Security+ Risk Identification and Risk Register Quiz

1. True or False: Risk acceptance means an organization has eliminated all identified risks through controls.

True

False

2. Which of the following is a key benefit of maintaining an updated risk register?

Provides visibility into organizational risk posture and supports decision-making

Guarantees that no security incidents will occur

Eliminates the need for security audits

Reduces the number of employees in the security department

3. True or False: Risk monitoring should continue even after mitigation controls have been implemented.

True

False

Submit

5. In risk scoring, impact is typically measured by potential loss in terms of:

Financial, operational, and reputational damage

Number of employees affected only

IT system downtime only

Regulatory fines only

6. Which document typically serves as the central repository for all identified, assessed, and managed risks?

Risk register

Security policy

Incident response plan

Employee handbook

7. True or False: A risk with high likelihood but low impact should always receive the highest priority for mitigation.

True

False

Submit

9. What does a threat assessment identify in the context of risk management?

Potential actors and methods that could harm assets

All employees who pose a security risk

Budget needed to purchase security software

Compliance violations that occurred in the past

10. Which risk response strategy involves purchasing insurance to transfer financial impact?

Risk avoidance

Risk mitigation

Risk transfer

Risk acceptance

11. Which process systematically identifies potential threats and vulnerabilities that could impact organizational assets?

Risk identification

Risk mitigation

Risk monitoring

Risk acceptance

Submit

13. Identify the correct sequence for the risk management lifecycle.

Identify, analyze, mitigate, monitor, report

Monitor, identify, analyze, report, mitigate

Mitigate, identify, monitor, analyze, report

Report, mitigate, identify, analyze, monitor

14. Which role is typically responsible for owning and managing a specific risk throughout its lifecycle?

Risk owner

Compliance officer

External auditor

IT help desk

15. What is the formula for calculating risk priority in most risk frameworks?

Risk = Threat + Vulnerability

Risk = Likelihood × Impact

Risk = Asset Value ÷ Control Cost

Risk = Compliance Score − Audit Findings

16. True or False: A risk register should be reviewed and updated only once per year during annual audits.

True

False

17. Which of the following best describes residual risk?

Risk that remains after mitigation controls are applied

Risk identified but not yet documented

Risk that affects only IT systems

Risk accepted by senior management

Submit

19. What is the primary purpose of conducting a risk assessment?

Eliminate all risks completely

Determine which risks require mitigation or acceptance

Assign blame for security incidents

Reduce IT budget spending

20. A risk register should document all identified risks. Which element is NOT typically included in a risk register entry?

Risk description and owner

Likelihood and impact rating

Employee salary information

Mitigation strategy

Security+ Risk Identification and Risk Register Basics Quiz

1. True or False: Risk acceptance means an organization has eliminated all identified risks through controls.

2.

What first name or nickname would you like us to use?

2. Which of the following is a key benefit of maintaining an updated risk register?

3. True or False: Risk monitoring should continue even after mitigation controls have been implemented.

4. The process of identifying what could go wrong and documenting it is called ____ identification.

5. In risk scoring, impact is typically measured by potential loss in terms of:

6. Which document typically serves as the central repository for all identified, assessed, and managed risks?

7. True or False: A risk with high likelihood but low impact should always receive the highest priority for mitigation.

8. A vulnerability in risk management is best defined as a ____ in systems or processes that could be exploited.

9. What does a threat assessment identify in the context of risk management?

10. Which risk response strategy involves purchasing insurance to transfer financial impact?

11. Which process systematically identifies potential threats and vulnerabilities that could impact organizational assets?

12. The ____ is the value or importance of an asset that could be lost if a risk materializes.

13. Identify the correct sequence for the risk management lifecycle.

14. Which role is typically responsible for owning and managing a specific risk throughout its lifecycle?

15. What is the formula for calculating risk priority in most risk frameworks?

16. True or False: A risk register should be reviewed and updated only once per year during annual audits.

17. Which of the following best describes residual risk?

18. In risk management, likelihood refers to the ____ that a threat will exploit a vulnerability.

19. What is the primary purpose of conducting a risk assessment?

20. A risk register should document all identified risks. Which element is NOT typically included in a risk register entry?