Cyber Security Quiz: Risk Terminology
10 questions · exam conditions
0:00
Risk TerminologyQuestion 1 of 10

A payroll portal is reachable from the internet and contains a SQL injection flaw. A criminal group routinely scans public payroll systems and exploits the flaw to alter employee bank details. If successful, the organization would issue fraudulent payments, suspend payroll processing, and incur recovery costs.

Which classification most accurately maps the elements of this scenario?

The criminal group's scanning is the vulnerability, the injection flaw is the impact, and fraudulent payments are the threat.
The criminal group's exploitation is the threat, the injection flaw is the vulnerability, and the resulting losses are the impact.
The public portal is the impact, the criminal group's activity is the vulnerability, and recovery costs represent the threat.
The injection flaw is the threat, fraudulent payments are the vulnerability, and the criminal group represents the impact.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Risk Terminology

Practice Risk Terminology in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Risk Terminology, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A payroll portal is reachable from the internet and contains a SQL injection flaw. A criminal group routinely scans public payroll systems and exploits the flaw to alter employee bank details. If successful, the organization would issue fraudulent payments, suspend payroll processing, and incur recovery costs.

Which classification most accurately maps the elements of this scenario?

  1. The criminal group's scanning is the vulnerability, the injection flaw is the impact, and fraudulent payments are the threat.
  2. The criminal group's exploitation is the threat, the injection flaw is the vulnerability, and the resulting losses are the impact. (correct answer)
  3. The public portal is the impact, the criminal group's activity is the vulnerability, and recovery costs represent the threat.
  4. The injection flaw is the threat, fraudulent payments are the vulnerability, and the criminal group represents the impact.
Explanation: When working through threat-modeling questions, anchor yourself to three core definitions: a threat is an actor or action capable of causing harm, a vulnerability is a weakness that can be exploited, and impact is the resulting damage or consequence. Mixing these up is the most common trap on cybersecurity classification questions. In this scenario, the criminal group actively scanning and exploiting the system is the threat — they are the hostile agent capable of causing harm. The SQL injection flaw is the vulnerability — it's the exploitable weakness in the portal's code that makes the attack possible. The fraudulent payments, suspended payroll, and recovery costs are the impact — they represent the real-world consequences if the threat successfully leverages the vulnerability. That maps cleanly to answer B, which correctly aligns all three elements. Answer A reverses the threat and vulnerability entirely, calling the criminals' scanning a "vulnerability" and the injection flaw an "impact" — neither is accurate. Scanning is an attacker action, not a weakness in the system, and a code flaw is never an impact. Answer C misidentifies the public portal as the impact (it's actually the attack surface, not a consequence), labels the criminal activity a vulnerability (again, attackers are threats, not weaknesses), and calls recovery costs a threat (costs are downstream consequences, i.e., impact). Answer D is almost entirely inverted — a code flaw cannot be a threat on its own without an actor exploiting it, and fraudulent payments are consequences, not vulnerabilities. A reliable study tip: always ask yourself who/what attacks (threat), what weakness is exploited (vulnerability), and what goes wrong afterward (impact). Following that sequence will untangle even tricky classification questions.

Question 2

A vendor releases a patch that completely removes a remotely exploitable flaw from a server. A hostile group still intends to compromise the organization, and the maximum business loss from a successful compromise has not changed. No alternative exploit is currently known.

Immediately after the patch is applied, which risk statement is most defensible?

  1. The threat and potential impact are eliminated because the specific vulnerability can no longer be exploited.
  2. The vulnerability remains, but risk decreases because the hostile group has temporarily lost its motivation.
  3. The impact decreases, while the threat and vulnerability remain unchanged until the group ends its campaign.
  4. The vulnerability is removed and risk decreases, while the threat source and potential impact can still remain. (correct answer)
Explanation: When a question describes a patching event and asks about residual risk, you need to think through the classic risk equation: Risk = Threat × Vulnerability × Impact. Each component is independent, and a change to one doesn't automatically change the others. Here's the logic for answer D: patching removes the vulnerability — the specific exploitable flaw no longer exists in the system. Because vulnerability drops, overall risk decreases. However, the threat source (the hostile group) still exists and hasn't changed its intent. Equally important, the potential impact — the maximum business loss from a successful compromise — is explicitly stated as unchanged. D correctly isolates what changed (vulnerability eliminated, risk reduced) from what didn't (threat and impact remain). Walking through the distractors: A is tempting but makes a critical overreach — it claims the threat is eliminated. Removing a vulnerability doesn't disband the hostile group or erase their motivation; they still exist as a threat actor. B gets the components completely wrong by claiming the vulnerability remains and inventing a motivation shift for the group that the passage never supports. It also confuses threat (who/what might attack) with motivation, which is a component of threat, not a separate element. C states that impact decreases, but the passage explicitly tells you maximum business loss is unchanged — this answer contradicts the scenario directly. A useful rule of thumb for risk questions: patch = vulnerability fix, not threat elimination. Threat actors, intent, and business impact all exist outside your patch management system. Always ask yourself which risk component each action actually touches.

