Security Risk Register Mapping Quiz

1. Which stakeholder role is MOST responsible for approving risk acceptance decisions in a risk register?

IT help desk

Chief Information Security Officer or Risk Owner

Entry-level security analyst

Network administrator

2. The risk register serves as a foundational tool for which security management activity?

Marketing the security program

Strategic risk-based decision-making and resource prioritization

Replacing incident response procedures

Eliminating the need for security controls

3. Risk register entries should be reviewed and updated at minimum:

Annually

When a breach occurs

Quarterly or when significant changes occur in the environment

Only during audit periods

4. A compliance mandate requires documenting all risks related to data privacy. In the risk register, the PRIMARY mapping should include:

Only financial penalties

Data type, regulatory requirement, affected individuals, and breach impact

Compliance officer name only

Vendor agreements

5. When a new vulnerability is discovered affecting multiple systems, how should it be entered in the risk register?

One entry per affected system with specific context

One consolidated entry for all systems

Only for the most critical system

Ignored if it affects more than five systems

6. The risk register should document the owner responsible for monitoring and remediating each risk. This person is typically:

The Chief Executive Officer

The business owner or manager of the affected asset or process

The most senior security officer

An external consultant

7. A risk register entry is marked as 'low priority' but the asset involved is business-critical. What should happen?

Keep it low priority due to low likelihood

Re-evaluate the risk score; criticality may warrant higher priority

Archive it and move on

Assign it to the most junior analyst

8. In the risk register, what distinguishes a threat from a vulnerability?

Threats are weaknesses; vulnerabilities are actors or events

Threats are potential harmful events; vulnerabilities are weaknesses that can be exploited

Threats are only external; vulnerabilities are always internal

Threats have higher severity than vulnerabilities

9. A security control reduces risk likelihood from 80% to 20%. This is an example of:

Risk avoidance

Risk mitigation

Risk acceptance

Risk transfer

10. When mapping supply chain risks to the register, what is the critical dependency element?

Vendor location only

Vendor criticality, data access, and incident response capability

Vendor cost alone

Vendor age and reputation score

11. Which element is MOST critical when mapping a threat to a risk register entry?

Asset identification and potential impact

Only the attacker's motivation

The cost of remediation alone

Current patch status

12. A phishing campaign targets employees in the finance department. How should this be mapped in the risk register?

As a single organizational risk with all employees affected

By department with specific asset and data exposure details

Only if the attack was successful

As a low-priority threat because phishing is common

13. In a risk register, residual risk refers to:

Risk that existed before any controls were applied

Risk remaining after mitigation controls are implemented

Risk that cannot be quantified

Risk transferred to a third party

14. Which metric BEST measures the effectiveness of a risk mitigation control?

Cost of the control implementation

Reduction in likelihood or impact post-implementation

Number of controls deployed

Time spent on documentation

15. A risk register entry shows high impact but mitigation is cost-prohibitive. Which response strategy is most appropriate?

Accept the risk and monitor

Immediately terminate the business process

Ignore it and focus only on low-cost mitigations

Transfer liability to customers

16. When mapping a zero-day vulnerability to the risk register, what should be documented first?

The exact exploit code

Affected assets and potential impact

The vendor's patch release date

Historical breach data

17. Risk registers require regular review cycles. What is the PRIMARY reason?

To satisfy audit requirements only

To reflect new threats, remediation progress, and environmental changes

To reduce the total number of risks

To assign blame for unresolved issues

18. A vulnerability in legacy software poses low likelihood of exploitation but would cause critical system downtime if exploited. How should this risk be rated?

Low risk due to low likelihood

Medium-to-high risk due to severe impact

High risk only if likelihood exceeds 50%

Ignore it as legacy systems are less valuable

19. When categorizing risks in a risk register, which approach provides the best prioritization for resource allocation?

Alphabetical listing of threats

Risk score based on likelihood × impact

Chronological order of discovery

Random assignment of severity

20. A risk register typically includes threat, vulnerability, and likelihood. What fourth element is essential?

Attacker profile

Impact or consequence

Network topology

Vendor information

Security Expert Mapping Risks to a Risk Register Quiz