Cyber Security Quiz: Risk Assessment
10 questions · exam conditions
0:00
Risk AssessmentQuestion 1 of 10

A company reviews its payroll environment. Employee salary records are stored in a cloud payroll application. Attackers are attempting credential-stuffing attacks against employee accounts. The application permits password-only authentication, although the company has enabled conditional-access rules that block sign-ins from several high-risk countries.

Which classification of the risk elements is MOST accurate?

The cloud application is the threat, password-only authentication is the asset, and credential stuffing is the existing control.
Credential stuffing is the vulnerability, salary records are the control, and conditional access is the primary threat source.
Salary records are the asset, password-only authentication is the vulnerability, and conditional access is an existing control.
Password-only authentication is the threat, conditional access is the vulnerability, and the cloud provider is the affected asset.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Risk Assessment

Practice Risk Assessment in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Risk Assessment, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A company reviews its payroll environment. Employee salary records are stored in a cloud payroll application. Attackers are attempting credential-stuffing attacks against employee accounts. The application permits password-only authentication, although the company has enabled conditional-access rules that block sign-ins from several high-risk countries.

Which classification of the risk elements is MOST accurate?

  1. The cloud application is the threat, password-only authentication is the asset, and credential stuffing is the existing control.
  2. Credential stuffing is the vulnerability, salary records are the control, and conditional access is the primary threat source.
  3. Salary records are the asset, password-only authentication is the vulnerability, and conditional access is an existing control. (correct answer)
  4. Password-only authentication is the threat, conditional access is the vulnerability, and the cloud provider is the affected asset.
Explanation: When analyzing risk, you need to classify three core elements correctly: assets (what you're protecting), vulnerabilities (weaknesses that can be exploited), and controls (safeguards already in place). Threats are the actors or events that exploit vulnerabilities to harm assets. Keeping these definitions sharp is the key to this question. In this scenario, salary records are what the organization is trying to protect — that's your asset. Password-only authentication is a weakness in the system because it lacks a second verification factor, making it susceptible to credential-stuffing attacks. Conditional access (blocking high-risk countries) is already deployed, making it an existing control — imperfect, but active. Answer C maps all three elements correctly, making it the most accurate classification. Answer A scrambles everything: the cloud application is infrastructure, not a threat; password-only authentication is a vulnerability, not an asset; and credential stuffing is the attack method (threat action), not a control. Answer B misidentifies credential stuffing as a vulnerability — it's actually the threat action performed by attackers. Salary records are the asset, not a control, and conditional access is a defensive measure, not a threat source. Answer D calls password-only authentication a "threat," but it's a vulnerability — threats are external actors or events, not internal weaknesses. Conditional access is a control, not a vulnerability, and the cloud provider is not the affected asset (the salary records are). A useful tip: on risk classification questions, ask yourself — "Is this something I'm protecting, something broken, or something defending?" That sequence maps directly to asset → vulnerability → control.

Question 2

A server has an asset value of $200,000\$200{,}000. A successful incident is expected to cause a loss of 25%25\% of that value, and the annual rate of occurrence is 0.40.4. A proposed control costs $14,000\$14{,}000 per year and would reduce the annual rate of occurrence to 0.10.1 without changing the loss magnitude.

Which statement BEST describes the control's annual quantitative benefit?

