I85PREP
⌘ K
CDRP study materials
CDRP study resources

CDRP practice questions

One question at a time. Build your CDRP understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber-risk identification and analysis

According to the ISO 31000 standard, how is 'risk' formally defined?

  1. The probability of a physical equipment hardware breakdown
  2. The effect of uncertainty on organizational objectives Correct answer.
  3. The financial loss resulting from an unplanned data centre power outage
  4. The product of threat severity and vulnerability frequency

Explanation

ISO 31000 defines risk as the 'effect of uncertainty on objectives'. An effect is a deviation from the expected, which can be positive, negative, or both. Objectives can have different aspects and levels, such as financial, health and safety, and environmental goals across data centre operations.

Question 2Cyber-risk identification and analysis

Which ISO 31000 risk management principle emphasizes that risk management must be tailored to the organization's external and internal context?

  1. Structured and comprehensive
  2. Customized Correct answer.
  3. Dynamic and reactive
  4. Human and cultural factors

Explanation

ISO 31000 specifies that risk management must be 'Customized'. The risk management framework and process are tailored and proportionate to the organization's external and internal context related to its objectives, including specific data centre site conditions and business requirements.

Question 3Cyber-risk identification and analysis

What is the primary relationship between ISO/IEC 27005 and ISO/IEC 27001 in an information security and data centre environment?

  1. ISO/IEC 27005 provides physical building construction codes required by ISO/IEC 27001
  2. ISO/IEC 27005 offers detailed guidance on implementing information security risk management in line with ISO/IEC 27001 requirements Correct answer.
  3. ISO/IEC 27005 replaces ISO/IEC 27001 for all cloud data centre facilities
  4. ISO/IEC 27005 is a certifiable standard for electrical grounding systems

Explanation

ISO/IEC 27005 provides guidelines for information security risk management. It supports the general concepts specified in ISO/IEC 27001 and is designed to assist the satisfactory implementation of information security risk assessments required by an Information Security Management System (ISMS).

Question 4Cyber-risk identification and analysis

In a data centre risk governance context, how does 'Risk Appetite' differ from 'Risk Tolerance'?

  1. Risk Appetite is the total financial budget for risk controls, while Risk Tolerance is the cost of insurance
  2. Risk Appetite is the broad amount and type of risk an organization is willing to pursue or accept, while Risk Tolerance is the maximum acceptable deviation from specific objectives Correct answer.
  3. Risk Appetite applies only to physical security, while Risk Tolerance applies only to electrical power
  4. Risk Appetite is defined by external regulators, while Risk Tolerance is set by facility maintenance staff

Explanation

Risk Appetite reflects an organization's high-level strategy regarding the types and degree of risk it is prepared to accept in pursuit of business value. Risk Tolerance is the tactical, measurable boundary or maximum acceptable variance around specific performance targets (such as allowable downtime minutes per year).

Question 5Cyber-risk identification and analysis

Which element forms the core pivot of the ISO 31000 risk management framework structure around which all framework components operate?

  1. Third-party external auditing
  2. Leadership and commitment Correct answer.
  3. Automated facility management software
  4. Quarterly insurance policy renewal

Explanation

In ISO 31000, 'Leadership and commitment' is the central core component of the risk management framework. Top management and oversight bodies must ensure that risk management is integrated into all organizational activities and demonstrate leadership through policy endorsement, resource allocation, and accountability assignment.

Question 6Cyber-risk identification and analysis

When establishing the internal context during a data centre risk assessment under ISO 31000, which factor must be evaluated?

  1. Local municipal seismic hazard zones and regional flood histories
  2. National power grid transmission reliability regulations
  3. Organizational culture, internal governance, contractual relationships, and existing infrastructure assets Correct answer.
  4. International trade tariffs on diesel fuel imports

Explanation

Establishing the internal context involves understanding the organization's internal environment, including its governance, organizational structure, roles, policies, culture, capabilities, information systems, contractual commitments, and existing physical infrastructure assets.

Question 7Cyber-risk identification and analysis

How are the three main structural components of ISO 31000 organized?

