Explain Risk Management 100-160 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An organization implements data encryption to protect sensitive information if a laptop is stolen. This is an example of which risk mitigation strategy?

   • AReducing vulnerabilities
   • BRisk transfer
   • CRisk acceptance
   • DReducing threat impact
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which type of data typically carries the highest risk if exposed due to legal and regulatory implications?

   • AInternal operational procedures
   • BProtected Health Information (PHI)
   • CPublicly available financial reports
   • DPublic marketing data
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company discovers that an employee's laptop, which contains unencrypted customer data, was stolen. The laptop had a strong password and full-disk encryption was not enabled. The company must decide how to respond. Which response best reduces the risk of data exposure?

   • AAccept the risk because the laptop had a strong password
   • BReport the laptop as stolen to the police
   • CEnable full-disk encryption on all company laptops immediately
   • DChange the employee's password
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization has identified three risks: (1) a high-likelihood, low-impact risk to a public website, (2) a low-likelihood, high-impact risk to a restricted database, and (3) a medium-likelihood, medium-impact risk to an internal application. Which risk should be addressed first?

   • AThe low-likelihood, high-impact risk, because the impact is severe.
   • BThe medium-likelihood, medium-impact risk, because it balances both factors and may have the highest overall risk score.
   • CAll three risks should be addressed simultaneously, because they are all important.
   • DThe high-likelihood, low-impact risk, because it will occur most often.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's risk assessment identifies two risks. Risk 1: a virus could infect a server that stores only public marketing data. Risk 2: a phishing email could trick an employee into transferring funds to a fraudulent account. The company has no email filtering and no financial controls. Which risk should be rated higher?

   • ARisk 2, because the likelihood is high and the impact is high
   • BRisk 1 is higher because viruses are more common than phishing
   • CRisk 1, because a virus can spread quickly
   • DBoth risks are equally high
   Reveal Solution Discussion Select an answer first