  1. It reduces expected annual loss by $15,000\$15{,}000, producing a net expected benefit of $1,000\$1{,}000 after control cost. (correct answer)
  2. It reduces expected annual loss by $20,000\$20{,}000, producing a net expected benefit of $6,000\$6{,}000 after control cost, treating the full original loss as the benefit gained.
  3. It reduces expected annual loss by $5,000\$5{,}000, producing a net expected loss of $9,000\$9{,}000 after control cost, using only the post-control loss figure as the reduction.
  4. It reduces expected annual loss by $30,000\$30{,}000, producing a net expected benefit of $16,000\$16{,}000 after control cost, by applying the occurrence-rate change to the full asset value.
Explanation: When you see a question involving risk quantification, your framework should be the Annualized Loss Expectancy (ALE) formula: ALE=AssetValue×ExposureFactor×AnnualRateOfOccurrenceALE = AssetValue \times ExposureFactor \times AnnualRateOfOccurrence. The control's benefit is simply the difference between the original ALE and the residual ALE after the control is applied. Here, the Single Loss Expectancy (SLE) is $200,000×0.25=$50,000\$200{,}000 \times 0.25 = \$50{,}000. The original ALE is $50,000×0.4=$20,000\$50{,}000 \times 0.4 = \$20{,}000. After the control drops the occurrence rate to 0.1, the residual ALE is $50,000×0.1=$5,000\$50{,}000 \times 0.1 = \$5{,}000. The reduction in expected annual loss is $20,000−$5,000=$15,000\$20{,}000 - \$5{,}000 = \$15{,}000. Subtracting the control cost gives a net benefit of $15,000−$14,000=$1,000\$15{,}000 - \$14{,}000 = \$1{,}000. That confirms A is correct. B is tempting but wrong — it claims a $20,000\$20{,}000 reduction by treating the entire original ALE as the benefit, as if the control eliminated all risk rather than just reducing occurrence rate. C makes the opposite error: it uses only the post-control ALE ($5,000\$5{,}000) as the reduction figure instead of computing the difference between before and after, producing a fabricated $9,000\$9{,}000 net loss. D incorrectly applies the occurrence-rate change (0.30.3 drop) directly to the full asset value ($200,000×0.3×0.5≈$30,000\$200{,}000 \times 0.3 \times 0.5 \approx \$30{,}000), conflating rate change with total exposure. A reliable study tip: always compute both the pre-control and post-control ALE separately, then subtract. Never shortcut by using one figure in isolation — that's exactly the trap each wrong answer exploits.

Question 3

A legacy service supports a critical business process and cannot be replaced for several months. It has a remotely exploitable vulnerability with no vendor patch. The company restricts access through an allowlisted reverse proxy and purchases insurance that covers some incident-response and recovery expenses.

Which statement BEST characterizes the resulting risk treatment?

  1. The proxy mitigates part of the likelihood, insurance transfers part of the financial impact, and residual risk remains with the company. (correct answer)
  2. The proxy avoids the risk by removing external access, while insurance accepts any operational impact that remains after an incident.
  3. Insurance transfers the entire risk to the insurer, while the proxy removes the vulnerability from the legacy service itself.
  4. Keeping the service constitutes acceptance only, because compensating controls do not qualify as formal methods of risk treatment.
Explanation: Whenever you see a risk treatment question, anchor yourself to the four standard strategies: avoid, mitigate, transfer, and accept. Real-world scenarios almost always blend multiple strategies simultaneously, and the exam will test whether you can correctly label what each control actually does. In this scenario, the reverse proxy doesn't eliminate the vulnerability — it reduces the likelihood that an attacker can reach and exploit it by restricting who can connect. That's mitigation. Cyber insurance doesn't make the vulnerability disappear either; it offsets some financial consequences if an incident occurs. That's partial transfer — partial because insurance never covers everything (deductibles, reputational damage, and operational losses typically remain). Because the service stays running with an unpatched flaw, some risk sits squarely with the company. Answer A correctly captures all three layers: likelihood reduction, partial financial transfer, and residual risk retention. Answer B fails because a reverse proxy does not avoid risk — avoidance means eliminating the activity or asset entirely, like shutting the service down. Restricting access is mitigation, not avoidance. Answer C contains two errors: insurance never transfers the entire risk (insurers have exclusions and coverage limits), and the proxy does nothing to the vulnerability itself — it remains in the code. Answer D is a trap for students who think compensating controls are somehow informal or disqualified; compensating controls are recognized risk treatment mechanisms in frameworks like ISO 27001 and NIST RMF. Keeping the service does involve acceptance, but only of the residual risk after other controls are applied. Your study tip: map each control in a scenario to its specific effect — does it touch likelihood, impact, or the asset itself? This prevents conflating mitigation with avoidance, a distinction the exam exploits repeatedly.

Question 4

A newly acquired company reports no known account-takeover incidents. However, it retains authentication logs for only a short period, has limited alerting, and operates in an industry experiencing frequent credential attacks. The assessment team proposes a low likelihood rating solely because no incidents were reported.

Which response BEST addresses the quality of this likelihood estimate?

