312-39 · Question #21
Mark Reynolds, a SOC analyst at a healthcare organization, is monitoring the SIEM system when he detects a potential security threat: a series of unusual login attempts targeting critical patient…
The correct answer is C. High. In a standard risk matrix, overall severity is derived by combining likelihood and impact. “Likely” indicates a higher probability (not rare or unlikely), and “Significant” damage indicates a high business impact. In most common 4x4 or 5x5 matrices, pairing a high likelihood…
Question
Mark Reynolds, a SOC analyst at a healthcare organization, is monitoring the SIEM system when he detects a potential security threat: a series of unusual login attempts targeting critical patient data servers. After investigating the alerts and collaborating with the incident response team, the SOC determines that the threat has a “Likely” chance of occurring and could cause “Significant” damage, including operational disruptions, financial loss due to data breaches, and regulatory penalties under HIPAA. Using a standard Risk Matrix, how would this risk be categorized in terms of overall severity?
Options
- AMedium
- BLow
- CHigh
- DVery High
How the community answered
(21 responses)- A14% (3)
- B5% (1)
- C76% (16)
- D5% (1)
Explanation
In a standard risk matrix, overall severity is derived by combining likelihood and impact. “Likely” indicates a higher probability (not rare or unlikely), and “Significant” damage indicates a high business impact. In most common 4x4 or 5x5 matrices, pairing a high likelihood with a high impact results in a “High” risk rating (or sometimes “Very High” if both are at the extreme ends like “Almost Certain” and “Catastrophic”). Here, the wording is “Likely” and “Significant,” which strongly maps to typically be “Almost Certain” plus “Severe/Catastrophic”). For a healthcare organization under HIPAA, unauthorized access to patient data can trigger regulatory penalties, breach notification obligations, operational disruption, and reputational harm-so the impact is clearly material. Since the SOC has already assessed it as both probable and damaging, the risk rating should drive prioritized response: immediate containment measures, validation of access attempts, and proactive controls (MFA, conditional access, monitoring for lateral movement). Therefore, “High” is the appropriate overall severity classification.
Topics
Community Discussion
No community discussion yet for this question.