  1. Policies, Procedures, and Work Instructions
  2. Principles, Framework, and Process Correct answer.
  3. Identification, Assessment, and Mitigation
  4. Plan, Do, and Check

Explanation

ISO 31000 is structured into three main components: Principles (the fundamental philosophy and values of risk management), Framework (the governance structure and arrangements for integrating risk management), and Process (the systematic application of policies, procedures, and practices to assessing and treating risk).

Question 8Cyber-risk identification and analysis

What is the primary responsibility of the Data Centre Risk Management Committee?

  1. Performing daily maintenance on generator fuel injectors
  2. Approving the risk management policy, setting risk appetite, and reviewing top residual risks Correct answer.
  3. Writing source code for custom facility monitoring scripts
  4. Inspecting incoming server rack shipments at the loading dock

Explanation

The Risk Management Committee is a governance body responsible for oversight. Its main duties include approving the risk management policy, defining risk appetite and tolerance thresholds, ensuring adequate resources, and reviewing key residual risks that exceed target limits across the data centre facility.

Question 9Cyber-risk identification and analysis

Under ISO/IEC 27005, which three distinct sequential activities comprise the 'Risk Assessment' phase?

  1. Risk Planning, Risk Execution, and Risk Sign-off
  2. Risk Identification, Risk Analysis, and Risk Evaluation Correct answer.
  3. Risk Avoidance, Risk Mitigation, and Risk Transfer
  4. Risk Inspection, Risk Audit, and Risk Certification

Explanation

In ISO/IEC 27005 (and ISO 31000), Risk Assessment is defined as the overall process consisting of three steps: 1) Risk Identification (finding threats, vulnerabilities, assets, and impacts), 2) Risk Analysis (comprehending the nature and level of risk), and 3) Risk Evaluation (comparing risk analysis results with risk criteria to determine acceptability).

Question 10Cyber-risk identification and analysis

How should an organization integrate ISO 31000 risk management guidelines with data centre facility standards such as ANSI/TIA-942 or Uptime Institute Tiers?

  1. ISO 31000 should replace TIA-942 electrical distribution design standards completely
  2. ISO 31000 provides the overarching risk governance process to evaluate and prioritize residual risks remaining in the chosen TIA-942 or Tier topology Correct answer.
  3. TIA-942 standards prohibit the use of ISO 31000 risk management frameworks
  4. Uptime Institute Tiers eliminate all need for risk management because Tier IV guarantees zero failure

Explanation

Facility standards (ANSI/TIA-942, Uptime Tiers) define physical, electrical, and mechanical design topologies and availability expectations. ISO 31000 provides the risk governance and assessment framework to identify, evaluate, and manage residual operational, environmental, and human risks that persist regardless of the underlying facility rating.

Question 11Cyber-risk identification and analysis

During risk evaluation under ISO 31000, what is the outcome of comparing analyzed risk levels against established risk criteria?

  1. Automatic purchase of emergency diesel generators
  2. A decision on whether specific risks are acceptable, tolerable, or require risk treatment Correct answer.
  3. Immediate termination of all third-party maintenance contracts
  4. Recalibration of facility temperature and humidity sensors

Explanation

Risk evaluation compares the estimated risk levels found during risk analysis with the risk criteria defined during context establishment. The purpose is to make decisions about which risks require treatment, their prioritization, and whether existing controls are sufficient.

Question 12Cyber-risk identification and analysis

Why is 'Communication and Consultation' depicted as a continuous activity supporting all phases of the ISO 31000 risk management process?

  1. To comply with weekly public marketing press release requirements
  2. To ensure stakeholders understand risk factors, provide relevant input, and support risk treatment decisions Correct answer.
  3. Because ISO 31000 requires daily mandatory meetings for all data centre technicians
  4. To negotiate lower electricity utility tariffs with local power companies

Explanation

Communication and consultation take place at every stage of the risk management process. Engaging internal and external stakeholders ensures that their perceptions of risk are understood, their expertise is incorporated into context and analysis, and their buy-in is secured for treatment plans.

Question 13Cyber-risk identification and analysis

What is 'Residual Risk' in a data centre risk assessment?

