Risk Management

1. A company is about to acquire a smaller competitor. The security team is asked to evaluate all IT systems, security controls, and compliance posture of the target company before the acquisition closes. Once the acquisition is complete and integration is finished, this evaluation will not be repeated. What type of risk assessment is this?

A. Recurring assessment — acquisitions should be evaluated on a quarterly basis B. One-time assessment — conducted for a specific, discrete project (the acquisition); not repeated unless another acquisition occurs C. Continuous assessment — the risk evaluation must continue indefinitely after the acquisition closes D. Ad hoc assessment — the security team was formed specifically for this evaluation and will disband after

2. A CISO returns from a threat intelligence conference where a new ransomware-as-a-service operation was discussed in detail. Concerned about the organization's specific exposure, the CISO convenes a team of security engineers and threat analysts to evaluate the organization's defenses against this specific threat. The team produces a report, presents recommendations, and then returns to their normal roles. What type of risk assessment describes this process?

A. One-time assessment — conducted once for the specific threat and not repeated B. Ad hoc assessment — convened for a specific, unplanned concern; the team forms, performs the assessment, and disbands; triggered by a specific event rather than a schedule C. Recurring assessment — threat intelligence conferences are scheduled events, making this a scheduled assessment D. Continuous assessment — threat monitoring must be ongoing to be effective

3. A payment processor is undergoing PCI DSS compliance validation. The QSA auditor requests documentation of the organization's risk assessment. The security team provides a risk assessment from 18 months ago. What does PCI DSS require regarding risk assessment frequency, and does the 18-month-old assessment satisfy this requirement?

A. PCI DSS has no specific risk assessment frequency requirement; any documented assessment satisfies the requirement regardless of age B. PCI DSS Requirement 12.3 mandates risk assessment at least annually; an 18-month-old assessment does not satisfy this requirement and the organization is likely out of compliance for this control C. PCI DSS requires quarterly risk assessments; an 18-month-old assessment is three periods overdue D. PCI DSS requires risk assessments only when a breach occurs; routine assessments are optional

4. A network engineer submits a change request to modify firewall rules, allowing a new cloud application to communicate through the corporate firewall. The change request includes implementation steps and a rollback plan, but the CCB reviewer notes that no risk assessment for the specific rule change was included. Why is a risk assessment required as part of the change control process?

A. Risk assessments are only required for changes to production databases, not firewall rules B. Every change to IT systems introduces potential new risks; the CCB cannot meaningfully evaluate a change without understanding what new attack surface, compliance gaps, or security risks that change introduces; continuous risk assessment requires evaluating risk for every significant change C. Risk assessments are not part of change control; they are separate annual activities conducted by a different team D. A rollback plan satisfies the risk assessment requirement; if the change can be reversed, no separate risk assessment is needed

5. An organization's security team runs vulnerability scans continuously, monitors SIEM alerts around the clock, subscribes to threat intelligence feeds, and requires a documented risk analysis for every change request submitted to the CCB. What type of risk assessment program does this describe?

A. Ad hoc assessment — these activities are triggered by security events rather than scheduled B. Continuous assessment — risk evaluation is integrated into ongoing operations with no defined start and end; the organization maintains current risk awareness in real time rather than through periodic snapshots C. Recurring assessment — vulnerability scans run on a scheduled basis, making this a recurring program D. One-time assessment — each vulnerability scan result is a one-time evaluation of a specific vulnerability

6. The security team conducts internal risk assessments every six months using a consistent methodology. Between assessments, they compare results to the previous period to identify trends. What advantage does this recurring approach provide that an ad hoc approach would not?

A. Recurring assessments can identify risks that ad hoc assessments cannot; ad hoc assessments are less thorough by design B. Recurring assessments with consistent methodology enable trend analysis — identifying whether the risk posture is improving or worsening over time, and measuring the effectiveness of security investments made since the last assessment C. Recurring assessments satisfy all regulatory requirements; ad hoc assessments have no regulatory value D. Recurring assessments use automated tools while ad hoc assessments must be conducted manually

Matching: Risk Assessment Types

Match each assessment type (1–4) to its correct description (A–D).

1One-time assessment

2Ad hoc assessment

3Recurring assessment

4Continuous assessment

APerformed on a defined schedule (quarterly, semi-annually, annually) using consistent methodology; enables trend analysis; mandated by PCI DSS and other regulations

BConducted for a specific project or event with defined scope; not repeated unless the same type of event recurs; examples include company acquisitions and new equipment deployments

COngoing process integrated into all operations including change control; no defined end date; maintains real-time awareness of risk posture through automated tools and per-change analysis

DTriggered by an unplanned specific concern; a team is formed for that single purpose, conducts the assessment, and disbands; not part of the regular schedule

Risk Management — Quiz