CSS Risk Evaluation & Threat Analysis 3 — Questions and Answers
Question 1: Which of the following best describes the concept of 'residual risk' in security management?
- The risk that exists before any controls are applied
- The risk remaining after countermeasures have been implemented (Correct answer)
- The total calculated risk across all assets
- The risk transferred to an insurance provider
Correct answer: The risk remaining after countermeasures have been implemented
Residual risk is the level of risk that remains after security controls and countermeasures have been put in place.
Question 2: A security supervisor is asked to perform a Business Impact Analysis (BIA). What is the PRIMARY purpose of this assessment?
- Identify which threats are most common in the region
- Determine how security incidents would affect critical business operations (Correct answer)
- Calculate the cost of hiring additional security staff
- Audit compliance with OSHA regulations
Correct answer: Determine how security incidents would affect critical business operations
A Business Impact Analysis identifies the effects that security incidents or disruptions would have on critical business functions and operations.
Question 3: In a threat analysis, 'frequency of occurrence' refers to:
- How often a particular asset is accessed by staff
- The likelihood that a specific threat will materialize within a given period (Correct answer)
- The number of countermeasures deployed against a threat
- The rate at which security patrols are conducted
Correct answer: The likelihood that a specific threat will materialize within a given period
Frequency of occurrence measures the probability or rate at which a particular threat event is expected to happen over a defined time period.
Question 4: A CSS candidate is reviewing a threat environment for a hospital. Which of the following would be classified as a natural hazard threat?
- An armed robbery of the pharmacy
- A tornado damaging the facility (Correct answer)
- A data breach by an external hacker
- A bomb threat called in by phone
Correct answer: A tornado damaging the facility
Natural hazards are threats arising from natural phenomena such as tornadoes, earthquakes, floods, and severe weather.
Question 5: When conducting target hardening as part of a risk mitigation strategy, a security supervisor is primarily attempting to:
- Eliminate all identified threats from the environment
- Transfer risk to a third-party security contractor
- Reduce vulnerabilities to make the target less attractive to offenders (Correct answer)
- Accept residual risk and document it formally
Correct answer: Reduce vulnerabilities to make the target less attractive to offenders
Target hardening involves implementing physical and procedural measures to reduce vulnerabilities and deter potential offenders.
Question 6: A supervisor uses crime statistics, incident reports, and police data to assess the threat environment. This process is known as:
- Asset classification
- Threat assessment (Correct answer)
- Vulnerability scanning
- Loss prevention audit
Correct answer: Threat assessment
Threat assessment involves collecting and analyzing data about potential threats, including historical crime data and incident reports, to understand the threat environment.
Question 7: Which of the following is an example of risk transference?
- Installing additional security cameras to deter theft
- Purchasing insurance to cover potential losses from security incidents (Correct answer)
- Training staff on emergency evacuation procedures
- Increasing patrol frequency in high-risk areas
Correct answer: Purchasing insurance to cover potential losses from security incidents
Risk transference shifts the financial burden of a potential loss to another party, most commonly through insurance policies.
CSS Risk Evaluation & Threat Analysis 3
Which of the following best describes the concept of 'residual risk' in security management?