MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Residual risk in cybersecurity refers to
   a. The risk fully eliminated by control measures
   b. The risk that remains after risk treatment measures are applied
   c. The inherent threat before mitigation
   d. The total impact of risk controls
   Answer: bexamradar+1​
2. The formula for calculating residual risk is
   a. Residual risk = inherent risk × control efficiency
   b. Residual risk = impact × likelihood
   c. Residual risk = inherent risk − impact of controls
   d. Residual risk = mitigated risk × tolerance
   Answer: ccentraleyes+1​
3. Residual risk is also known as
   a. Unmitigated risk
   b. True risk
   c. Acceptable risk
   d. Managed risk
   Answer: acsrc.nist+1​
4. When does residual risk exist?
   a. Only before implementing controls
   b. Only after vulnerabilities are patched
   c. After implementing all feasible controls
   d. When the system is free from flaws
   Answer: ctechtarget+1​
5. ISO/IEC 27001 views residual risk as
   a. Eliminated after full control deployment
   b. Acceptable if within limits of risk appetite
   c. Always unacceptable risk
   d. Risk ignored during audits
   Answer: bstudocu+1​
6. Which of the following types of risk can be considered residual?
   a. New system configurations
   b. Zero-day vulnerabilities
   c. Perfectly mitigated threats
   d. Eliminated threats
   Answer: bhyperproof+1​
7. Residual risk can never be
   a. Eliminated
   b. Mitigated
   c. Reassessed
   d. Controlled
   Answer: apanorays+1​
8. In the risk management process, residual risk occurs after
   a. Risk identification
   b. Risk assessment
   c. Risk treatment
   d. Risk elimination
   Answer: cstudocu+1​
9. The organization’s tolerance of residual risk determines
   a. Control efficiency
   b. Acceptable exposure level
   c. Threat elimination strategy
   d. Incident reporting method
   Answer: bcentraleyes+1​
10. Even after applying strong access controls, insider threats remain a form of
    a. Eliminated risk
    b. Residual risk
    c. Inherent risk
    d. Mitigated risk
    Answer: bsecurityscorecard+1​
11. The main reason residual risk persists is
    a. Control measures are 100% efficient
    b. All risks are mapped accurately
    c. Threats evolve faster than controls
    d. Security systems are infallible
    Answer: cbitsight+1​
12. Human error is an example of
    a. Technical control
    b. Residual risk
    c. Eliminated risk
    d. Quantitative control
    Answer: bsecurityscorecard+1​
13. Residual risk is calculated by subtracting the control impact from
    a. Risk frequency
    b. Inherent risk
    c. Tolerated risk
    d. Mitigated risk
    Answer: btechtarget+1​
14. Residual risk is assessed during which phase?
    a. Risk avoidance
    b. Risk identification
    c. Risk evaluation
    d. Risk transfer
    Answer: cstudocu+1​
15. Cloud configuration mistakes often create
    a. Accepted risk only
    b. Residual security risk
    c. Nullified risk
    d. Reversible risk
    Answer: bhyperproof+1​
16. The inherent risk level minus control efficiency provides
    a. Managed risk
    b. Residual risk
    c. Shared risk
    d. Avoided risk
    Answer: bisms+1​
17. Residual risk is sometimes called
    a. Controlled losses
    b. Remaining exposure
    c. Prevented impact
    d. Mitigation result
    Answer: bcsrc.nist+1​
18. Third-party supplier outages contribute to what form of risk?
    a. Avoided risk
    b. Inherent risk
    c. Residual risk
    d. Incurred risk
    Answer: chyperproof+1​
19. Inherent risk measures
    a. The effectiveness of controls
    b. Risk before applying mitigation
    c. Residual exposure
    d. Reassessed risk factors
    Answer: bcentraleyes+1​
20. When residual risk exceeds the organization’s tolerance level, it must be
    a. Ignored
