Explain Risk Management 100-160 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is about to deploy a new web application. The security team has limited time and budget. They must choose between a full penetration test and a vulnerability scan. The application will handle sensitive customer data. Which choice best balances thoroughness and resource constraints?

   • AConduct only a penetration test
   • BSkip both and rely on the vendor's security claims
   • CConduct only a vulnerability scan
   • DConduct a vulnerability scan first, then a penetration test if time and budget allow
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is an example of a risk mitigation strategy that reduces the likelihood of a vulnerability being exploited?

   • AApplying security patches to software
   • BDiscontinuing the use of the software
   • CPurchasing cyber insurance
   • DAccepting the risk in a risk register
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A government agency classifies data into four levels: public, internal, confidential, and restricted. A risk assessment must assign a risk level to each data type. Which factor should be the primary determinant of the risk level?

   • AThe cost of the hardware storing the data
   • BThe likelihood of a threat exploiting a vulnerability
   • CThe number of users who access the data
   • DThe age of the data
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A hospital's IT team discovers a critical vulnerability in a medical device that stores patient data. The vendor has not yet released a patch. The device is essential for patient care and cannot be taken offline. The hospital must reduce the risk while maintaining device availability. Which strategy best balances these constraints?

   • AAccept the risk because the device is essential
   • BSegment the device onto an isolated network and monitor access
   • CDisconnect the device from the network until a patch is available
   • DReplace the device immediately with a newer model
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's network has a firewall with a rule that allows all inbound traffic from the internet to a database server. The database contains customer credit card numbers. The firewall rule is not needed for business operations. What is the best way to reduce the risk?

   • AAdd a second firewall in series
   • BAccept the risk because the database is protected by encryption
   • CRemove the unnecessary firewall rule
   • DEncrypt the database
   Reveal Solution Discussion Select an answer first