  1. The initial unmitigated risk present before any controls are considered
  2. The risk remaining after risk treatment options and controls have been implemented Correct answer.
  3. The financial penalty imposed by customers when SLAs are breached
  4. The risk associated exclusively with decommissioned IT hardware

Explanation

Residual risk is the risk remaining after risk treatment controls have been selected and implemented. No control completely eliminates risk; residual risk must be monitored and evaluated to verify it falls within the organization's risk tolerance.

Question 14Cyber-risk identification and analysis

When applying ISO/IEC 27005 to data centre physical security, how should environmental threats (such as local river flooding) be categorized?

  1. As software vulnerabilities
  2. As non-human / physical environmental threats impacting asset availability and integrity Correct answer.
  3. As acceptable risks that require no documentation
  4. As human-induced cyber attacks

Explanation

In ISO/IEC 27005, threats are categorized by origin. River flooding is a non-human physical/environmental threat that threatens the availability, physical integrity, and operational continuity of data centre infrastructure assets.

Question 15Cyber-risk identification and analysis

What is the primary role of a designated 'Risk Owner' within a data centre organization?

  1. To personally repair all failed UPS power modules
  2. To hold the accountability and authority to manage a specific risk and ensure treatment controls are effective Correct answer.
  3. To pay out financial claims to colocation tenants
  4. To conduct annual external financial audits of the firm

Explanation

A Risk Owner is an individual with the accountability, authority, and responsibility to manage a designated risk. This includes approving treatment plans, monitoring control effectiveness, and reporting on residual risk status within their operational domain (e.g., Facilities Manager for cooling risk).

Question 16Cyber-risk identification and analysis

Why is the ISO/IEC 27005 risk treatment process described as an iterative cycle?

  1. Because risk treatment plans must be rewritten every 24 hours
  2. If proposed risk treatments do not reduce residual risk to an acceptable level, revised or additional controls must be evaluated iteratively Correct answer.
  3. Because software updates require resetting all physical risk registers to zero
  4. To satisfy weekly vendor sales presentation schedules

Explanation

Risk treatment is iterative. If the initial selection of controls leaves a residual risk that exceeds the organization's risk tolerance, the process loops back to evaluate alternative or supplementary risk treatment options until residual risk is within acceptable boundaries.

Question 17Cyber-risk identification and analysis

Which statement correctly distinguishes ISO 31000 from certifiable management standards like ISO 27001 or ISO 22301?

  1. ISO 31000 is a mandatory law, whereas ISO 27001 is voluntary
  2. ISO 31000 provides non-certifiable generic guidance and principles, whereas ISO 27001 specifies requirements for certification Correct answer.
  3. ISO 31000 applies only to banking, whereas ISO 22301 applies only to healthcare
  4. ISO 31000 requires passing a 400-question written exam for corporate compliance

Explanation

ISO 31000 is a guidelines document intended for any organization seeking to manage risk effectively; it is not intended for certification purposes. In contrast, ISO/IEC 27001 and ISO 22301 are normative management system standards containing explicit 'shall' requirements against which organizations can be formally audited and certified.

Question 18Cyber-risk identification and analysis

When defining risk criteria for a financial trading firm's enterprise data centre, which criteria metric should take top priority?

  1. Aesthetic appearance of white space server rack enclosures
  2. Maximum allowable unexpected downtime (RTO) and transactional data loss (RPO) Correct answer.
  3. Number of parking spaces available for visitor parking
  4. Frequency of routine building paint maintenance

Explanation

For a financial trading firm, unexpected downtime (RTO) and transactional data loss (RPO) directly dictate revenue impact, regulatory compliance fines, and market reputation. Therefore, operational outage duration and data loss metrics are primary risk criteria.

Question 19Cyber-risk identification and analysis

Under ISO 31000, what is the primary purpose of the 'Monitoring and Review' activity throughout the risk management lifecycle?

  1. To ensure that facility maintenance contracts are renewed at the lowest price
  2. To detect changes in context, verify control effectiveness, identify emerging risks, and ensure risk treatment plans remain valid over time Correct answer.
  3. To replace all human operators with robotic artificial intelligence units
  4. To publish daily risk scores on the corporate public website

Explanation

ISO 31000 specifies that monitoring and review must take place continuously to ensure that controls are effective and efficient, new threats and vulnerabilities are identified as internal/external contexts evolve, and risk treatment assumptions remain accurate.

