Risk Ratings & Finding Analysis for Security Analysts

1. When a finding affects a system storing personally identifiable information (PII), what impact component is most critical?

Confidentiality

Integrity

Availability

Authentication

2. A security finding's risk rating changes after implementing compensating controls. What justifies this adjustment?

Compliance requirement

Reduced likelihood or impact through mitigation

Analyst preference

Quarterly re-assessment schedule

3. When multiple findings affect the same asset, what approach best determines which to remediate first?

Patch the oldest vulnerability first

Aggregate impact and prioritize by combined risk

Address highest CVSS score regardless of context

Remediate in vendor release order

4. A critical vulnerability is discovered but requires a zero-day exploit with limited availability. How should exploitability factor into the risk rating?

Lower the overall risk rating

Maintain high rating; zero-day status increases threat

Eliminate from risk assessment

Defer rating until exploit is public

5. Which framework explicitly defines severity ratings for web application vulnerabilities?

NIST Cybersecurity Framework

OWASP Risk Rating Methodology

ISO 27001

CIS Controls

6. A finding is rated as high-risk but the affected system is air-gapped from the network. What risk management action is most appropriate?

Immediately patch despite isolation

Accept the risk and document rationale

Increase the risk rating

Remove the finding from records

7. When documenting risk findings, which element is essential for communicating severity to non-technical stakeholders?

Raw CVSS vector string

Business impact and remediation timeline

Technical exploit details

Vendor patch release date

8. A vulnerability has no known public exploit code available. How does this affect its risk rating?

Increases the rating

Decreases the rating

No impact on CVSS score; may affect threat likelihood

Eliminates the vulnerability

9. Which of the following is a valid reason to adjust a CVSS score after initial calculation?

Personal preference of the analyst

Environmental factors specific to the organization

To make remediation appear less urgent

To match competitor vulnerability ratings

10. A security analyst must choose between patching a high-risk finding in a critical system versus a critical-risk finding in a non-critical system. Which factor should guide this decision?

Always patch the critical-risk finding first

Assess business impact and operational risk

Patch in numerical order of severity

Defer both for quarterly patch management

11. Which risk rating model uses a numerical scale from 0.0 to 10.0 to measure vulnerability severity?

CVSS

NIST

ISO 27001

OWASP

12. A vulnerability requires physical access to the device. What Attack Vector rating should be assigned?

Network

Adjacent

Local

Physical

13. Which CVSS component measures the difficulty of exploiting a vulnerability?

Attack Vector

Attack Complexity

Privileges Required

User Interaction

14. A medium-severity vulnerability exists in legacy software scheduled for retirement in 6 months. How should timeline affect the risk rating?

Increase rating due to extended exposure

Decrease rating due to planned retirement

Maintain rating; timeline is separate concern

Remove from risk assessment

15. What is the primary purpose of applying risk ratings to security findings?

Ensure all vulnerabilities are patched immediately

Prioritize remediation efforts based on business impact

Eliminate the need for vulnerability scanning

Satisfy compliance audit requirements only

16. An organization discovers a vulnerability affecting 5% of its systems. How should this prevalence affect the risk rating priority?

Lower priority due to limited scope

Higher priority due to lateral movement risk

No impact on priority

Eliminate from risk register

17. Which of the following best describes the relationship between threat intelligence and risk rating?

Threat intelligence confirms the CVSS score

Threat intelligence informs the likelihood component of risk

They are unrelated metrics

Risk rating determines threat intelligence

18. A finding has a CVSS score of 9.8. What risk category does this represent?

Low

Medium

High

Critical

19. When applying risk ratings, which factor combines the likelihood of exploitation with the severity of impact?

Vulnerability assessment

Risk calculation

Threat modeling

Compliance mapping

20. A critical vulnerability is discovered in a system with no internet access. What impact does asset exposure have on its risk rating?

Increases risk significantly

Decreases risk substantially

No change to risk rating

Eliminates risk entirely

Security Analyst Applying Risk Ratings to Findings Quiz