I85PREP
⌘ K
C-ACYFSW study materials
C-ACYFSW study resources

C-ACYFSW practice questions

One question at a time. Build your C-ACYFSW understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Resilience Strategy and Governance

Which document defines the organization's overall approach to managing cyber risk, including principles, roles, and risk appetite, at the highest level?

  1. The asset inventory register
  2. The cyber resilience policy Correct answer.
  3. The vulnerability scan report
  4. The incident response runbook

Explanation

A policy is the top-level governance instrument that states management's intent, principles, risk appetite, and accountability for cyber risk. Lower-level documents such as runbooks, inventories, and scan reports support execution but do not set organizational direction.

Question 2Cyber Resilience Strategy and Governance

Senior leadership formally accepting the remaining risk after controls are applied is best described as:

  1. Risk transfer
  2. Risk avoidance
  3. Risk mitigation
  4. Risk acceptance Correct answer.

Explanation

Risk acceptance is a deliberate governance decision by an accountable authority to tolerate a residual risk, usually documented with rationale and review dates. Avoidance eliminates the activity, transfer shifts financial impact, and mitigation reduces likelihood or impact through controls.

Question 3Cyber Resilience Strategy and Governance

A cyber resilience strategy aligned with business objectives primarily ensures that:

  1. Resilience investments support the organization's critical services and goals Correct answer.
  2. Security spending always exceeds industry averages
  3. Every technical control is identical across all business units
  4. Compliance certificates are renewed before their expiry dates

Explanation

Strategy alignment means resilience priorities are derived from what the business must deliver and the impact of disruption to those services. Uniform controls, spending benchmarks, and certificate renewal are tactical or comparative concerns, not alignment to business goals.

Question 4Cyber Resilience Strategy and Governance

In governance terms, the group that provides oversight of cyber risk and holds management accountable is typically the:

  1. Board of directors or a delegated board committee Correct answer.
  2. External penetration testing vendor
  3. Service desk team
  4. Change advisory board

Explanation

Ultimate accountability for cyber risk oversight rests with the board or a committee it delegates to, which sets expectations and monitors management's performance. Operational bodies and vendors execute or advise but do not carry governing accountability.

Question 5Cyber Resilience Strategy and Governance

Which term describes the maximum tolerable time a critical business process can be unavailable before unacceptable harm occurs?

  1. Recovery point objective
  2. Mean time to repair
  3. Service level target
  4. Maximum tolerable downtime Correct answer.

Explanation

Maximum tolerable downtime expresses the longest outage the business can absorb before impact becomes unacceptable, and it drives recovery requirements. Recovery point objective concerns data loss, while repair time and service targets are operational measures.

Question 6Cyber Resilience Strategy and Governance

Which practice best demonstrates a mature cyber risk appetite statement?

  1. Expressing tolerance qualitatively and quantitatively for defined risk categories Correct answer.
  2. Listing every security product the organization has purchased
  3. Stating that all risk must be eliminated before any new service launches
  4. Delegating all risk decisions to individual system administrators

Explanation

A useful appetite statement defines, in measurable and qualitative terms, how much risk the organization will accept for specific categories and who may approve exceptions. Eliminating all risk is unattainable, product lists are not appetite, and decentralized decisions without thresholds remove accountability.

Question 7Cyber Resilience Strategy and Governance

An organization requires that the security function report independently of IT operations to the chief risk officer. This structure primarily strengthens:

  1. Patch automation coverage
  2. Independent oversight and challenge Correct answer.
  3. Endpoint encryption strength
  4. Network segmentation

Explanation

Reporting lines that separate the security or resilience function from the teams it oversees preserve objectivity and enable credible challenge. Segmentation, patching, and encryption are technical controls unaffected by reporting structure.

Question 8Cyber Resilience Strategy and Governance

A regulator issues new incident notification requirements. What is the most appropriate first governance action?

  1. Ask staff to sign a new acceptable use form
  2. Purchase additional monitoring tools immediately
  3. Suspend all third-party connections until further notice
  4. Perform a gap assessment against current policy and processes Correct answer.