    b. Reassessed and treated again
    c. Documented without change
    d. Outsourced entirely
    Answer: bstudocu+1​
21. Which of the following can reduce residual risk?
    a. Eliminating threat actors
    b. Implementing additional controls
    c. Ignoring audit findings
    d. Removing documentation requirements
    Answer: btechtarget+1​
22. Acceptable residual risk is determined through
    a. Incident reporting
    b. Risk appetite analysis
    c. Insurance valuation
    d. Vulnerability scanning
    Answer: bcentraleyes+1​
23. An email phishing attack that bypasses filtering shows
    a. Fully mitigated risk
    b. Residual risk
    c. Acceptable loss
    d. Avoided risk
    Answer: bpanorays+1​
24. The main goal of managing residual risk is
    a. To eliminate all threats
    b. To balance cost and risk tolerance
    c. To avoid control review
    d. To ignore unavoidable loss
    Answer: bstudocu+1​
25. Which factor cannot be fully eliminated through controls?
    a. Human behavior
    b. Encryption protocols
    c. Patch deployment
    d. Configuration tracking
    Answer: abitsight+1​
26. What guideline defines residual risk for federal cybersecurity?
    a. CNSSI 4009-2015
    b. ISO 9001
    c. IEEE 802.11
    d. SOC 2
    Answer: acsrc.nist​
27. Residual risk in cloud computing can result from
    a. Shared responsibility models
    b. User unawareness
    c. Network redundancy
    d. Zero controls
    Answer: asecurityscorecard+1​
28. Acceptable residual risk reflects the organization’s
    a. Security tolerance threshold
    b. Regulatory breach list
    c. Eliminated exposure
    d. Unlimited control range
    Answer: acentraleyes+1​
29. Insider sabotage even after monitoring illustrates
    a. Control error
    b. Residual risk
    c. Eliminated risk
    d. Rejected threat
    Answer: bhyperproof+1​
30. Risk sharing typically
    a. Transfers part of residual risk to another entity
    b. Eliminates inherent risk
    c. Increases exposure
    d. Removes compliance controls
    Answer: apanorays+1​
31. A company cannot completely eliminate residual risk because
    a. Perfect security doesn’t exist
    b. Laws forbid elimination
    c. Employees resist controls
    d. Risk assessments are unnecessary
    Answer: abitsight+1​
32. Even with strong monitoring, zero-day exploits represent
    a. Prevented vulnerabilities
    b. Residual risk
    c. Avoided attacks
    d. Negligible exposure
    Answer: bsecurityscorecard​
33. Which equation aligns with NIST guidance on risk management?
    a. Residual = Inherent − Controls
    b. Residual = Inherent + Impact
    c. Residual = Controls − Inherent
    d. Residual = Mitigation × Likelihood
    Answer: atechtarget+1​
34. What type of residual risk is caused by omitted dependencies in vendor contracts?
    a. Shared risk
    b. Vendor visibility risk
    c. Inherent risk
    d. Eliminated risk
    Answer: bsecurityscorecard​
35. In assessing residual risk, qualitative scoring involves
    a. Numeric loss calculations
    b. Impact-likelihood scales
    c. Pure cost modeling
    d. No evaluation criteria
    Answer: bcentraleyes​
36. Business continuity planning reduces but never eliminates
    a. Data residual risk
    b. Network redundancy
    c. Recovery cost
    d. Risk appetite
    Answer: apanorays+1​
37. The difference between inherent and residual risk reflects
    a. Control effectiveness
    b. Inherent threat increase
    c. Risk appetite reduction
    d. Audit findings
    Answer: atechtarget+1​
38. Residual risk assessments must be updated
    a. Never
    b. Biannually or when threats evolve
    c. Only after incidents
    d. Once every 5 years
    Answer: bhyperproof+1​
39. Cyber insurance often leaves residual exposure because
    a. Policies exclude all cyber events
    b. Not all attack types are covered