Question 3

Two servers have the same unpatched software flaw, identical internet exposure, and comparable attacker activity. One server contains synthetic test records, while the other processes regulated customer transactions. Exploitation would require the same attacker effort on either server.

Why can the transaction server have greater risk even though the vulnerability and threat conditions are equivalent?

  1. Its vulnerability is greater because regulated records make the identical software flaw easier to exploit.
  2. Its potential impact is greater because compromise would produce more serious business and legal consequences. (correct answer)
  3. Its threat is greater because a regulated workload automatically increases attacker capability and intent.
  4. Its risk is greater only if the technical severity rating of the shared flaw is also increased.
Explanation: Whenever you see a question about risk, anchor yourself to the classic formula: Risk = Threat × Vulnerability × Impact. This question is specifically testing whether you can isolate the impact component when all other variables are held equal. The scenario deliberately controls for threat (same attacker activity) and vulnerability (same unpatched flaw, same exploitation effort). The only variable that differs is what happens after a successful breach. The transaction server holds regulated customer data, meaning a compromise triggers breach notification requirements, regulatory fines, legal liability, and reputational damage — consequences that simply don't apply to synthetic test records. Because impact is a core component of risk, a higher impact produces higher overall risk even when threat and vulnerability are identical. That's exactly what B describes, making it the correct answer. A is wrong because impact doesn't change exploitability. The software flaw is no easier or harder to exploit on the transaction server — the passage explicitly states exploitation requires the same attacker effort. Conflating impact with vulnerability is a common trap. C is wrong for a similar reason: the regulated workload doesn't enhance attacker capability or intent. Attacker motivation might increase if they know valuable data is present, but the scenario tells you attacker activity is already comparable. More importantly, this confuses threat with impact. D is wrong because risk isn't solely determined by a technical severity rating. A low-CVSS flaw on a critical system can represent enormous organizational risk once business context and impact are factored in. Study tip: On risk questions, always ask which component is actually changing — threat, vulnerability, or impact. Distractors often smuggle the right concept into the wrong category.

Question 4

A cloud storage bucket was accidentally configured for public access and was indexed by a search engine. Logs cannot establish whether an unauthorized person downloaded any files. The bucket contains confidential design documents.

Which assessment uses the risk terms most accurately despite the lack of confirmed data theft?

  1. Search-engine indexing is the impact because it proves the organization has suffered a confirmed confidentiality loss.
  2. The public-access setting is the threat because that configuration can directly cause harm to confidential information.
  3. No risk exists until a download is proven, although public access would become a vulnerability afterward.
  4. Public access is a vulnerability, unauthorized discovery or access is a threat scenario, and disclosure is a potential impact. (correct answer)
Explanation: Whenever you see a scenario involving a misconfigured system and potential data exposure, anchor yourself to three foundational risk terms: vulnerability (a weakness), threat (an actor or scenario that could exploit it), and impact (the harm that results). These are distinct concepts, and exam questions love to test whether you can keep them straight under pressure. In this scenario, the public-access configuration is clearly a vulnerability — it's a weakness in the system's security posture that creates exploitable exposure. The realistic scenario of an unauthorized party discovering and accessing those files through the search engine index is the threat (or threat scenario). The impact — confidential disclosure — is potential because no confirmed download has been established. Answer D captures all three layers accurately and handles the uncertainty honestly by calling disclosure a potential impact rather than a confirmed one. Answer A misidentifies the impact. Search-engine indexing is an event that increased exposure; it doesn't itself constitute a confirmed confidentiality loss. Impact requires actual harm, not just visibility. Answer B misidentifies the threat. The public-access setting is a configuration weakness — that's a vulnerability. A threat must be an external actor or scenario that exploits the weakness, not the weakness itself. Answer C is the most dangerous distractor: it claims no risk exists until a download is proven. This fundamentally misunderstands risk. Risk exists whenever a vulnerability is present and a plausible threat scenario exists — you don't need confirmed harm to acknowledge risk. Your takeaway: vulnerability = the weakness, threat = the exploiting scenario, impact = the resulting harm. These can be assessed probabilistically — confirmed evidence of harm is not required to identify risk.