Explanation

New obligations should first be translated into required controls and compared with the current state so that gaps, owners, and remediation plans can be established. Tool purchases or disruptive actions taken before that analysis risk misallocating effort.

Question 9Cyber Resilience Strategy and Governance

Which metric best indicates whether resilience governance is functioning rather than merely documented?

  1. Percentage of identified resilience gaps closed within agreed remediation dates Correct answer.
  2. Frequency of password reset requests
  3. Number of pages in the policy library
  4. Count of security tools deployed across the estate

Explanation

Governance effectiveness is shown by tracked commitments being met, such as remediation completed by agreed dates with clear ownership. Document volume, tool counts, and helpdesk activity measure output or workload rather than accountability and follow-through.

Question 10Cyber Resilience Strategy and Governance

A business unit wants to adopt a cloud service that stores regulated data. Under a sound governance model, who should approve the residual risk if the service cannot meet an internal encryption standard?

  1. Any engineer with administrative access to the service
  2. The authority designated in the risk appetite framework for that risk level Correct answer.
  3. The procurement officer who negotiated the contract
  4. The cloud vendor's account manager

Explanation

Exception and acceptance authority must be pre-assigned according to risk level so that decisions are made by accountable people with proper visibility. Vendors, administrators, and procurement staff may contribute information but cannot accept enterprise risk on the organization's behalf.

Question 11Cyber Resilience Strategy and Governance

Which set of roles best reflects separation of duties in cyber resilience governance?

  1. The same manager sets policy, approves exceptions, and audits compliance
  2. All resilience duties are assigned to a single outsourced provider
  3. The incident commander also performs all forensic analysis and approves the final report
  4. One team defines requirements, another implements controls, and a third provides independent assurance Correct answer.

Explanation

Separating requirement setting, implementation, and independent assurance creates checks and balances that reduce undetected error and conflicts of interest. Combining all functions in one party, internal or external, removes independent challenge.

Question 12Cyber Resilience Strategy and Governance

An organization defines a tiered classification of its business services by disruption impact. What is the primary governance purpose of this classification?

  1. To select the programming language for new applications
  2. To decide which employees receive larger bonuses
  3. To rank vendors by contract value
  4. To determine which services justify prioritized resilience investment and testing Correct answer.

Explanation

Impact tiering lets leadership direct limited resources and testing rigor toward the services whose failure would harm the organization most. It is not a compensation, procurement ranking, or technology selection mechanism.

Question 13Cyber Resilience Strategy and Governance

A resilience program reports strong control coverage but has never tested recovery of its most critical service. What governance conclusion is most defensible?

  1. The program is fully mature because controls are documented
  2. Recovery capability is guaranteed by vendor contracts
  3. Assurance is incomplete because untested recovery capability is an unverified assumption Correct answer.
  4. Testing is unnecessary when controls are certified

Explanation

Documented controls show intent, not proven capability; recovery must be exercised to confirm that plans, dependencies, and people work under stress. Certification and contracts support but cannot substitute for validating the organization's own response.

Question 14Cyber Resilience Strategy and Governance

Which statement best describes the relationship between a cyber resilience framework and a control catalogue?

  1. They are identical documents maintained by the same owner
  2. The catalogue sets strategy; the framework lists products to purchase
  3. The framework sets outcomes and principles; the catalogue lists specific controls that may achieve them Correct answer.
  4. The framework replaces the need for any control documentation

Explanation

A framework articulates desired outcomes and governance principles, while a control catalogue provides the granular safeguards mapped to those outcomes. The two are complementary layers, not substitutes or duplicates.

Question 15Cyber Resilience Strategy and Governance

Leadership asks how resilience spending compares with the potential cost of outages. Which analysis most directly answers this?

  1. A staff training attendance record
  2. A penetration test summary
  3. An asset depreciation schedule
  4. A cost-benefit analysis comparing investment with expected loss reduction Correct answer.