Question 20Cyber-risk identification and analysis

A data centre operator defines a risk tolerance threshold of maximum 1.6 hours of annual unplanned downtime for critical IT workloads. Which facility reliability tier baseline aligns with this requirement?

  1. Tier I (Basic Capacity)
  2. Tier II (Redundant Components)
  3. Tier III (Concurrently Maintainable) Correct answer.
  4. Non-rated warehouse storage room

Explanation

Uptime Institute Tier III concurrent maintainability targets approximately 99.982% availability, which corresponds to roughly 1.6 hours of maximum unplanned downtime per year. Tier I and Tier II target lower availability (allowing over 22 hours and 26 hours of downtime, respectively).

Question 21Cyber-risk identification and analysis

How do external compliance requirements (such as GDPR, PCI-DSS, or HIPAA) shape the external context of a data centre risk assessment?

  1. They dictate the colour of server cabinets and floor tiles
  2. They establish mandatory legal and regulatory risk criteria, penalty exposure, and baseline security control obligations Correct answer.
  3. They eliminate the need to perform physical security background checks
  4. They provide free insurance coverage for hardware equipment failure

Explanation

External regulations define non-negotiable legal risk context. Non-compliance exposes the organization to massive financial penalties, license revocations, and legal liability, which directly forces specific risk treatment controls and stringent risk criteria.

Question 22Cyber-risk identification and analysis

When establishing a risk management framework across a distributed portfolio of regional edge data centres, which risk factor becomes significantly more prominent compared to a single centralized hyperscale facility?

  1. Centralized mega-watt utility transformer short circuits
  2. Physical security vulnerability due to unstaffed sites, localized physical tampering, and varied local contractor access Correct answer.
  3. High availability of dedicated 24/7 on-site facility engineers
  4. Elimination of all WAN network latency dependencies

Explanation

Distributed edge data centres are frequently unstaffed or lightly staffed, relying on local third-party contractors and remote management. This creates prominent physical security, access control, tampering, and delayed incident response risks compared to centralized sites with dedicated 24/7 security personnel.

Question 23Cyber-risk identification and analysis

In an integrated management system combining ISO/IEC 27001 (ISMS) and ISO 22301 (BCMS), how does an IT security risk assessment feed into the Business Continuity Management System?

  1. Security risk assessments replace the need for Business Impact Analysis (BIA)
  2. Identified security risk scenarios (e.g., ransomware, physical breach) provide input for disruption scenarios evaluated in the BIA and continuity plans Correct answer.
  3. BCMS operates completely independently without using security risk data
  4. ISMS risk assessments only deal with paper document archiving

Explanation

ISO 27001 security risk assessments identify threats and vulnerabilities (e.g., cyber attacks, facility sabotage, data corruption) that could trigger operational disruptions. These risk scenarios directly inform the disruption modeling and recovery strategy development within the ISO 22301 BCMS.

Question 24Cyber-risk identification and analysis

Why is defining the exact physical and logical boundaries (scope) critical prior to starting a data centre risk assessment?

  1. To prevent technicians from wearing safety hard hats
  2. To ensure all critical assets, supporting physical infrastructure (power, cooling, fire, security), and operational dependencies are evaluated without gaps or unnecessary out-of-scope effort Correct answer.
  3. To limit the assessment strictly to software licensing agreements
  4. To guarantee that no risk treatment will cost money

Explanation

Scope definition clearly establishes what physical areas (e.g., white space, generator yard, MMR), technical assets, network links, and operational processes are included. Clear boundaries prevent blind spots (such as omitting utility sub-stations) and focus resources on critical scope.

Question 25Cyber-risk identification and analysis

What key component must be included in a formal Data Centre Risk Management Policy document?

