Explain Risk Management 100-160 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is planning a security assessment of its IT systems. The goal is to verify that recent changes to the firewall configuration have not introduced new vulnerabilities. Which type of assessment best fits this goal?

   • AComputer operations review
   • BInformation assurance certification
   • CInformation security policy audit
   • DChange management review
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A financial services company processes credit card transactions. A vulnerability assessment found that the payment application is outdated and has known vulnerabilities. The company cannot afford to upgrade the application immediately. Which combination of mitigation strategies would best reduce the risk while the upgrade is pending?

   • AIncrease logging and monitoring to detect attacks, but take no other action.
   • BSegment the payment application from the rest of the network and apply vendor-provided patches or workarounds.
   • CDisconnect the payment application from the internet and process transactions manually.
   • DPurchase cyber insurance to cover potential losses and continue operations unchanged.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How are risk levels such as low, medium, high, and extremely high typically determined?

   • ABy the number of vulnerabilities found in a system
   • BBy combining the likelihood of occurrence with the impact of the event
   • CBy the cost of the security controls implemented
   • DBy the type of threat actor involved
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What two factors are used to rank risks for prioritization?

   • ASeverity and exposure
   • BThreat and vulnerability
   • CCost and speed
   • DLikelihood and impact
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is evaluating two risks. Risk A: a phishing email that could trick an employee into revealing their password. The company has no email filtering and no multi-factor authentication. Risk B: a misconfigured firewall that could allow unauthorized access to a public web server. The web server contains only publicly available marketing brochures. Which risk should be prioritized?

   • ARisk A, because the likelihood is high and the impact is high
   • BNeither risk, because both are low likelihood
   • CBoth risks equally, because both are security weaknesses
   • DRisk B, because the firewall is a critical security control
   Reveal Solution Discussion Select an answer first