Explain Risk Management 100-160 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has identified that its public-facing web server has a high likelihood of being compromised due to outdated software. The server is critical to business operations and cannot be taken offline. Which mitigation strategy would be most effective in reducing the risk while keeping the server operational?

   • APurchase cyber insurance to cover potential losses from a breach.
   • BIncrease the server's logging level to detect attacks after they occur.
   • CDisconnect the server from the internet until a maintenance window is available.
   • DApply a virtual patch or vendor-recommended workaround to address the vulnerability without rebooting.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a limited security budget and must choose between fixing a vulnerability in a public-facing web server (high likelihood, medium impact) and a vulnerability in an internal HR database (low likelihood, high impact). The company has regulatory obligations to protect employee PII. Which risk should be prioritized?

   • ABoth should be fixed simultaneously, because both are important.
   • BThe web server vulnerability, because it has a higher likelihood of exploitation.
   • CNeither should be fixed, because the company can accept the risk.
   • DThe HR database vulnerability, because the impact is high and regulatory obligations increase the severity.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company stores sensitive customer data in a cloud environment. The company is considering moving to a new cloud provider that offers better security features but is more expensive. The current provider has had no breaches, but the company's security team believes the new provider's security controls are stronger. The company's budget is limited. What is the most balanced risk management decision?

   • AMove to the new provider despite the higher cost
   • BStay with the current provider and implement additional security controls
   • CAccept the risk because the current provider has had no breaches
   • DMove to the new provider and reduce other security spending
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's internal application has a known vulnerability that could allow an attacker to gain access to customer data. The vendor has released a patch, but the patch requires a reboot of the server, which would cause downtime during business hours. The company decides to apply the patch during the next maintenance window. Which risk mitigation strategy does this represent?

   • ATransferring the risk to the vendor
   • BReducing the threat impact by isolating the server
   • CReducing the vulnerability by applying the patch
   • DAccepting the risk permanently
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization is evaluating the risk of a ransomware attack on its file server. The file server contains only non-confidential operational data, and the organization has reliable backups. The likelihood of an attack is high, but the impact is low because data can be restored quickly. What is the overall risk level?

   • AHigh
   • BMedium
   • CLow
   • DExtremely high
   Reveal Solution Discussion Select an answer first