Free Risk Management practice questions
10 free SY0-801 questions on Risk Management, each with a full explanation — no account needed. This section sits in the Program Management and Oversight part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A company with no formal risk program hires its first risk manager. What should she do FIRST?
You can't assess risk to something you don't know you own, so asset identification comes first and everything else depends on it. Scoring threats, buying controls and writing policy are all tempting starting points, but each needs the asset list to know what is being scored, protected or governed.
A vulnerability scan reports a CVSS 9.8 flaw on an isolated lab machine nobody depends on and a CVSS 6.5 flaw on the payment server. Which statement about the two findings is MOST accurate?
A CVSS score rates a vulnerability's technical severity and says nothing about what the affected system means to the business, so a moderate flaw on the payment server can carry more risk than a critical one on an isolated lab machine. Treating the higher CVSS score as the higher risk is the classic confusion between a vulnerability scan and a risk assessment.
A risk register entry for phishing-driven ransomware lists the messaging administrator because she runs the MFA service that protects email. Which ownership role does she hold?
The control owner runs a specific control, such as the administrator who manages MFA or the infrastructure lead who runs backups. The risk owner is the business leader accountable for the risk and its treatment, and the asset owner is accountable for an asset's classification, access and protection, so neither describes the person operating MFA.
A ransomware risk analysis lists nightly backups to a NAS joined to the same domain as the servers, yet the analyst leaves the impact rating at its highest level. Why is that rating reasonable?
A control lowers a rating only if it exists and would actually work, and a NAS reachable with a domain admin account would probably be encrypted in the same attack, so it doesn't reduce the impact. Backups are an impact control rather than a likelihood control, and planned controls don't count until they are deployed and working.
A risk manager groups the register's entries by type and notices that nine separate high risks all involve vendor remote access, which points to a broken vendor onboarding process. Which assessment activity revealed the pattern?
Categorization groups risks by type, business unit, CIA impact or level, so patterns that single scores hide become visible, such as many vendor-access risks pointing to one broken process. Scoring rates each risk on its own, and quantitative analysis puts dollar figures on individual risks rather than grouping them.
In quantitative risk analysis, what does annualized loss expectancy (ALE) represent?
ALE is the expected loss over a year, calculated as SLE multiplied by ARO. The loss from one occurrence is the single loss expectancy, the number of occurrences per year is the annualized rate of occurrence, and the share of value lost in one event is the exposure factor.
A company owns 400 laptops, and about 3 of them are stolen each month. Each theft costs $2,500 in hardware, rebuild time and lost work. What is the annualized loss expectancy for laptop theft?
Three thefts a month is an ARO of 36, so ALE = $2,500 × 36 = $90,000. $7,500 is a single month's loss, $30,000 treats the thefts as happening once a month, and $1,000,000 multiplies by the 400 laptops owned instead of the number stolen each year.
A file-server environment and the order processing that depends on it are valued at $500,000. One successful ransomware attack would cost 40 percent of that value, and the business expects such an attack about once every 5 years. What is the ALE?
SLE = $500,000 × 0.4 = $200,000, and once every 5 years is an ARO of 0.2, so ALE = $200,000 × 0.2 = $40,000. $200,000 stops at the SLE, $1,000,000 multiplies by 5 instead of using 1 ÷ 5, and $100,000 applies the ARO to the asset value without the exposure factor.
A security appliance costs $120,000 up front, is expected to last 4 years and needs $15,000 a year in support. It would cut a risk's ALE from $95,000 to $35,000. Judged on cost-benefit alone, what should the risk owner conclude?
Spread over 4 years the purchase is $30,000 a year, plus $15,000 support, so the control costs $45,000 a year and removes $95,000 − $35,000 = $60,000 of expected loss, a net gain of $15,000 a year. Comparing the purchase price with an annual ALE, or charging the whole price to the first year, mixes one-time and yearly figures.
Laptop theft and a warehouse flood each carry an ALE of about $25,000. Laptop thefts are small and frequent, while the flood is expected once in 20 years at a cost of $500,000. Why might the business treat the flood differently?
ALE averages losses over many years, so it hides that the flood arrives as a single $500,000 hit while laptop losses are small and predictable enough to absorb as a running cost. Rare, severe risks suit insurance, which turns an unpredictable large loss into a predictable premium; equal ALEs don't make two risks identical, and frequency alone doesn't make theft the larger one.
Study this section
Every lesson that covers Risk Management on the SY0-801 exam.