  1. Daily cafeteria menu selections
  2. Statement of executive commitment, risk management objectives, governance roles, and risk evaluation criteria Correct answer.
  3. Individual serial numbers of every patch cable in the building
  4. List of nearby local restaurants

Explanation

A formal Risk Management Policy documents executive commitment, defines the objectives and scope of risk management, outlines roles and responsibilities across governance levels, establishes acceptable risk thresholds, and mandates periodic reviews.

Question 26Cyber-risk identification and analysis

What is the key practical difference between qualitative and quantitative risk assessment methodologies?

  1. Qualitative assessment uses numerical monetary and statistical values, while quantitative uses descriptive rating scales
  2. Qualitative assessment uses descriptive categories (e.g., High, Medium, Low) based on expert judgment, while quantitative uses numerical metrics (e.g., ALE, SLE, financial loss figures) Correct answer.
  3. Qualitative assessment requires supercomputers, while quantitative requires paper sticky notes
  4. Qualitative assessment applies only to power systems, while quantitative applies only to cooling systems

Explanation

Qualitative risk assessment categorizes risk levels using descriptive scales (e.g., Low, Medium, High, Critical) based on qualitative criteria and subjective judgment. Quantitative risk assessment calculates risk using numerical metrics such as Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Annualized Loss Expectancy (ALE) expressed in currency or explicit statistics.

Question 27Cyber-risk identification and analysis

In quantitative risk analysis, what is the formula for calculating Single Loss Expectancy (SLE)?

  1. SLE = Asset Value (AV) x Exposure Factor (EF) Correct answer.
  2. SLE = Asset Value (AV) / Annualized Rate of Occurrence (ARO)
  3. SLE = Exposure Factor (EF) x Annualized Loss Expectancy (ALE)
  4. SLE = Recovery Time Objective (RTO) x Hourly Salary

Explanation

Single Loss Expectancy (SLE) represents the monetary loss expected each time a specific risk event occurs. It is calculated by multiplying the monetary value of the asset (Asset Value, AV) by the percentage of asset value lost during the event (Exposure Factor, EF): SLE = AV x EF.

Question 28Cyber-risk identification and analysis

If a data centre facility asset has an Asset Value (AV) of $500,000, an Exposure Factor (EF) of 40% during a severe pipe burst, and an Annualized Rate of Occurrence (ARO) of 0.1 (once every 10 years), what is the Annualized Loss Expectancy (ALE)?

  1. $20,000 Correct answer.
  2. $200,000
  3. $50,000
  4. $2,000

Explanation

First, calculate SLE = AV x EF = $500,000 x 0.40 = $200,000. Next, calculate ALE = SLE x ARO = $200,000 x 0.1 = $20,000 per year.

Question 29Cyber-risk identification and analysis

Which event represents a physical natural/environmental threat to a data centre facility?

  1. A insider network administrator deleting database tables
  2. A severe river flood breaching external flood barriers Correct answer.
  3. An unpatched operating system kernel vulnerability
  4. A vendor maintenance technician tripping over a fiber cable

Explanation

A river flood is an environmental/natural physical threat caused by extreme weather and hydrology, outside human control.

Question 30Cyber-risk identification and analysis

During a physical site selection risk assessment, which geological hazard presents the greatest catastrophic structural risk to a high-density data hall?

  1. High atmospheric humidity during summer months
  2. Active seismic fault lines capable of generating soil liquefaction and ground rupture Correct answer.
  3. Abundant surrounding grass vegetation
  4. Proximity to a municipal public library

Explanation

Active seismic faults and soil liquefaction can destroy building foundations, collapse raised floors, sever utility connections, and cause catastrophic facility loss that internal equipment redundancy cannot mitigate.

Question 31Cyber-risk identification and analysis

In risk terminology, how is a 'Vulnerability' defined in relation to a 'Threat'?

  1. A vulnerability is a potential external event that causes damage, while a threat is a physical control
  2. A vulnerability is a weakness or flaw in an asset or control that could be exploited by a threat Correct answer.
  3. A vulnerability is the monetary cost of insurance premiums
  4. A vulnerability is a guarantee that a data centre will pass ISO certification

Explanation

A vulnerability is an inherent weakness, flaw, or gap in physical infrastructure, systems, procedures, or internal controls (e.g., lack of dual power paths). A threat is an agent or event (e.g., lightning strike, power surge) capable of exploiting that vulnerability to cause harm.

