Explain Risk Management 100-160 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's risk assessment identifies a vulnerability in a public-facing web server. The server hosts the company's main website, which is critical to business operations. The vulnerability could allow an attacker to deface the website. The company has a web application firewall (WAF) that can block the attack. What is the most appropriate risk response?

   • ATransfer the risk by purchasing cyber insurance
   • BAvoid the risk by taking the website offline
   • CMitigate the risk by configuring the WAF to block the attack
   • DAccept the risk because the WAF is already in place
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is explaining risk to a non-technical manager. The manager says, 'We have a vulnerability in our web server, so we have a high risk.' Which statement best clarifies the relationship between vulnerability and risk?

   • AIf a vulnerability exists, the risk is always high regardless of other factors.
   • BRisk is determined solely by the impact of the vulnerability, not the likelihood.
   • CA vulnerability is the same as risk, so the manager is correct.
   • DA vulnerability only becomes a risk when a threat exploits it, so the risk depends on the likelihood of exploitation and the impact.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a legacy system that contains sensitive customer data. The system cannot be upgraded, and the company cannot afford to replace it. The risk of a breach is considered medium. Which risk management approach is most appropriate?

   • AAvoid the risk by discontinuing use of the legacy system.
   • BTransfer the risk by purchasing insurance, but take no other action.
   • CAccept the risk and document the decision, while implementing compensating controls to reduce the likelihood.
   • DMitigate the risk by implementing strong encryption and access controls, but do not document the decision.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company processes credit card payments and stores cardholder data. The company is considering a new payment processing vendor that claims to be PCI DSS compliant. The company's current on-premises system has never been breached but requires significant maintenance. The company wants to reduce its security responsibilities while maintaining compliance. Which approach best meets these goals?

   • APurchase cyber insurance to cover a potential breach
   • BAccept the risk because the current system has never been breached
   • COutsource payment processing to the PCI DSS compliant vendor
   • DKeep the on-premises system and add more security controls
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A marketing firm stores three types of data: a public product brochure, internal employee email addresses, and a restricted file containing client financial records. Which data type poses the highest risk if exposed?

   • AThe restricted client financial records
   • BThe internal employee email addresses
   • CAll three pose equal risk because any data exposure is a breach.
   • DThe public product brochure
   Reveal Solution Discussion Select an answer first