    c. Insurers guarantee total protection
    d. Insurance removes compliance needs
    Answer: bhyperproof​
40. Incident response planning addresses residual risk by
    a. Preparing containment measures
    b. Removing threat actors
    c. Eliminating human error
    d. Avoiding all attacks
    Answer: asecurityscorecard+1​
41. A low efficiency of mitigating controls will cause
    a. Higher residual risk
    b. Lower inherent risk
    c. Zero exposure
    d. Reduced incidents automatically
    Answer: atechtarget+1​
42. What is the primary threat type contributing to residual risk?
    a. External only
    b. Both external and internal factors
    c. Only environmental
    d. Regulatory risk only
    Answer: bbitsight+1​
43. Vendor management tools are used to mitigate
    a. Third-party residual risks
    b. User access errors
    c. Backup retention failures
    d. Encryption gaps
    Answer: ahyperproof​
44. Residual risk tolerance should align with
    a. Organizational goals and appetite
    b. Random benchmark tests
    c. Industry averages only
    d. Predefined fixed ratios
    Answer: astudocu+1​
45. Risk modification aims to
    a. Manage the remaining risk until acceptable
    b. Stop monitoring risks
    c. Ignore assessment findings
    d. Eliminate inherent threats
    Answer: astudocu​
46. Security awareness training reduces but cannot remove
    a. Phishing-related residual risk
    b. Patching frequency
    c. Control cost
    d. Cloud latency
    Answer: abitsight+1​
47. Accepting residual risk requires
    a. Executive sign-off and documented justification
    b. Ignoring guidelines
    c. Minimal stakeholder awareness
    d. Risk calculation omission
    Answer: acentraleyes+1​
48. Applying layered defense strategies results in
    a. Reduced residual risk exposure
    b. Full risk elimination
    c. Increased inherent threats
    d. Static vulnerabilities
    Answer: atechtarget+1​
49. Residual risk is an unavoidable element of
    a. Security strategy
    b. Regulatory penalty
    c. Fraudulent activity
    d. Legal compliance
    Answer: apanorays+1​
50. Continuous improvement frameworks emphasize
    a. Monitoring and re-evaluating residual risk periodically
    b. Avoiding additional controls
    c. Accepting uncontrolled threats
    d. Ignoring audit measurements
    Answer: astudocu+1​

1. https://examradar.com/risk-assessment-methodologies-mcqs-multiple-choice-questions-with-answer/
2. https://www.techtarget.com/searchsecurity/definition/residual-risk
3. https://www.centraleyes.com/glossary/residual-risk/
4. https://csrc.nist.gov/glossary/term/residual_risk
5. https://www.tutorialspoint.com/what-is-residual-risk-in-cybersecurity
6. https://www.isms.online/glossary/residual-risk/
7. https://www.studocu.com/in/document/charutar-vidya-mandal-university/internet-network-security/ismc-mcqs-unit-1-to-9-ism-mcq-2023/93462008
8. https://hyperproof.io/resource/residual-risk-definition/
9. https://securityscorecard.com/blog/what-is-residual-risk/
10. https://panorays.com/blog/what-is-residual-risk-how-it-guides-third-party-evaluation/
11. https://www.bitsight.com/glossary/residual-risk
12. https://www.sanfoundry.com/1000-cyber-security-questions-answers/
13. https://www.imocha.io/tests/cyber-security-risk-management-test
14. https://www.scribd.com/document/515582655/mcq-it-control
15. https://examradar.com/risk-mitigation-strategies-mcqs-multiple-choice-questions-with-answer/
16. https://www.theknowledgeacademy.com/blog/cyber-security-mcq-and-answers/
17. https://www.igmguru.com/blog/cyber-security-mcqs
18. https://www.yeahhub.com/certified-ethical-hacker-v10-multiple-choice-questions-answers-part-4/
19. https://www.verizon.com/business/resources/articles/s/what-is-residual-risk-in-cyber-security/
20. https://www.hypercomply.com/blog/inherent-risk-vs-residual-risk