Question 5

Before an incident, a risk register stated that attackers might use reused administrator passwords to deploy ransomware, potentially interrupting operations. The event later occurred and caused eight hours of downtime and substantial recovery expense.

Which statement correctly distinguishes the pre-incident risk from the realized impact?

  1. The reused passwords were the pre-incident threat, while the ransomware operators became the vulnerability after exploitation.
  2. The predicted interruption was the vulnerability, while the eight-hour outage was the threat once it occurred.
  3. The recovery expense was the original risk, while uncertainty about attacker action was the realized impact.
  4. The possibility of ransomware and resulting harm was the risk, while the actual outage and expense were impacts. (correct answer)
Explanation: When tackling risk management questions, keep these definitions sharp: risk is the possibility of harm (combining threat, vulnerability, and potential consequence before anything happens), while impact is the realized damage once an event actually occurs. The risk register entry describes a forward-looking concern — administrators might reuse passwords, attackers might exploit that weakness, ransomware might deploy, operations might be disrupted. That entire predicted scenario is the risk. D is correct because it maps precisely onto this framework. The pre-incident entry captured possibility — ransomware deployment and resulting harm — which is exactly what a risk represents. Once the event unfolded, the eight-hour outage and recovery costs became concrete, measurable impacts. The distinction is possibility versus actuality. A gets the terminology backwards. The reused passwords were the vulnerability (a weakness to be exploited), not the threat. The ransomware operators were the threat (the actor with intent). Neither of these swaps to the other role after exploitation — the labels stay fixed to what each element actually is. B confuses the framework entirely. The predicted interruption was never the vulnerability; it was the anticipated consequence. A vulnerability is a weakness in a system or process, not an outcome. Calling an outage a "threat once it occurred" also misuses threat, which refers to an actor or event with potential to cause harm, not the harm itself. C inverts the timeline. Recovery expense wasn't recorded before the incident as the original risk — it emerged from the incident. Uncertainty about attacker action describes risk broadly, but the passage's actual risk was the specific ransomware scenario, not generic uncertainty. Study tip: On risk questions, ask yourself: "Is this a 'what might happen' statement or a 'what did happen' statement?" That single check reliably separates risk from impact.

Question 6

A security analyst is revising a register whose entries have incorrectly mixed threats, vulnerabilities, impacts, and risks.

Which proposed entry is a risk statement rather than only a threat, vulnerability, or impact statement?

  1. Former contractors retain active remote-access accounts after their employment ends, creating an access-control gap.
  2. A criminal group is conducting credential-stuffing campaigns against companies operating in the sector.
  3. Attackers may use retained accounts to access customer records, causing regulatory and notification costs. (correct answer)
  4. Unauthorized disclosure of customer records would damage organizational trust and interrupt normal business operations.
Explanation: When working with risk registers, you need to distinguish four distinct concepts: a threat (an actor or event that could cause harm), a vulnerability (a weakness that can be exploited), an impact (a consequence if something goes wrong), and a risk (the combination of a threat exploiting a vulnerability to produce an impact). A proper risk statement connects all three elements into one coherent chain. Option C does exactly this: it names the threat actor (attackers), identifies the vulnerability being exploited (retained accounts), and specifies the resulting impact (regulatory and notification costs). That full threat-vulnerability-impact chain is what makes C a risk statement rather than any one component in isolation. Option A describes only a vulnerability — the access-control gap created by lingering contractor accounts. There's no threat actor acting on it and no harm articulated. Option B identifies only a threat — a criminal group running credential-stuffing campaigns. It tells you who might attack and how, but says nothing about what weakness they'd exploit or what damage would follow. Option D describes only an impact — the trust damage and operational disruption from unauthorized disclosure. It skips both the threat actor and the exploited vulnerability entirely. The common trap here is that options A and D feel serious and risk-adjacent, so students assume seriousness equals risk. But severity alone isn't a risk statement — it's just an impact. A reliable memory aid: a risk statement answers who does what to what weakness, causing what harm. If any of those three pieces is missing, you're looking at a component, not a complete risk.

