SSCP Risk Identification and Analysis Quiz

1. What is the primary advantage of quantitative risk analysis over qualitative?

It is faster to complete

It provides numerical values for financial decision-making

It requires no expert input

It eliminates all uncertainty

2. True or False: Risk appetite and risk tolerance are the same concept.

True

False

Submit

4. A vulnerability scan is most useful for identifying which type of weakness?

Social engineering vectors

Configuration and software defects in systems

Executive decision-making flaws

Physical security gaps only

5. What metric measures the effectiveness of a security control in reducing risk?

Risk velocity

Control coverage

Risk reduction

Threat factor

6. True or False: Inherent risk is the risk level after applying security controls.

True

False

7. In the STRIDE threat modeling framework, what does the 'E' represent?

Encryption

Elevation of privilege

Exposure

External threats

Submit

9. Which of the following best describes threat modeling?

A list of all employees with access to systems

A systematic approach to identify potential attacks and vulnerabilities

A compliance checklist for auditors

A record of all security incidents

10. True or False: A control that reduces the probability of a threat occurring is called mitigation.

True

False

11. What is the primary purpose of risk identification in a security program?

To eliminate all possible threats

To discover, recognize, and document threats and vulnerabilities

To ensure compliance with regulations

To reduce IT spending

Submit

13. Which risk response strategy involves accepting the potential impact of a risk?

Risk mitigation

Risk avoidance

Risk acceptance

Risk transfer

14. An organization discovers a software vulnerability but has no exploitable threat actor. What is the risk level?

Critical

High

Low to medium (threat component missing)

Zero

15. What is the relationship between threat, vulnerability, and risk?

Risk = Threat + Vulnerability

Risk = Threat × Vulnerability × Asset Value

Vulnerability = Threat + Risk

Threat = Risk − Vulnerability

Submit

17. Vulnerability assessments are typically performed to identify what?

Actual active attacks in progress

Weaknesses in systems and controls that threats could exploit

All employees with security clearances

Regulatory compliance status

18. What does Single Loss Expectancy (SLE) represent?

The total annual financial impact of a threat

The monetary loss from a single occurrence of a threat

The probability that a threat will occur

The cost of implementing a control

19. Which of the following is NOT a common threat modeling methodology?

STRIDE

PASTA

Attack trees

ITIL v4

20. In quantitative risk analysis, what does the formula (Asset Value × Exposure Factor × Threat Frequency) calculate?

Annualized Loss Expectancy (ALE)

Single Loss Expectancy (SLE)

Risk tolerance

Residual risk

SSCP Risk Identification and Analysis Quiz

1. What is the primary advantage of quantitative risk analysis over qualitative?

2.

What first name or nickname would you like us to use?

2. True or False: Risk appetite and risk tolerance are the same concept.

3. The process of documenting and communicating identified risks to stakeholders is called ____.

4. A vulnerability scan is most useful for identifying which type of weakness?

5. What metric measures the effectiveness of a security control in reducing risk?

6. True or False: Inherent risk is the risk level after applying security controls.

7. In the STRIDE threat modeling framework, what does the 'E' represent?

8. Risk transfer typically involves purchasing ____.

9. Which of the following best describes threat modeling?

10. True or False: A control that reduces the probability of a threat occurring is called mitigation.

11. What is the primary purpose of risk identification in a security program?

12. Qualitative risk analysis relies primarily on ____.

13. Which risk response strategy involves accepting the potential impact of a risk?

14. An organization discovers a software vulnerability but has no exploitable threat actor. What is the risk level?

15. What is the relationship between threat, vulnerability, and risk?

16. In risk management, residual risk is the risk that remains after ____.

17. Vulnerability assessments are typically performed to identify what?

18. What does Single Loss Expectancy (SLE) represent?

19. Which of the following is NOT a common threat modeling methodology?

20. In quantitative risk analysis, what does the formula (Asset Value × Exposure Factor × Threat Frequency) calculate?