CompTIA Security+ Certification Exam SY0-701 Practice Test 23

What is the estimate of how often a threat successfully exploits a vulnerability?

• ALE

• SLA

• ARO

• SLE

Answer explanation

ARO, or Annual Rate of Occurrence, estimates how often a threat successfully exploits a vulnerability. It helps organizations understand the frequency of potential incidents, making it the correct choice for this question.

If an asset is valued at $10,000 and the Exposure Factor (EF) is 20%, what is the Single Loss Expectancy (SLE)?

• $500

• $2,000

• $5,000

• $10,000

Answer explanation

To calculate the Single Loss Expectancy (SLE), multiply the asset value by the Exposure Factor (EF). Here, SLE = $10,000 * 20% = $2,000. Thus, the correct answer is $2,000.

Which document is used to identify, assess, and track risks?

• Risk heat map

• Risk matrix

• Risk register

• Risk repository

Answer explanation

The risk register is a key document used to identify, assess, and track risks throughout a project. It provides a comprehensive overview of all identified risks, their assessments, and the actions taken to manage them.

Which term describes the specific level of risk an organization is willing to tolerate?

• Risk appetite

• Risk tolerance

• Risk acceptance

• Risk capacity

Answer explanation

Risk tolerance specifically refers to the level of risk an organization is willing to accept in pursuit of its objectives. It defines the boundaries within which risk management decisions are made.

Which term reflects an organization’s general attitude towards taking risks?

• Risk strategy

• Risk control

• Risk appetite

• Risk tolerance

Answer explanation

The term 'risk appetite' reflects an organization’s general attitude towards taking risks, indicating the level of risk it is willing to accept in pursuit of its objectives.

What is it called when a company outsources tasks due to lack of internal expertise?

• Risk deterrence

• Risk avoidance

• Risk acceptance

• Risk transference

Answer explanation

When a company lacks internal expertise, it may outsource tasks to manage that risk. This is known as risk transference, as the responsibility is shifted to an external party.

Cybersecurity insurance is an example of which risk strategy?

• Risk avoidance

• Risk deterrence

• Risk transference

• Risk acceptance

Answer explanation

Cybersecurity insurance is a form of risk transference, as it allows organizations to transfer the financial burden of potential cyber incidents to an insurance provider, rather than bearing the risk themselves.

Choosing not to apply certain controls for a known risk is referred to as:

• Exception

• Evasion

• Exemption

• Exclusion

Answer explanation

Choosing not to apply certain controls for a known risk is called an 'exemption.' This term indicates that an organization has decided to forgo specific measures despite being aware of the associated risks.

Temporarily not complying with a standard due to a risk scenario is called:

• Exclusion

• Exception

• Evasion

• Exemption

Answer explanation

Temporarily not complying with a standard due to a risk scenario is referred to as an 'Exception'. This term indicates a deviation from the norm under specific circumstances, distinguishing it from terms like 'Exemption' or 'Evasion'.

Disabling systems to avoid risk is an example of:

• Risk acceptance

• Risk avoidance

• Risk transference

• Risk deterrence

Answer explanation

Disabling systems to avoid risk is an example of risk avoidance, as it involves taking proactive measures to eliminate potential threats rather than accepting or transferring the risk.