AP Cybersecurity Drill 4: Risk Inventory and Scoring

Question 1. What is the risk score for the researcher laptops?

• A) 8
• B) 10
• C) 15 ✓
• D) 5

Explanation: Choice C is correct. The laptops have Likelihood 3 and Impact 5, and 3 times 5 is 15. Choice A is incorrect. 8 does not match any Likelihood times Impact pair for this asset. Choice B is incorrect. 10 would require Likelihood 2 and Impact 5, which is the backup server, not the laptops. Choice D is incorrect. 5 ignores the likelihood factor entirely.

Question 2. Which asset has the highest risk score in the inventory?

• A) The public lobby kiosk, which carries the inventory's lowest overall risk score
• B) The backup server, at a score of 10
• C) The visitor Wi-Fi, at a score of 4
• D) The researcher laptops, at a score of 15 ✓

Explanation: Choice D is correct. The researcher laptops score 3 times 5 = 15, higher than the kiosk (8), backup server (10), or visitor Wi-Fi (4). Choice A is incorrect. The kiosk scores 4 times 2 = 8, below the laptops. Choice B is incorrect. The backup server scores 2 times 5 = 10, still below the laptops. Choice C is incorrect. The visitor Wi-Fi scores 4 times 1 = 4, the lowest in the table.

Question 3. Two assets share an Impact of 5. Why does the laptop risk still rank above the backup-server risk?

• A) The laptop threat is theft, and theft is always treated as worse than ransomware
• B) The laptop has a higher likelihood, so its Likelihood times Impact product is larger ✓
• C) The backup server is simply considered less valuable than the researcher laptops
• D) The laptops are newer equipment, so the model weights them more heavily than the server

Explanation: Choice B is correct. With equal Impact of 5, the laptops' higher Likelihood of 3 versus the server's 2 makes their product larger, so they rank higher. Choice A is incorrect. The model does not rank threat types; it multiplies likelihood and impact regardless of label. Choice C is incorrect. Both share an Impact of 5, so the difference is likelihood, not an assumed value gap. Choice D is incorrect. Equipment age is not part of the scoring; likelihood is the deciding factor.

Question 4. The analyst flags the laptops as a priority partly because they could expose more than their own data. Which detail in the stimulus best supports treating them as a foothold to more sensitive systems?

• A) The laptops hold saved VPN credentials that allow remote access to the backup server's full archive ✓
• B) The laptops are simply the day-to-day devices that the office's researchers are assigned and use
• C) The public lobby kiosk is positioned in an open, public-facing area near the front of the office
• D) The visitor Wi-Fi network has been left wide open and is freely available to any of the guests who are present

Explanation: Choice A is correct. The saved VPN credentials let a stolen laptop reach the backup server's complete archive, so the laptop is a foothold to more sensitive data, not just a risk to itself. Choice B is incorrect. That researchers use the laptops does not by itself explain a path to other systems. Choice C is incorrect. The kiosk's location is a separate concern and not why the laptops reach the server. Choice D is incorrect. Open visitor Wi-Fi is its own low-impact risk and is unrelated to the laptops' VPN access.

Question 5. Given the listed threat in the inventory, which single mitigation most directly lowers the highest-ranked risk?

• A) Disable the USB ports on the public lobby kiosk so that USB malware can no longer be introduced
• B) Replace the building's existing visitor Wi-Fi with a newer, faster, and more modern guest network
• C) Encrypt the laptops and require reauthentication for VPN access so a stolen device exposes little ✓
• D) Move the backup server into a different, more physically secure room elsewhere within the building

Explanation: Choice C is correct. Encrypting the highest-ranked asset (the laptops) and requiring VPN reauthentication means a stolen device exposes neither its local data nor easy server access, directly addressing theft. Choice A is incorrect. Disabling kiosk USB ports addresses a lower-ranked asset, not the laptops. Choice B is incorrect. A faster visitor Wi-Fi does nothing about laptop theft or the VPN path. Choice D is incorrect. Moving the backup server does not protect the laptops, which are the top risk and the route to the server.