Explain Risk Management 100-160 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company stores customer PII in a cloud database. A recent assessment found that the database has weak access controls, and the data is not encrypted at rest. Which mitigation strategy would be most effective in reducing the risk of unauthorized access?

   • AMove the data to a different cloud provider, because that will eliminate the risk.
   • BImplement multi-factor authentication and encrypt the database at rest.
   • COnly implement multi-factor authentication, because access controls are the primary concern.
   • DOnly encrypt the database at rest, because encryption alone is sufficient.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of a security assessment of an IT system?

   • ATo assign a monetary value to all assets
   • BTo identify vulnerabilities and evaluate the effectiveness of security controls
   • CTo provide training to end users
   • DTo ensure the system is always available to users
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   An organization is assessing risks to its internal employee database. The database contains only non-sensitive operational data, and a breach would cause minor inconvenience. The likelihood of a breach is considered low because the database is behind multiple layers of security. According to a standard risk matrix, what is the overall risk level?

   • AExtremely high
   • BHigh
   • CMedium
   • DLow
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is planning a security assessment but has limited time and budget. The goal is to identify the most critical vulnerabilities and ensure that recent changes have not weakened security. Which combination of assessment types would be most efficient?

   • AFull penetration test and information assurance certification
   • BComputer operations review and policy audit
   • CVulnerability scan and change management review
   • DRisk acceptance and insurance purchase
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An organization decides to purchase cybersecurity insurance to cover potential losses from a data breach. Which risk management approach is this?

   • ARisk acceptance
   • BRisk avoidance
   • CRisk mitigation
   • DRisk transfer
   Reveal Solution Discussion Select an answer first