Question 7

During a review, a manager says, "A distributed denial-of-service attack is our biggest vulnerability." The company operates a revenue-generating service through a single internet provider, and an extortion group has recently threatened to overwhelm that connection.

Which revision most accurately corrects the manager's terminology?

  1. The denial-of-service campaign is the threat, dependence on one provider is the vulnerability, and service outage losses are the impact. (correct answer)
  2. The extortion group's demand is the vulnerability, the single provider is the impact, and traffic flooding is the resulting risk.
  3. The service outage is the threat, dependence on one provider is the risk, and the group's capability is the vulnerability.
  4. The single internet provider is the threat, traffic flooding is the impact, and lost revenue is the organization's vulnerability.
Explanation: Cybersecurity risk frameworks hinge on three distinct concepts you must keep separate: a threat is any actor or event that could cause harm, a vulnerability is a weakness that can be exploited, and impact (or consequence) is the resulting damage. The manager's mistake is calling the entire DDoS attack a "vulnerability" — that collapses three separate ideas into one. Answer A correctly untangles them. The DDoS campaign (the extortion group's action of flooding traffic) is the threat — it's the external force that could cause harm. Relying on a single internet provider is the vulnerability — it's the internal weakness that makes the threat dangerous; if the company had redundant providers, the attack would be far less impactful. Lost revenue from a service outage is the impact — the measurable consequence if the threat exploits the vulnerability. That mapping is clean and accurate. Answer B falls apart immediately: an extortion group's demand is not a vulnerability, it's a threat action. Answer C misidentifies the service outage as the threat — an outage is an outcome, not an attacking force. It also swaps risk and vulnerability without meaningful distinction. Answer D commits the worst reversal: it calls the single internet provider the threat, when a provider is a dependency (a vulnerability), not an adversary. Lost revenue is the impact, not a vulnerability. A useful memory anchor: Threat = who/what attacks, Vulnerability = weakness exploited, Impact = what you lose. On exam questions, check whether each term maps to an actor/event, a weakness, or a consequence — any mismatch is your signal to eliminate that choice.

Question 8

An organization deploys immutable offline backups. Testing shows that phishing emails arrive at the same rate and compromised credentials are just as likely to be used successfully. However, recovery from a ransomware encryption event would now take four hours instead of five days.

Which component of the ransomware risk is most directly reduced by this control?

  1. Impact, because the duration and operational consequences of a successful encryption event are reduced. (correct answer)
  2. Threat, because immutable backups discourage attackers from sending phishing messages to the organization.
  3. Vulnerability, because offline backups prevent compromised credentials from enabling unauthorized access.
  4. Threat likelihood, because faster restoration makes successful credential use less technically probable.
Explanation: When analyzing how a security control affects risk, always decompose risk into its core components: threat (the attacker and their actions), vulnerability (weaknesses that enable exploitation), and impact (the consequences when an attack succeeds). A control can reduce risk by affecting one or more of these components — your job is to identify which one a specific control targets. Immutable offline backups don't interfere with attackers or their methods — phishing still arrives at the same rate. They don't close any access pathway — compromised credentials still work. What they change is what happens after a successful ransomware encryption: recovery drops from five days to four hours. That's a direct reduction in impact — the severity and duration of harm caused by a successful attack. Answer A correctly identifies this. Answer B is wrong because the passage explicitly states phishing emails arrive at the same rate — attackers aren't deterred at all. Backups don't reduce the threat actor's motivation or capability. Answer C is wrong because vulnerability refers to weaknesses that allow unauthorized access. The passage confirms compromised credentials are still used successfully — no access barrier was added. Answer D misuses "threat likelihood" and "technical probability." Restoration speed has no effect on whether an attacker can successfully deploy ransomware; it only affects what you can do afterward. A useful memory anchor: ask yourself at what stage of the attack lifecycle does the control intervene? If it acts after compromise and encryption have already occurred, it's reducing impact — not threat or vulnerability.

