Identifying and mitigating threats

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A threat has a HIGH risk rating and a MEDIUM threat sits beside it on the risk register. Which should the team treat first?

A The MEDIUM risk threat

B The HIGH risk threat

2. A login page has an old admin feature nobody uses, and it has a serious flaw. Removing the feature completely is which type of response?

A Eliminate

B Accept

3. Adding input validation to a form so SQL injection is much harder is which type of response?

A Transfer

B Reduce

4. A company buys cyber insurance to cover the cost of a data breach. Which response is this?

A Transfer

B Eliminate

5. A threat is rated LOW and fixing it would cost far more than the harm it could cause. What is a sensible response?

A Accept the risk and monitor it

B Spend the whole budget eliminating it

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Eliminate: remove the vulnerable feature		Acursor.execute("SELECT * FROM users WHERE id = ?", (uid,))
2Accept: log the risk and monitor it		BRemoves the threat completely, for example deleting an unused upload page that attackers could exploit
3Reduce a high-rated SQL injection threat by lowering its likelihood		CBuy cyber insurance cover for breach costs
4Transfer the financial impact of a data breach to another party		DThe priority is backwards. High risks must be treated first, while low risks are the ones most likely to be accepted.
5Risk register: Low risks fixed first, High risks accepted		EKeeps the threat as it is because its risk rating is low and the cost of treating it is higher than the harm it could cause
6Threat: stolen password. Response: Accept (no control)		FA stolen password is a likely, high-impact threat, so accepting it is the wrong choice. It needs a control such as MFA to reduce it.

Definitions

Risk treatment

Fill in the Blanks

Complete each line of code by filling in the missing parts.

threat ← "Unused debug page can be exploited" treatment ← "_________"

threat ← "Costly data breach" buyCyberInsurance() treatment ← "________"

IF rating = "Low" THEN treatment ← "______" END IF

SORT threats BY riskScore __________ FOR EACH t IN threats applyControl(t)

riskScore ← likelihood _ impact IF riskScore >= 15 THEN reduce(threat)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A threat = "SQL injection"

B rating = "High"

C if rating == "High":

D treat_first = False

Question 2

A likelihood = 1

B impact = 1

C if likelihood * impact >= 2:

D response = "Accept"

Question 3

A threat = "Server outage costs"

B action = "buy insurance"

C response = "Accept"

D print(threat, response)

Question 4

A threat = "Old admin account"

B action = "delete the account"

C removes_threat = True

D response = "Reduce"

Question 5

A threat = "Weak passwords"

B action = "enforce MFA"

C response = "Eliminate"

D print(response)

Answer Key

Identifying and mitigating threats

Section A: Quick Questions

B — The HIGH risk threat

A — Eliminate

B — Reduce

A — Transfer

A — Accept the risk and monitor it

Section B: Match the Pairs

Eliminate: remove the vulnerable feature → Removes the threat completely, for example deleting an unused upload page that attackers could exploit

Accept: log the risk and monitor it → Keeps the threat as it is because its risk rating is low and the cost of treating it is higher than the harm it could cause

Reduce a high-rated SQL injection threat by lowering its likelihood → cursor.execute("SELECT * FROM users WHERE id = ?", (uid,))

Transfer the financial impact of a data breach to another party → Buy cyber insurance cover for breach costs

Risk register: Low risks fixed first, High risks accepted → The priority is backwards. High risks must be treated first, while low risks are the ones most likely to be accepted.

Threat: stolen password. Response: Accept (no control) → A stolen password is a likely, high-impact threat, so accepting it is the wrong choice. It needs a control such as MFA to reduce it.

Section C: Definitions

Risk treatment — Matching each threat to a response chosen by its risk rating: eliminate it, reduce it, transfer it (e.g. insure) or accept it. High risks are treated first.

Section D: Fill in the Blanks

threat ← "Unused debug page can be exploited"
treatment ← "Eliminate"

threat ← "Costly data breach"
buyCyberInsurance()
treatment ← "Transfer"

IF rating = "Low" THEN
    treatment ← "Accept"
END IF

SORT threats BY riskScore DESCENDING
FOR EACH t IN threats
    applyControl(t)

riskScore ← likelihood * impact
IF riskScore >= 15 THEN reduce(threat)

Section E: Spot the Error

D — High risks must be treated first. The flag should be treat_first = True so the SQL injection threat is dealt with before lower risks.

C — Only low-rated risks should be accepted. The test should be <= 2 (a low score), not >= 2, which would let higher risks be accepted.

C — Buying insurance shifts the financial loss to another party. That is the Transfer response, not Accept.

D — Deleting the account removes the threat completely, so the response is Eliminate. Reduce only lowers the likelihood or impact.

C — MFA makes a stolen password much less useful, but the threat still exists. It lowers the risk, so the response is Reduce, not Eliminate.