1.4 Compare Security Concepts 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A risk assessment team is conducting a risk assessment for a healthcare organization. The team has identified that the organization's patient records system is a critical asset. The system has a known vulnerability that could allow unauthorized access to patient data. The team has determined that the likelihood of exploitation is high because the vulnerability is publicly known and the system is internet-facing. The impact of a breach is also high because of regulatory fines and reputational damage. The team is now at the risk evaluation step. Which action should the team take next?

   • ADocument the vulnerability in the risk register and move to the next asset.
   • BImplement a patch to fix the vulnerability immediately.
   • CDetermine whether the risk is acceptable based on the organization's risk tolerance.
   • DCalculate the risk score by combining the likelihood and impact ratings.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A regional bank is evaluating the risk of a new mobile banking feature. The feature will store customer financial data in a new cloud database. The bank's risk team identifies that a misconfigured database could expose customer records, and the likelihood of misconfiguration is rated as medium. The impact of a data breach is rated as high because of regulatory fines and reputational damage. The bank's risk appetite allows for medium-risk projects to proceed with additional controls. Which action best aligns with the bank's risk appetite?

   • APurchase a cyber insurance policy that covers regulatory fines and breach response costs
   • BAccept the risk without any additional controls because the likelihood is only medium
   • CProceed with the feature but require a security review and automated configuration checks before launch
   • DCancel the mobile banking feature entirely to avoid any possibility of a data breach
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   How does an exploit relate to a vulnerability?

   • AAn exploit patches a vulnerability
   • BAn exploit uses a vulnerability to gain unauthorized access or cause harm
   • CAn exploit creates a vulnerability in a system
   • DAn exploit is the same as a vulnerability
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A small e-commerce company hosts its website on a single server. A risk assessment identifies that a denial-of-service (DoS) attack could take the site offline, causing significant revenue loss. The company has a limited budget and cannot afford a full high-availability architecture. The management decides to purchase a DoS protection service from a third-party provider. This decision is an example of which risk treatment strategy?

   • ARisk avoidance
   • BRisk mitigation
   • CRisk transfer
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which risk management strategy involves purchasing an insurance policy to cover potential losses from a security incident?

   • AAcceptance
   • BMitigation
   • CAvoidance
   • DTransfer
   Reveal Solution Discussion Select an answer first