Question 9

A company buys cyber insurance covering part of the direct recovery expense from a destructive attack. The policy does not prevent attacks, correct system weaknesses, restore unavailable services faster, or compensate for reputational damage.

How should the effect of the insurance be characterized in risk terminology?

  1. It removes the threat because an insured destructive attack can no longer produce any meaningful financial consequences for the organization.
  2. It transfers part of the financial consequence to the insurer, while the threat, vulnerabilities, and uncovered impacts remain unchanged. (correct answer)
  3. It eliminates the vulnerabilities because recovery expenses are now assigned contractually to an external party under the policy terms.
  4. It lowers attack likelihood because adversaries recognize that insured organizations are less profitable targets to exploit.
Explanation: Whenever you see a question about risk management, anchor yourself to the classic risk equation: Risk = Threat × Vulnerability × Impact. Each component is distinct, and a control that addresses one does not automatically affect the others. The key question to ask is: which component does this control actually change? Cyber insurance is a risk transfer mechanism — it shifts a portion of the financial burden to a third party (the insurer) in exchange for premiums. In this scenario, the insurance covers part of the direct recovery expense, meaning it reduces how much of the impact the organization bears out of pocket. The threat actors still exist, the system weaknesses remain unpatched, services still go down during an attack, and reputational damage is still uncompensated. That's precisely what B captures: a partial transfer of financial consequence while everything else stays intact. Choice A is wrong because insurance never removes the threat. Attackers don't disappear because a policy exists — the destructive attack can still occur and cause real harm. Choice C confuses financial liability with technical vulnerability. Assigning recovery costs to an insurer does nothing to patch software flaws or close attack surfaces. Choice D describes a deterrence effect that insurance simply doesn't produce — adversaries generally don't research target insurance portfolios before launching attacks, and there's no mechanism by which coverage reduces attack probability. Study tip: On risk questions, always map each control to the specific risk component it modifies — threat, vulnerability, likelihood, or impact. Insurance is almost always a transfer of impact, never a reduction of threat or vulnerability.

Question 10

A scanner assigns a critical technical severity to a flaw on a laboratory system. The system is isolated from production, accepts connections only from a restricted management network, and stores no sensitive or operationally important data. The flaw is verified and remains unpatched.

Which conclusion best explains why the organization's assessed risk may be lower than the scanner's technical severity suggests?

  1. The flaw is not a vulnerability unless a threat actor has already exploited it on the laboratory system and caused measurable harm.
  2. Isolation converts the flaw from a vulnerability into an impact because any exploitation would remain contained within the laboratory environment.
  3. The vulnerability exists, but restricted threat access and low business impact can reduce the contextual risk below the technical severity rating. (correct answer)
  4. Technical severity measures the current threat level, so environmental controls affect impact but cannot change overall risk.
Explanation: When you see a question like this, think about the difference between technical severity and contextual risk. Technical severity is a property of the vulnerability itself — how bad could exploitation be in a worst-case scenario? Risk, however, is a function of threat likelihood, vulnerability, and impact together. Environmental controls can reduce either the probability that a threat actor reaches the flaw or the consequences if they do, pulling overall risk well below the raw severity score. That's exactly what C captures. The vulnerability genuinely exists — the scanner is not wrong — but two contextual factors suppress the risk. First, network isolation and restricted management access reduce threat access, making successful exploitation far less likely. Second, no sensitive data and no operational significance mean the business impact of a successful attack is minimal. When both likelihood and impact are low, assessed risk falls below the technical severity label, which is the precise conclusion the question asks for. A is wrong because it conflates "risk" with "realized harm." A vulnerability exists the moment a flaw is present and exploitable, not only after someone is hurt. Requiring observed exploitation to confirm a vulnerability misrepresents the definition entirely. B makes a category error by claiming isolation converts the flaw into an impact. Isolation is a control that reduces likelihood and limits blast radius — it doesn't change the classification of the finding from vulnerability to impact. D gets the model backwards. Technical severity measures the inherent danger of the flaw, not the current threat level. More importantly, environmental controls absolutely affect overall risk — they're central to risk calculation. Remember: on risk-focused questions, always ask yourself whether all three components — threat, vulnerability, and impact — are being evaluated together.