Question 32Cyber-risk identification and analysis

When assessing electrical supply risks, what constitutes a critical Single Point of Failure (SPOF) in a data centre utility connection?

  1. Two independent electrical sub-stations feeding two separate automatic transfer switches
  2. A single utility transformer feeding the main switchboard through a single circuit breaker with no alternate feed Correct answer.
  3. Dual utility feeds originating from two distinct power grids
  4. Redundant diesel generators configured in 2N parallel

Explanation

A single utility transformer and single main circuit breaker represents a classic Single Point of Failure (SPOF): if that transformer fails or breaker trips, the entire utility power path to the facility is lost.

Question 33Cyber-risk identification and analysis

A data centre risk team assesses a potential chilled water pipe rupture directly above server racks. If a total rupture would destroy 70% of the equipment in that server hall, what is the Exposure Factor (EF) for this hazard?

  1. 0.70 (or 70%) Correct answer.
  2. 7.0
  3. 0.30 (or 30%)
  4. 1.70

Explanation

The Exposure Factor (EF) represents the percentage of asset loss caused by a specific threat event. Destroying 70% of the asset value corresponds directly to an EF of 0.70 (70%).

Question 34Cyber-risk identification and analysis

For this supplied matrix only, risk score is likelihood×impact and scores20to25are classified Critical. What rating follows from likelihood4and impact5?

  1. Low Risk (Score 1)
  2. High / Critical Risk (Score 20) Correct answer.
  3. Negligible Risk (Score 0.8)
  4. Medium Risk (Score 9)

Explanation

The supplied rule gives4×5=20, which falls in its explicitly stated Critical band. Risk-matrix scoring and category thresholds are organizational choices; ordinal products are not precise expected monetary losses or a universally mandated ISO classification. Apply the actual criteria consistently and record uncertainty.

Question 35Cyber-risk identification and analysis

When assessing supply chain risks for diesel generator emergency operations, which factor poses a major vulnerability during a regional electrical grid outage?

  1. Inability of fuel supply trucks to deliver fuel due to widespread traffic gridlock, closed fuel depots, or local pump power failures Correct answer.
  2. Abundance of local retail gas stations
  3. Excessive fuel tank storage capacity on-site
  4. Automatic solar panel recharge of diesel fuel tanks

Explanation

During extended regional blackouts, fuel supply logistics become a critical vulnerability. Fuel pumping terminals may lack backup power, highways may experience gridlock, and contracted fuel suppliers may face competing emergency priorities, disrupting planned fuel resupply.

Question 36Cyber-risk identification and analysis

When conducting an asset valuation for data centre risk assessment, why is the business value of stored data often significantly higher than the physical replacement cost of server hardware?

  1. Because metal server chassis degrade faster than copper wiring
  2. Because hardware can be easily repurchased off the shelf, whereas lost or corrupted proprietary enterprise data can cause catastrophic business failure, lost customer trust, and severe regulatory fines Correct answer.
  3. Because server hardware is exempted from insurance claims
  4. Because software licences double in price every month

Explanation

Physical servers are commoditized assets easily replaced via vendor contracts. In contrast, unrecoverable enterprise data, customer records, intellectual property, and transactional history can result in permanent business ruin, regulatory non-compliance fines, and loss of market entity.

Question 37Cyber-risk identification and analysis

What unique fire hazard risk must be evaluated when replacing legacy VRLA (Lead-Acid) UPS batteries with high-energy-density Lithium-ion (Li-ion) battery cabinets?

  1. Sulfuric acid spill hazard
  2. Thermal runaway leading to self-sustaining fires and off-gas explosion risks that require specialized monitoring and fire suppression strategies Correct answer.
  3. Lack of electrical conductivity
  4. Excessive weight overloading raised floor tiles

Explanation

Lithium-ion batteries present thermal runaway risks where an internal cell short or overheat causes rapid chemical breakdown, releasing toxic flammable gases (off-gassing) and self-sustaining fires that generate their own oxygen, requiring specialized early off-gas detection, thermal management, and containment controls.