Explanation

Comparing the cost of resilience measures against the expected reduction in outage losses frames spending in risk-adjusted economic terms. Technical test results, accounting schedules, and attendance data do not quantify avoided loss.

Question 16Cyber Resilience Strategy and Governance

An organization outsources a critical payment platform to a provider. Which governance arrangement best preserves accountability?

  1. Relying on the provider's self-reported assurance with no internal review
  2. Removing the service from the business impact assessment
  3. Transferring all accountability for outages to the provider
  4. Defining contractual resilience requirements and retaining internal oversight of provider performance Correct answer.

Explanation

Outsourcing transfers execution but not accountability, so the organization must specify resilience requirements contractually and monitor performance itself. Blind reliance, full delegation of accountability, and excluding the service from impact analysis all leave the organization exposed.

Question 17Cyber Resilience Strategy and Governance

Which approach best embeds cyber resilience into an organization's culture?

  1. Publishing the policy on the intranet and taking no further action
  2. Relying solely on automated technical controls
  3. Visible leadership sponsorship, role-based training, and reinforcement in everyday processes Correct answer.
  4. Annual one-time awareness sessions with no follow-up

Explanation

Culture changes when leaders visibly sponsor resilience, training is tailored to roles, and expected behaviors are reinforced in routine workflows. One-off sessions, passive publication, and pure automation do not build shared responsibility.

Question 18Cyber Resilience Strategy and Governance

A board receives a dashboard showing only the count of security incidents. Why is this insufficient for resilience oversight?

  1. Boards are not permitted to view incident data
  2. Volume alone omits severity, impact, recovery performance, and trend context Correct answer.
  3. Dashboards should show only financial metrics
  4. Incident counts are always inaccurate

Explanation

Effective oversight requires context such as severity distribution, business impact, recovery times, and trends against targets. A raw count can rise or fall for reasons unrelated to resilience and cannot support informed challenge.

Question 19Cyber Resilience Strategy and Governance

Two business units apply different recovery objectives to the same shared platform. What governance mechanism best resolves this conflict?

  1. Escalate to the platform owner and risk committee to agree a target based on the highest justified business need Correct answer.
  2. Let each unit set independent targets for the shared platform
  3. Defer the decision indefinitely until an incident occurs
  4. Adopt the lowest objective to minimize cost without discussion

Explanation

Shared dependencies require a single agreed objective reconciled through accountable ownership and governance, typically driven by the most demanding justified requirement. Independent targets, unilateral cost minimization, and indefinite deferral create untested assumptions and conflict.

Question 20Cyber Resilience Strategy and Governance

An organization adopts a recognized resilience framework but claims full compliance while omitting several core outcomes. What is the most significant governance risk?

  1. The framework may be superseded by a newer version
  2. Staff may need additional training on framework terminology
  3. False assurance leading to misallocated investment and undetected exposure Correct answer.
  4. The framework license may be invalidated

Explanation

Partial adoption presented as full compliance creates false assurance, so leadership funds the wrong areas and real exposures remain unmanaged. Licensing, terminology, and version currency are minor compared with the integrity of assurance reporting.

Question 21Cyber Resilience Strategy and Governance

A merger brings two organizations with conflicting risk appetites into one entity. What sequence best establishes coherent governance?

  1. Assess both appetites and critical services, agree a unified appetite with leadership, then harmonize policies and controls Correct answer.
  2. Immediately impose the larger organization's appetite without assessment
  3. Suspend all resilience activities until systems are fully integrated
  4. Maintain both appetites indefinitely to avoid conflict

Explanation

Coherent governance after a merger requires understanding both risk positions and critical services before leadership agrees a unified appetite that drives policy and control harmonization. Imposition without assessment, permanent duality, and pausing resilience all create unmanaged risk.

Question 22Cyber Resilience Strategy and Governance

Which statement correctly distinguishes accountability from responsibility in resilience governance?

  1. Accountability cannot be delegated and rests with a named senior owner, while responsibility for tasks can be Correct answer.
  2. Accountability can be delegated to any competent engineer
  3. Responsibility and accountability are interchangeable terms
  4. Responsibility always sits with the board while accountability sits with operators

Explanation

Accountability is the non-delegable answerability of a named senior owner for an outcome, whereas responsibility covers the tasks that may be assigned to many people. Confusing the two blurs escalation and decision rights.

