value × Exposure Factor

The probability of an annual loss

Total risk divided by number of assets

5. The process of regularly reviewing and updating risk assessments is called:

Risk acceptance

Risk monitoring and review

Risk avoidance

Risk quantification

6. True or False: Risk can be completely eliminated through proper security controls.

True

False

7. Which risk management phase involves determining how to address identified risks?

Risk identification

Risk analysis

Risk response planning

Risk monitoring

8. What is the primary difference between a threat and a vulnerability?

Threats are weaknesses; vulnerabilities are attacks

Threats are potential dangers; vulnerabilities are weaknesses

There is no difference

Threats are external; vulnerabilities are always internal

9. Which of the following represents the highest risk level?

High probability, low impact

Low probability, high impact

High probability, high impact

Low probability, low impact

10. Risk transfer is best exemplified by:

Purchasing cyber liability insurance

Implementing firewall rules

Conducting employee security training

Disabling unnecessary services

11. Which of the following best defines risk in a cybersecurity context?

The probability that a threat will exploit a vulnerability

The total cost of all security incidents

The number of vulnerabilities in a system

The amount of data an organization stores

12. Which framework provides guidelines for information security risk management?

ISO/IEC 27005

NIST Cybersecurity Framework

Both A and B

Neither A nor B

13. What does CVSS measure?

The financial impact of a vulnerability

The severity of a software vulnerability

The number of affected users

The time to patch a system

14. Which of the following is an example of risk mitigation?

Discontinuing a risky business process

Installing antivirus software to reduce malware risk

Transferring risk to an insurance company

Ignoring known vulnerabilities

15. What is the main goal of threat modeling?

To predict all future attacks

To identify potential attack vectors and vulnerabilities

To eliminate all threats

To document security policies

16. A vulnerability is best described as:

An actual attack or exploitation event

A weakness that could be exploited by a threat

The likelihood of a security incident

The cost of a security breach

17. Which risk response strategy involves accepting potential losses?

Risk avoidance

Risk mitigation

Risk acceptance

Risk transfer

18. What does ALE stand for in risk management?

Asset Loss Evaluation

Annual Loss Expectancy

Acceptable Likelihood Estimate

Annualized Loss Exposure

19. Which quantitative risk formula is correct?

Risk = Threat × Vulnerability

Risk = Asset Value × Threat × Vulnerability

Risk = Probability × Impact

Risk = Cost + Likelihood

20. What is the primary purpose of a risk assessment?

To eliminate all security threats

To identify, analyze, and prioritize organizational risks

To document all company assets

To create security policies