  1. Keep the low rating because internal incident history is more relevant than external threat activity, regardless of detection capability.
  2. Treat the absence of reports as weak evidence, use industry and exposure data, and document uncertainty caused by limited detection. (correct answer)
  3. Assign the highest likelihood automatically because missing logs prove that successful account takeovers have already occurred.
  4. Defer the entire assessment until several years of internal incident data are available and statistically representative.
Explanation: When evaluating likelihood in a risk assessment, you must consider the quality of your evidence, not just the absence of bad news. A clean incident record means very little if the organization lacks the detection capability to spot incidents in the first place — short log retention and limited alerting create a "blind spot," not safety. This question tests whether you understand that likelihood estimates must account for detection gaps and external threat context, not just internal history. B is correct because it applies sound risk methodology: treat absence of evidence as weak evidence (not evidence of absence), supplement internal gaps with industry threat data, and transparently document the uncertainty introduced by poor detection. This produces a defensible, calibrated estimate rather than a falsely confident one. A is wrong because it inverts the logic. Internal incident history is only meaningful when detection capability is strong enough to actually catch incidents. Prioritizing that history over external threat data when detection is admittedly poor leads to systematic underestimation of risk. C is wrong because it overcorrects into the opposite extreme. Missing logs increase uncertainty — they don't prove successful attacks occurred. Automatically assigning maximum likelihood based on an absence of logs is unsupported speculation, not analysis. D is wrong because it confuses rigor with paralysis. Waiting years for statistically significant internal data ignores usable evidence that exists right now (industry reports, threat intelligence, exposure indicators). Risk decisions often must be made under uncertainty — the goal is managing that uncertainty, not eliminating it before proceeding. Study tip: On risk questions, watch for scenarios where absence of incidents is conflated with low risk. Always ask: "Could this organization even detect an incident?" That question reveals whether the baseline is trustworthy.

Question 5

An analyst must recommend which of four findings should receive additional treatment first. The organization prioritizes risks according to current likelihood and business impact, after considering controls already operating.

Which finding should the analyst rank as the HIGHEST current risk?

  1. An Internet-facing order API is targeted by an active exploit, but a tested virtual patch blocks the exploit and the API processes only payment tokens.
  2. A frequently traveled finance laptop stores payroll exports, lacks full-disk encryption, and is regularly exposed to targeted phishing and theft attempts. (correct answer)
  3. An unsupported manufacturing controller could halt production, but it is isolated from user networks and reachable only through a monitored maintenance gateway.
  4. A source-code repository contains valuable intellectual property, but phishing-resistant MFA and quarterly access reviews cover all current repository users.
Explanation: When evaluating risk priority on security exams, remember that residual risk is what matters — not the raw threat, but the risk remaining after existing controls are applied. You're looking for the scenario where controls are weakest relative to the likelihood and impact of the threat. The finance laptop in B represents the highest residual risk because multiple compounding factors converge: sensitive payroll data is stored locally, full-disk encryption is absent (so physical access equals data access), and the device is frequently exposed to both targeted phishing and theft. No meaningful compensating control is described. High likelihood plus high impact plus weak controls equals high residual risk. A looks alarming because of the active exploit, but the virtual patch has been tested and is actively blocking it. The data involved is payment tokens, not raw financial records. Controls are functioning and validated — residual risk is substantially reduced. C involves a serious availability threat (halting production), but the manufacturing controller is network-isolated and accessible only through a monitored gateway. Isolation is a strong compensating control, and the attack surface is tightly constrained. D protects high-value intellectual property, but phishing-resistant MFA is one of the strongest available authentication controls, and quarterly access reviews limit insider threat exposure. Controls are mature and well-matched to the threat. The strategic takeaway: don't let dramatic-sounding threats distract you from evaluating controls. On risk-prioritization questions, always ask "what controls exist, are they tested, and do they actually reduce likelihood or impact?" The scenario with the fewest effective controls relative to its exposure wins — and here, that's B.

Question 6

During an assessment, an application owner reports that multifactor authentication protects all remote access. Authentication logs later show that a legacy protocol bypasses the multifactor workflow and is still used by several active accounts.

What should the assessor do NEXT when determining residual risk?

  1. Use the owner's reported control status because interviews are sufficient evidence for a basic conceptual risk assessment.
  2. Lower inherent risk because most remote sessions use multifactor authentication despite the remaining legacy protocol.
  3. Treat the bypass as a control gap, determine its exposure and usage, and revise residual risk using observed effectiveness. (correct answer)
  4. Remove multifactor authentication from the assessment entirely because one bypass means the control provides no measurable benefit.
Explanation: When evaluating controls during a risk assessment, you must distinguish between reported controls and effective controls. The core concept here is residual risk, which equals inherent risk minus the actual risk reduction a control provides — not the reduction it was supposed to provide. When evidence contradicts a control owner's claim, observed evidence always takes precedence. The authentication logs reveal a concrete control gap: a legacy protocol bypasses MFA entirely for active accounts. Answer C is correct because it follows sound risk methodology — acknowledge the gap, assess its scope (how many accounts, how frequently used, what's exposed), and recalculate residual risk based on what the control actually does, not what was reported. A control that can be bypassed provides only partial protection, and your residual risk calculation must reflect that reality. Answer A fails because interviews alone are never sufficient when technical evidence contradicts them. Logs, configurations, and system tests are primary evidence; self-reporting is secondary. Treating an owner's statement as conclusive ignores a fundamental principle of evidence-based assessment. Answer B commits a common averaging fallacy — concluding that because most sessions use MFA, the risk is reduced proportionally. Attackers exploit the weakest path, not the most common one. One reliable bypass can negate the benefit of strong controls elsewhere. Answer D swings too far in the opposite direction. A partial bypass doesn't erase the value of MFA for all other sessions. Residual risk should be revised, not the control discarded entirely. Study tip: On questions about residual risk, watch for the trap of accepting reported controls at face value. Always ask: what does the evidence show about actual control effectiveness?