Question 23Cyber Resilience Strategy and Governance

What is the primary purpose of a cyber resilience policy exception process?

  1. To allow unlimited permanent deviation from standards
  2. To transfer all liability to the individual requester
  3. To eliminate the need for periodic policy review
  4. To document, justify, time-bound, and approve deviations with compensating controls Correct answer.

Explanation

Exceptions provide controlled, time-limited approval of justified deviations, with compensating measures and review so risk remains visible and managed. Unlimited or permanent deviation, liability shifting, and avoiding review defeat the purpose.

Question 24Cyber Resilience Strategy and Governance

Which activity is a governance responsibility rather than an operational one?

  1. Restoring data from backup after a failure
  2. Configuring firewall rules for a new application
  3. Approving the enterprise risk appetite and monitoring residual risk Correct answer.
  4. Applying the latest operating system patch to a server

Explanation

Setting risk appetite and monitoring residual risk are direction-setting and oversight activities reserved for governing bodies. Patching, firewall configuration, and restoration are execution tasks performed by operational teams.

Question 25Cyber Resilience Strategy and Governance

An organization wants assurance that its resilience program meets legal obligations. Which evidence is most appropriate?

  1. A list of security products currently deployed
  2. A vendor marketing brochure describing compliance features
  3. An internal team's verbal assurance during a meeting
  4. An independent audit report mapped to the applicable regulations Correct answer.

Explanation

Independent audit evidence mapped to specific regulatory requirements provides credible, traceable assurance for governing bodies and regulators. Marketing material, verbal claims, and product lists lack independence and traceability to obligations.

Question 26Cyber Resilience Strategy and Governance

Which artifact formally authorizes a cyber resilience program and grants its leader the authority to allocate resources across business units?

  1. An approved program charter with executive sponsorship Correct answer.
  2. An incident post-mortem report
  3. A vendor security assessment questionnaire
  4. A project risk register entry

Explanation

A program charter is the governance instrument that documents mandate, scope, executive sponsorship, and delegated authority, which is what allows a resilience leader to commit resources across organizational boundaries. Other artifacts support execution or assurance but do not confer authority.

Question 27Cyber Resilience Strategy and Governance

An organization sets a target that its most critical services will be restored within four hours of a major disruption. Which governance element does this target represent?

  1. A residual risk score
  2. A control test result
  3. A service level agreement
  4. A recovery time objective Correct answer.

Explanation

A recovery time objective defines the maximum tolerable duration of disruption for a service and is set through governance because it expresses how much outage impact the organization is willing to accept. It is a target, not a measurement or a contractual commitment to a customer.

Question 28Cyber Resilience Strategy and Governance

A resilience steering committee meets quarterly but decisions stall because no single member can commit funding between meetings. Which governance change most directly addresses this?

  1. Increase the meeting frequency to monthly
  2. Delegate a defined approval threshold to a named executive Correct answer.
  3. Add more business unit representatives to the committee
  4. Publish committee minutes to the whole organization

Explanation

Decision latency in governance usually reflects unclear delegated authority rather than insufficient meeting cadence. Assigning a named executive a defined spending and approval threshold lets routine resilience decisions proceed while preserving committee oversight of larger commitments.

Question 29Cyber Resilience Strategy and Governance

A resilience program's objectives were written three years ago and still reference a service the organization retired. Leadership wants objectives that stay relevant as the business changes. Which governance practice best achieves this?

  1. Let each team set its own objectives independently
  2. Replace objectives with a list of technical controls
  3. Freeze objectives until the next regulatory review cycle
  4. Tie objectives to a periodic refresh triggered by major business change Correct answer.

Explanation

Resilience objectives remain meaningful only if they are reviewed on a defined cycle and whenever significant change occurs, such as service retirement, mergers, or new dependencies. A change-triggered refresh keeps objectives aligned with the current service landscape and impact tolerances.