Question 38Cyber-risk identification and analysis

During a risk audit of rack power distribution, an auditor discovers that both power cords of a dual-corded server are plugged into outlets on the SAME single rack PDU. What vulnerability does this introduce?

  1. Complete loss of power redundancy, making the server vulnerable to total shutdown if that single rack PDU or upstream feed trips Correct answer.
  2. Increased server network port bandwidth
  3. Double electrical billing by the utility company
  4. Automatic activation of clean agent gas suppression

Explanation

Dual-corded servers are designed to take feeds from two separate, independent power paths (Path A and Path B). Plugging both power supplies into a single PDU eliminates path diversity, creating a single point of failure where a PDU fault drops the server.

Question 39Cyber-risk identification and analysis

In physical security vulnerability analysis, what is the core objective of applying CPTED (Crime Prevention Through Environmental Design) principles to site perimeter planning?

  1. To obscure all CCTV camera views with thick bushes
  2. To use natural surveillance, territorial reinforcement, and natural access control to deter unauthorized physical access Correct answer.
  3. To replace perimeter fences with open public park seating
  4. To encourage unauthorized visitors to enter the loading dock area

Explanation

CPTED uses physical design features-such as clear lines of sight, natural landscaping barriers, strategic lighting, clear boundary demarcation, and access control points-to discourage intruders before they approach critical facility structures.

Question 40Cyber-risk identification and analysis

If historical utility grid records indicate that a facility experiences an average of 3 power brownout events every 5 years, what is the Annualized Rate of Occurrence (ARO) for brownouts?

  1. 0.60 events per year Correct answer.
  2. 3.0 events per year
  3. 1.67 events per year
  4. 15.0 events per year

Explanation

The Annualized Rate of Occurrence (ARO) is the estimated frequency of an event per year. ARO = Number of events / Number of years = 3 / 5 = 0.60 events per year.

Question 41Cyber-risk identification and analysis

Why must high-frequency Electromagnetic Interference (EMI) risks be evaluated near heavy electrical switchgear and transformer rooms?

  1. EMI causes immediate freezing of chilled water pipes
  2. Strong electromagnetic fields can induce noise, corrupt unshielded data transmissions, and distort sensitive monitoring equipment readings Correct answer.
  3. EMI increases physical weight loading on raised floor pedestals
  4. EMI causes automatic activation of pre-action fire sprinklers

Explanation

Heavy transformers, busways, and large switchgear generate intense electromagnetic fields. If copper data cabling or sensitive sensor wiring is routed too close without proper shielding or physical clearance, EMI can corrupt data communications and disrupt instrumentation.

Question 42Cyber-risk identification and analysis

In a formal threat-to-vulnerability pairing matrix, how is an actionable risk scenario constructed?

  1. By pairing a specific Threat Agent/Event with a corresponding asset Vulnerability and estimating the resulting Impact Correct answer.
  2. By multiplying total building square footage by annual utility cost
  3. By listing server hostnames in alphabetical order
  4. By adding all employee job titles into a spreadsheet

Explanation

A risk scenario occurs when a specific threat (e.g., severe lightning storm) exploits an existing vulnerability (e.g., lack of service entrance Surge Protective Devices) to cause an impact (e.g., destroyed UPS input rectifiers and white space downtime).

Question 43Cyber-risk identification and analysis

An engineering team evaluates two utility feeds for a new data centre. Feed A and Feed B come from two different substations, but both substations originate from the SAME high-voltage regional transmission grid tower line. What risk factor does this reveal?

  1. True 100% utility fault isolation
  2. Common-mode upstream utility grid dependency (lack of true utility path diversity) Correct answer.
  3. Zero risk of power disruption
  4. Non-compliance with local water drainage bylaws

Explanation

Although the feeds terminate at separate local substations, their reliance on a single high-voltage transmission corridor represents a hidden common-mode failure point. Physical damage to that single transmission tower line will de-energize both substations simultaneously.

Question 44Cyber-risk identification and analysis

What operational risk is introduced when migrating from physical dedicated bare-metal servers to a heavily oversubscribed Software-Defined Data Centre (SDDC) hypervisor cluster?

