ITPEC IP April 2020 Question 37
When the evaluation values of asset value, threat, and vulnerability of assets A through D are as shown in the table, which of the following assets will be evaluated as the asset where risk measures should be taken at the highest priority? Here, the risk value is calculated by multiplying each three evaluation values together in the table without weighting.
Explanation
Asset A — its risk value, 5 × 2 × 3 = 30, is the highest of the four.
Risk value = asset value × threat × vulnerability, with no weighting:
Asset A has the largest risk value, so its risk measures come first.
Answer (a)
Why not others:
- •(b) Asset B — has the largest asset value, 6, but threat 1 and vulnerability 2 bring its risk value down to 12, the lowest of the four
- •(c) Asset C — has the highest vulnerability, 5, but its risk value is only 20
- •(d) Asset D — has the highest threat, 5, but its asset value of 1 keeps its risk value at 15
Key rule: A risk value combines all its factors, so one large factor can be outweighed by small ones; compute the product for every asset before ranking, and treat the highest first.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.