Question 30Cyber Resilience Strategy and Governance

A board wants assurance that resilience decisions reflect the organization's stated tolerance for disruption rather than the preferences of individual executives. Which governance arrangement provides the strongest evidence of this?

  1. Documented decision criteria mapped to impact tolerances, with recorded rationale for each major resilience decision Correct answer.
  2. A dashboard counting the number of resilience meetings held per quarter
  3. Annual attestation by each executive that they support the resilience strategy
  4. Assignment of all resilience decisions to the technology function

Explanation

Assurance that decisions reflect stated tolerances requires traceability: predefined criteria derived from impact tolerances plus a recorded rationale showing how each significant decision was tested against them. This allows an independent reviewer to verify consistency rather than relying on assertions of support.

Question 31Risk Management and Threat Assessment

Which statement best describes the purpose of a risk assessment within an aviation security program?

  1. It replaces the need for regulatory compliance inspections.
  2. It documents employee attendance at security awareness training.
  3. It guarantees that no security incident can occur at a protected facility.
  4. It identifies, evaluates, and prioritizes threats and vulnerabilities so resources can be applied where risk is greatest. Correct answer.

Explanation

Risk assessment is a structured process that identifies threats and vulnerabilities, evaluates the likelihood and consequence of exploitation, and ranks risks so mitigation resources go where they reduce risk most. It informs decision-making but cannot eliminate risk entirely.

Question 32Risk Management and Threat Assessment

In the risk equation commonly used in security management, risk is generally expressed as which combination?

  1. Regulation multiplied by inspection multiplied by audit
  2. Budget multiplied by staffing multiplied by schedule
  3. Threat multiplied by vulnerability multiplied by consequence Correct answer.
  4. Training multiplied by drills multiplied by reporting

Explanation

Security risk is typically modeled as a function of threat, vulnerability, and consequence, so that a high threat against a highly vulnerable asset with severe consequences produces the highest risk. Management then targets the factors it can influence, chiefly vulnerability and consequence.

Question 33Risk Management and Threat Assessment

Which of the following is the clearest example of a vulnerability rather than a threat?

  1. A published advisory about a regional campaign
  2. An increase in attempted breaches worldwide
  3. An unlocked service door leading to the apron Correct answer.
  4. A known extremist group targeting aviation

Explanation

A vulnerability is a weakness or condition in the system that a threat could exploit, such as an unsecured door. Threats are actors or events with the intent and capability to cause harm, so adversary groups and advisories about them are threat information.

Question 34Risk Management and Threat Assessment

A security manager is deciding how to treat a risk that has been evaluated as low likelihood but catastrophic consequence. Which treatment approach is most appropriate?

  1. Reduce the consequence through layered mitigation even though likelihood is low Correct answer.
  2. Ignore the risk until an incident actually occurs
  3. Transfer the entire risk to the regulator
  4. Accept the risk without further action because likelihood is low

Explanation

Risk is a product of likelihood and consequence, so a low-likelihood event with catastrophic consequences can still rank high and warrants mitigation that limits severity. Layered controls such as redundancy and response planning reduce consequence even when prevention is difficult.

Question 35Risk Management and Threat Assessment

What is the primary role of an insider threat program in aviation security risk management?

  1. Replacing background checks with continuous video surveillance
  2. Detecting and mitigating risks posed by individuals with authorized access who may misuse it Correct answer.
  3. Ensuring that contractors are paid on schedule
  4. Eliminating the need for access control badges

Explanation

Insider threat programs focus on people who already hold authorized access and could exploit it to cause harm, using reporting mechanisms, behavioral indicators, and access controls. They complement, rather than replace, vetting and physical security measures.

Question 36Risk Management and Threat Assessment

A risk matrix used in an airport security assessment typically plots which two dimensions?

  1. Cost and schedule
  2. Likelihood and consequence Correct answer.
  3. Staffing level and training hours
  4. Regulation number and audit date

Explanation

A risk matrix displays likelihood on one axis and consequence or severity on the other, allowing risks to be ranked into tiers such as low, medium, and high. This visual ranking supports consistent prioritization across different types of risk.