  1. Elimination of all network bandwidth demands
  2. Resource contention and noisy-neighbor impact, where a single runaway virtual machine starves hypervisor host CPU, RAM, or I/O for adjacent critical workloads Correct answer.
  3. Increased consumption of diesel fuel in generators
  4. Automatic physical theft of server racks

Explanation

In oversubscribed SDDC and virtualized environments, workloads share hypervisor host resources. If resource allocation controls are misconfigured, one resource-intensive VM can starve shared CPU, memory, or disk I/O, impacting critical adjacent business applications.

Question 45Cyber-risk identification and analysis

Why is installing pressurized wet-pipe water plumbing directly above white space server racks considered a major facility design vulnerability?

  1. Because water pipes reduce ambient lighting lux levels
  2. Because pipe joint leaks, condensation drips, or burst pipes can discharge water directly onto live electrical server hardware, causing short circuits, hardware destruction, and downtime Correct answer.
  3. Because water plumbing increases server CPU clock speeds uncontrollably
  4. Because wet-pipe plumbing violates local postal service regulations

Explanation

Pressurized water plumbing directly over server racks creates extreme risk of water ingress onto energized electronics. Best practice requires avoiding overhead liquid piping in data halls or installing secondary containment drip trays and leak detection systems.

Question 46Risk options, shared failures and accountable facility resilience

In the explicitly supplied four-category teaching taxonomy, which listed set names common ways of responding to risk?

  1. Buy, Sell, Hold, and Trade
  2. Avoidance, Reduction (Mitigation), Sharing (Transfer), and Acceptance Correct answer.
  3. Ignore, Hide, Delay, and Deny
  4. Encrypt, Compress, Backup, and Restore

Explanation

Avoiding, reducing, sharing and accepting are common teaching categories for risk responses. International standards describe additional nuances and options; this four-part list is not a complete verbatim normative catalogue. Insurance can share defined financial consequences without removing operational responsibility or all residual exposure.

Question 47Risk options, shared failures and accountable facility resilience

An organization purchases a comprehensive property damage and business interruption insurance policy for its data centre. Which risk treatment option does this represent?

  1. Risk Avoidance
  2. Risk Sharing / Risk Transfer Correct answer.
  3. Risk Elimination
  4. Risk Creation

Explanation

Purchasing insurance transfers or shares the financial consequences of a risk event with an insurer. While insurance does not prevent the physical event from occurring, it mitigates financial impact.

Question 48Risk options, shared failures and accountable facility resilience

Implementing a 2N double-conversion UPS topology instead of a single N UPS system is an example of which risk treatment strategy?

  1. Risk Acceptance
  2. Risk Reduction / Mitigation (via fault-tolerant infrastructure design) Correct answer.
  3. Risk Transfer
  4. Risk Avoidance

Explanation

Deploying a 2N UPS system reduces the likelihood and impact of power outages by providing full system redundancy. This mitigates infrastructure failure risks while keeping operations in the facility.

Question 49Risk options, shared failures and accountable facility resilience

Installing a physical mantrap with biometric two-factor authentication and anti-passback weight sensors is classified as which type of security control?

  1. Detective control
  2. Preventive control Correct answer.
  3. Corrective control
  4. Compensating control

Explanation

A mantrap with biometric authentication prevents unauthorized persons from entering the secure data hall in the first place, making it a classic Preventive physical control.

Question 50Risk options, shared failures and accountable facility resilience

Why is the mandatory enforcement of a Method of Procedure (MOP) considered a critical operational risk control during high-risk maintenance?

  1. To increase the speed of maintenance by skipping safety checks
  2. To provide a step-by-step, pre-approved execution and back-out plan that minimizes human error and ensures safe isolation of critical infrastructure Correct answer.
  3. To transfer legal liability to external equipment vendors
  4. To automatically order replacement parts from suppliers

Explanation

A Method of Procedure (MOP) details every step, safety precaution, peer sign-off requirement, and explicit roll-back procedure before work begins. Enforcing MOPs reduces procedural omissions and human operational errors.