Explain Risk Management 100-160 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A regional hospital stores patient records in a database that is accessible only to clinical staff. A recent scan found that the database server is missing a critical security patch. The exploit code for this vulnerability is publicly available, but the database is on an isolated network segment with no internet access. The hospital's risk team must rank this risk against others. How should they classify the likelihood and impact?

   • ALow likelihood, high impact
   • BLow likelihood, low impact
   • CHigh likelihood, low impact
   • DHigh likelihood, high impact
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A small retail company has two identified issues: a known unpatched vulnerability in a customer-facing web application that has a 90% chance of being exploited, and a misconfigured firewall rule that could allow unauthorized access to the internal network but has only been observed once in the past year. The company has limited resources and can only address one issue this quarter. Which issue should the company prioritize?

   • ABoth issues equally, because all vulnerabilities should be treated with the same priority.
   • BThe unpatched web application vulnerability, because it has a high likelihood of exploitation and could lead to a data breach.
   • CNeither issue, because the company has not experienced a breach yet, so the risk is acceptable.
   • DThe misconfigured firewall rule, because it affects the entire internal network and is a more critical asset.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which area of security assessment focuses on ensuring that changes to IT systems are reviewed, approved, and documented?

   • AInformation security
   • BInformation assurance
   • CChange management
   • DComputer operations
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company stores customer data in two systems. System 1 stores customer names and email addresses. System 2 stores customer credit card numbers. Both systems have the same vulnerability. The company can only patch one system immediately. Which system should be patched first?

   • ASystem 1, because names and email addresses are PII
   • BPatch neither system until both can be patched
   • CSystem 2, because credit card data is more sensitive
   • DPatch both systems simultaneously
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which risk management approach involves taking action to eliminate the risk entirely, such as discontinuing a risky activity?

   • ARisk acceptance
   • BRisk transfer
   • CRisk avoidance
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first