Question 37Risk Management and Threat Assessment

Which intelligence attribute most directly affects how a threat warning should be acted upon?

  1. The seniority of the person who forwarded it
  2. The length of the written report
  3. The color scheme of the briefing slides
  4. The credibility and specificity of the source information Correct answer.

Explanation

Decision-makers weigh threat information by its credibility, reliability, and specificity, since vague or unverified reporting may justify monitoring rather than immediate action. Source reliability and corroboration are central to intelligence assessment.

Question 38Risk Management and Threat Assessment

What distinguishes a threat assessment from a vulnerability assessment?

  1. A threat assessment focuses on finances, while a vulnerability assessment focuses on staffing.
  2. A threat assessment examines actors and their intent and capability, while a vulnerability assessment examines weaknesses in protective measures. Correct answer.
  3. A threat assessment is performed only by regulators, while a vulnerability assessment is performed only by airlines.
  4. A threat assessment is a one-time event, while a vulnerability assessment is continuous.

Explanation

Threat assessment characterizes adversaries, their intent, capability, and historical patterns, while vulnerability assessment examines how exposed an asset is given existing controls. The two are complementary inputs to the overall risk picture.

Question 39Risk Management and Threat Assessment

In risk management terminology, what does 'risk appetite' mean for an aviation organization?

  1. The amount and type of risk the organization is willing to accept in pursuit of its objectives Correct answer.
  2. The maximum number of passengers allowed in a terminal
  3. The budget allocated to security technology purchases
  4. The frequency with which drills must be conducted

Explanation

Risk appetite expresses the level of risk leadership is prepared to tolerate, which guides decisions about accepting, reducing, or transferring risk. It is a governance statement, not an operational capacity limit or budget figure.

Question 40Risk Management and Threat Assessment

A screening checkpoint has a single detection technology with a known failure rate. Which risk reduction strategy best addresses this single point of failure?

  1. Removing the technology and relying on random pat-downs
  2. Adding an independent layer of detection so both would have to fail Correct answer.
  3. Increasing the throughput target for the checkpoint
  4. Reducing staff training hours to save budget

Explanation

Layered, independent controls reduce the probability that a single failure results in a successful breach, because an adversary must defeat multiple barriers. Removing technology or cutting training weakens the control environment rather than strengthening it.

Question 41Risk Management and Threat Assessment

Why is consequence analysis an essential part of aviation security risk assessment?

  1. It eliminates the need to evaluate likelihood at all.
  2. It proves that an attack will occur within a specific timeframe.
  3. It determines the exact insurance payout after an incident.
  4. It estimates the severity of harm so that high-impact scenarios receive proportionate attention even when likelihood is uncertain. Correct answer.

Explanation

Consequence analysis estimates the potential harm to people, assets, operations, and reputation, allowing severe scenarios to be prioritized even when probability estimates are uncertain. It complements likelihood analysis rather than replacing it.

Question 42Risk Management and Threat Assessment

Which factor most strongly increases the likelihood component of risk at a crowded terminal curb?

  1. The publication of a terminal map online
  2. The use of energy-efficient lighting in the lobby
  3. The presence of decorative plants near the entrance
  4. A high volume of uncontrolled persons and vehicles in close proximity Correct answer.

Explanation

Crowded, uncontrolled areas where people and vehicles converge present attractive targets and increase the probability that an adversary can act with effect. The other factors may be relevant in specific contexts but do not inherently raise likelihood as directly.

Question 43Risk Management and Threat Assessment

What is the main purpose of conducting periodic risk reassessments after initial mitigation is in place?

  1. To satisfy a one-time documentation requirement
  2. To account for changes in threat, operations, and control effectiveness that alter the residual risk Correct answer.
  3. To confirm that the original assessment was flawless
  4. To reduce the number of staff assigned to security

Explanation

Threats, operational footprints, and the performance of controls change over time, so reassessment keeps the risk picture current and reveals whether residual risk remains tolerable. It is a continuous improvement activity, not a validation of past perfection.

