2 Threats, Risk, and Security Governance Online Quiz Questions

A team finds that a public-facing application has not received security updates, creating a weakness an attacker could exploit. What has the team identified?

A team uses low, medium, and high ratings for likelihood and impact. These ratings are estimates, not precise measurements.

An organization needs a document that gives staff step-by-step instructions for disabling an account when a person leaves. Which type of document should it use?

After an organization applies controls to a risk, what is the remaining exposure called?

An organization buys insurance for a risk. This may allocate some consequences, but the organization should not assume that it has eliminated all responsibility. True or false?

What risk response means knowingly retaining a risk with approval from an appropriate decision-maker?

A business decides to stop offering a service because it creates an unacceptable security risk. Which risk response is this?

A team is gathering information to identify important assets and plausible security scenarios. Which sources listed can help inform its analysis? Select all correct choices.

A public-facing application has an unpatched weakness that could expose customer records. Explain how the organization should assess this risk, document the assessment, decide what to do, and follow up after taking action.

A cybersecurity framework can guide an organization’s risk decisions without prescribing one identical solution for every organization.

An audit finds that staff misunderstand a security policy and that a related control is not working as intended. What is the most appropriate governance response?

An attacker tries to steal credentials from a company employee. Which part of this scenario is the threat event?

A company wants to restore a critical service after a power failure. Which security objective do tested backups most directly support?

An organization decides to discontinue an activity because it creates a risk the organization does not want to retain. Which risk response is this?

A security team has limited time to investigate potential weaknesses. Which approach best aligns with sound threat and vulnerability analysis?

An organization adds safeguards to reduce the chance or impact of harm, but some exposure remains. What is this remaining exposure called?

A security team needs a record for tracking significant risks, their owners, planned responses, due dates, and review status. What is this record commonly called?

An organization’s security initiatives are chosen by technical teams without clear leadership priorities, assigned decision authority, or review of how the work supports business objectives. Which leadership actions would address these governance gaps? Select all that apply.