CSS Risk Evaluation & Threat Analysis 2 — Questions and Answers
Question 1: A security supervisor is conducting a risk assessment for a newly opened retail store. Which step should occur FIRST in the risk evaluation process?
- Implement countermeasures
- Identify assets to be protected (Correct answer)
- Calculate annual loss expectancy
- Interview security officers
Correct answer: Identify assets to be protected
Asset identification is the foundational first step in any risk evaluation because you cannot assess threats or vulnerabilities without knowing what needs protection.
Question 2: Which formula correctly expresses the relationship used to calculate risk in security management?
- Risk = Threat × Countermeasure
- Risk = Asset Value ÷ Vulnerability
- Risk = Threat × Vulnerability × Asset Value (Correct answer)
- Risk = Probability + Impact
Correct answer: Risk = Threat × Vulnerability × Asset Value
Risk is determined by multiplying threat likelihood, vulnerability level, and the value of the asset at risk.
Question 3: A disgruntled employee who has inside knowledge of security procedures and access to restricted areas is best classified as what type of threat?
- External adversarial threat
- Natural hazard
- Insider threat (Correct answer)
- Technological threat
Correct answer: Insider threat
An insider threat involves individuals with authorized access who misuse that access to harm the organization.
Question 4: During a threat analysis, a security supervisor discovers that a competitor has been gathering intelligence on the company's operations. This is an example of which threat category?
- Corporate espionage (Correct answer)
- Cyber intrusion
- Workplace violence
- Vandalism
Correct answer: Corporate espionage
Corporate espionage involves deliberate efforts by competitors or adversaries to gather proprietary business intelligence.
Question 5: A vulnerability assessment reveals that a server room has no secondary lock on the door. In risk terminology, this lack of protection is called a:
- Threat vector
- Exposure
- Vulnerability (Correct answer)
- Hazard
Correct answer: Vulnerability
A vulnerability is a weakness or gap in security measures that could be exploited by a threat to cause harm.
Question 6: When evaluating risks using a qualitative approach, a security supervisor would most likely use which tool?
- Annual loss expectancy calculation
- Risk rating matrix with High/Medium/Low categories (Correct answer)
- Return on security investment formula
- Fault tree analysis diagram
Correct answer: Risk rating matrix with High/Medium/Low categories
Qualitative risk analysis uses descriptive scales such as High, Medium, and Low ratings rather than precise numerical calculations.
Question 7: A security supervisor observes that a parking garage has poor lighting, blind corners, and no CCTV coverage. These factors collectively increase which element of risk?
- Threat frequency
- Asset value
- Vulnerability level (Correct answer)
- Countermeasure effectiveness
Correct answer: Vulnerability level
Physical deficiencies such as poor lighting and lack of surveillance increase the vulnerability of a location to attack or crime.
CSS Risk Evaluation & Threat Analysis 2
A security supervisor is conducting a risk assessment for a newly opened retail store.
Which step should occur FIRST in the risk evaluation process?