Question 7

A team assesses a customer portal and inventories its web servers, databases, and network controls. The portal itself stores little sensitive data. During review, the team learns that it relies on an external identity provider also used by the company's payroll and support systems. Compromise of that provider could permit access to all three services.

What is the BEST correction to the assessment approach?

  1. Exclude the identity provider because it is externally hosted and therefore belongs only in the provider's own risk assessment.
  2. Add the identity provider as a critical dependency and evaluate common authentication failures across the connected business services. (correct answer)
  3. Rate the portal as low impact because it stores little data, while separately documenting that the other systems have higher asset values.
  4. Treat each service as independent because combining their impacts would duplicate the same authentication vulnerability in the register.
Explanation: When assessing systems for risk, you must think beyond the asset directly in front of you and consider the full dependency chain. A vulnerability's true impact is measured not by what a single system stores, but by what access it can grant to other systems. Here, the identity provider is a shared authentication hub connecting the portal, payroll, and support systems. Compromising it doesn't just affect the portal — it creates a lateral attack path to all three services. B is correct because it captures this reality: the identity provider must be elevated to a critical dependency in the assessment scope, and authentication risks must be evaluated across all connected services together. This is consistent with how frameworks like NIST SP 800-30 and threat modeling methodologies treat third-party dependencies — they belong in your scope if their failure directly affects your assets. A is a dangerous scoping error. Externally hosted doesn't mean outside your risk boundary. If a third party's compromise harms your systems, that third party belongs in your assessment. Outsourcing hosting does not outsource risk. C misapplies asset valuation. Rating the portal in isolation because it stores little data ignores that it serves as an entry point to systems with far greater sensitivity. Impact ratings must account for reachable assets, not just local ones. D confuses duplication with accuracy. Documenting a shared vulnerability across connected services isn't double-counting — it's correctly modeling the blast radius. Treating each service as independent would hide the systemic exposure. Study tip: On exam questions about scoping, watch for shared services like identity providers, APIs, and middleware — they are almost always in scope because their failure cascades across systems.

Question 8

A risk assessment originally rated malware infection of employee workstations as high before endpoint detection and response was introduced. A later review finds that the tool is effective on enrolled systems, but a significant group of remote workstations has not enrolled.

How should the assessor MOST appropriately update the assessment?

  1. Lower inherent risk because the endpoint tool is effective wherever it has been installed and tested.
  2. Set residual risk to low because control design is effective, even though actual deployment is incomplete.
  3. Raise inherent risk because incomplete enrollment has created a new malware threat against remote systems.
  4. Leave inherent risk unchanged and recalculate residual risk using the tool's actual coverage and effectiveness. (correct answer)
Explanation: When you see a risk assessment question, anchor yourself to two distinct concepts: inherent risk (the baseline threat level before any controls exist) and residual risk (what remains after controls are applied). The scenario here is testing whether you understand that incomplete deployment affects residual risk, not the underlying threat itself. The malware threat to workstations hasn't changed — it was high before, and the fundamental vulnerability of endpoints to malware remains exactly the same. What changed is the control environment. Because a significant portion of remote workstations never enrolled in the EDR tool, the control is only partially effective across the actual environment. That means residual risk must be recalculated based on real-world coverage, not theoretical design. Answer D correctly preserves inherent risk (unchanged threat and vulnerability baseline) while requiring an honest reassessment of residual risk using actual deployment data. Answer A is wrong because it confuses partial deployment with full effectiveness. The tool working well on enrolled systems tells you nothing about the unprotected machines — those systems still carry the full inherent exposure. Answer B commits a critical error: "control design is effective" does not equal "control is implemented." A control that isn't deployed isn't a control at all, so setting residual risk to low misrepresents actual organizational exposure. Answer C is a trap — incomplete enrollment doesn't create a new threat or raise inherent risk. Inherent risk reflects the threat landscape independent of controls; you don't adjust it because controls are missing. The key study tip: inherent risk is about the world; residual risk is about your controls. Only recalculate residual risk when the control environment changes — never adjust inherent risk based on control gaps.