Question 44Risk Management and Threat Assessment

A new concession opens in a sterile area and introduces deliveries by outside vendors. Which risk consideration should the security manager evaluate first?

  1. Whether the vendor's branding complies with terminal design standards
  2. Whether the concession will increase rental revenue
  3. How the new delivery flow affects access control and screening of goods entering the sterile area Correct answer.
  4. Whether the concession's menu meets passenger demand

Explanation

New supply chains crossing a security boundary create potential pathways for prohibited items or unauthorized access, so access control and goods screening must be evaluated. Commercial and aesthetic considerations are secondary to security risk.

Question 45Risk Management and Threat Assessment

Which of the following best illustrates the concept of residual risk?

  1. The risk that existed before any controls were designed
  2. The risk that is transferred entirely to an insurance provider
  3. The total budget set aside for security equipment
  4. The risk that remains after existing controls have been applied Correct answer.

Explanation

Residual risk is what remains once mitigation measures are in place and is compared with the organization's risk appetite to decide whether further action is needed. Inherent risk, by contrast, is the level before controls are applied.

Question 46Risk Management and Threat Assessment

A threat report describes a general capability with no specific target, timing, or method. What is the most defensible analytic response?

  1. Immediately close the airport until the source is identified
  2. Publicly announce the report to deter the adversary
  3. Disregard it entirely because it lacks specifics
  4. Treat it as low-specificity intelligence and use it to inform general awareness and monitoring Correct answer.

Explanation

Intelligence lacking specificity still has value for situational awareness and may warrant enhanced monitoring, but it rarely justifies drastic operational action on its own. Analysts weigh credibility and specificity together before recommending costly measures.

Question 47Risk Management and Threat Assessment

Which statement correctly describes the relationship between threat, vulnerability, and risk?

  1. Risk falls to zero whenever any single control is installed.
  2. Risk is determined solely by the threat level regardless of protective measures.
  3. Risk can be high even when threat is moderate if vulnerability and consequence are high. Correct answer.
  4. Vulnerability has no effect on risk once a threat has been identified.

Explanation

Risk responds to all three components, so a moderate threat combined with high vulnerability and severe consequence can still produce high risk. Effective controls reduce vulnerability and therefore lower overall risk without changing the threat itself.

Question 48Risk Management and Threat Assessment

What is the primary benefit of using a standardized risk scoring scale across an aviation organization?

  1. It removes the need for professional judgment in decisions
  2. It enables consistent comparison and prioritization of diverse risks Correct answer.
  3. It eliminates the requirement for documentation
  4. It guarantees that all risks will be eliminated

Explanation

A common scoring scale lets managers compare dissimilar risks on the same footing and allocate resources consistently. Judgment and documentation remain essential; standardization supports rather than replaces them.

Question 49Risk Management and Threat Assessment

During a tabletop exercise, participants identify that a contingency plan assumes police will arrive within five minutes, but actual response time is twenty minutes. What risk management action does this reveal?

  1. A legal issue that is outside security's scope
  2. A financial risk that should be transferred to insurers
  3. A planning assumption that creates unmitigated exposure during the response gap Correct answer.
  4. A training deficiency that can be solved by adding more slides

Explanation

The exercise exposes a gap between assumed and actual response capability, meaning the facility must survive a longer period without external assistance. Mitigation may include hardening, on-site response capability, or revised procedures to cover the gap.

Question 50Risk Management and Threat Assessment

Which of the following best describes a 'target attractiveness' factor in threat assessment?

  1. The age of the terminal building's HVAC system
  2. The market value of the real estate on which the airport sits
  3. Characteristics such as symbolic value, crowding, and expected media impact that make an asset appealing to an adversary Correct answer.
  4. The number of retail outlets in the terminal

Explanation

Adversaries select targets based on perceived symbolic value, likelihood of success, expected casualties, and publicity potential, which together define attractiveness. Physical or commercial attributes are relevant only insofar as they affect security or impact.