Question 9

A ransomware assessment finds that production files are backed up nightly. However, the backup repository remains continuously writable from production and uses the same administrative credentials. Recent ransomware campaigns specifically target accessible backup systems.

Which control recommendation would MOST directly reduce the identified recovery risk?

  1. Increase backup frequency and retain additional writable copies in the same repository using the existing administrative access model.
  2. Deploy enhanced email filtering and require annual awareness training for users with access to the production file environment.
  3. Maintain immutable or offline backup copies, separate backup credentials, and periodically test restoration from those protected copies. (correct answer)
  4. Purchase additional cyber insurance and document that recovery expenses may be submitted if ransomware disrupts production services.
Explanation: When evaluating ransomware recovery risks, focus on the specific vulnerabilities identified — in this case, a writable backup repository accessible with shared credentials. The threat isn't just that ransomware can encrypt production files; modern ransomware actively hunts for reachable backup systems and destroys them before triggering encryption. Your recommendation must directly neutralize that attack path. Option C is correct because it addresses every identified weakness simultaneously. Immutable or offline backups cannot be encrypted or deleted by ransomware, even if attackers gain production-level access. Separate backup credentials prevent a single compromised account from reaching both environments. Periodic restoration testing confirms the backups actually work — a recoverable backup that has never been tested is an assumption, not a control. Option A is a trap that makes the vulnerability worse. Increasing frequency and retaining more writable copies in the same accessible repository simply gives ransomware more targets. More copies ≠ more protection when the access model is the problem. Option B addresses the delivery mechanism (phishing emails, user error) rather than the recovery gap. Email filtering and training are worthwhile preventive controls, but they don't protect backup integrity if an attacker breaks through anyway. Option D is a financial transfer mechanism, not a technical control. Cyber insurance helps you pay for recovery but does nothing to make recovery possible. If backups are destroyed, insurance money doesn't restore your files. A useful pattern to remember: when a question describes a specific technical vulnerability, the correct control will directly close that gap — not shift the problem, prevent something adjacent, or compensate financially after failure.

Question 10

A remote-access appliance contains unsupported firmware. Internet scanning for that appliance has increased, and customer records are reachable after successful remote authentication. A firewall permits connections only from approved partner addresses, although several partners use large shared address ranges.

Which risk description assigns the scenario's elements MOST accurately?

  1. The firewall is the threat, partner address ranges are the asset, and unsupported firmware is a compensating control protecting customer records.
  2. Unsupported firmware is the impact, Internet scanning is the asset, and customer records are a vulnerability created by remote authentication.
  3. Customer records are the threat, remote access is the impact, and the approved-address rule eliminates the underlying firmware vulnerability.
  4. Attackers are the threat source, unsupported firmware is a vulnerability, customer records are an asset, and address filtering is a partial control. (correct answer)
Explanation: When analyzing risk scenarios on security exams, you need to map each scenario element to the correct risk framework component: threat source (who attacks), vulnerability (weakness exploited), asset (what has value), and control (what mitigates risk). Mixing these up is exactly what the wrong answers exploit. In this scenario, the attackers conducting internet scanning are the threat source — they're the agents capable of causing harm. The unsupported firmware is the vulnerability because it's an unpatched weakness that can be exploited. Customer records are the asset at risk — they're what holds value and what attackers ultimately want. The firewall's address filtering is a control, but calling it partial is key: partners using large shared address ranges means a compromised partner IP, or a spoofed one, could still gain entry. Answer D captures all of this correctly. Answer A misidentifies the firewall as the threat — firewalls are controls, not adversaries. It also wrongly labels unsupported firmware as a compensating control, when it's actually the vulnerability being compensated for. Answer B calls unsupported firmware the "impact" — impacts are outcomes like data breaches or downtime, not technical weaknesses. It also treats internet scanning as an asset, when scanning is threat activity. Answer C is perhaps the most misleading: it claims the address rule "eliminates" the firmware vulnerability, which it doesn't — filtering reduces exposure but doesn't patch the firmware flaw. It also misidentifies customer records as the threat. Your study tip: on risk questions, identify each element by asking who, what weakness, what's valuable, and what protects it — in that order — before evaluating the answer choices.