1.5 Describe the Purpose of Cyber Risk Insurance 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization's cyber insurance policy has a $5 million aggregate limit and a $250,000 sublimit for social engineering fraud. During the policy period, the organization experiences two separate social engineering fraud incidents, each causing $200,000 in losses. How much will the insurer pay for these two incidents combined?

   • A$400,000
   • B$200,000
   • C$5 million
   • D$250,000
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During the underwriting process for cyber risk insurance, which factor would an insurer most likely evaluate to assess an organization's cyber risk posture?

   • AThe strength of the organization's security controls and incident response capabilities
   • BThe number of employees in the marketing department
   • CThe color scheme of the organization's website
   • DThe organization's stock price and market capitalization
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An insurer is underwriting a cyber policy for a financial services firm. The firm has implemented MFA, endpoint detection and response (EDR), and regular backups. However, the firm's incident response plan has not been tested in three years, and the firm recently experienced a phishing incident that resulted in a small data breach. The insurer must decide between offering coverage with a higher premium or requiring the firm to remediate the untested incident response plan before binding. Which approach best balances the insurer's risk and the firm's operational reality?

   • ARequire the firm to test the incident response plan within 30 days before issuing coverage.
   • BOffer standard terms because the firm has MFA, EDR, and backups.
   • CDeny coverage because the untested plan and recent breach make the risk unacceptable.
   • DOffer coverage with a higher premium and a condition to test the incident response plan within the next policy period.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can cyber risk insurance influence an organization's security practices?

   • ABy guaranteeing that the organization will pass all security audits
   • BBy taking over the organization's incident response team
   • CBy requiring the organization to implement specific security controls as a condition of coverage
   • DBy eliminating the need for the organization to invest in security technologies
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is considering cyber risk insurance for the first time. The company's IT manager believes that insurance will cover all costs associated with a cyber incident, including fines, legal fees, and lost revenue. The company's broker explains that policies have limits and exclusions. Which statement best describes the role of cyber risk insurance in this context?

   • AInsurance provides a safety net for covered losses, but it does not eliminate the need for security controls.
   • BInsurance replaces the need for an incident response plan because the insurer will handle the response.
   • CInsurance covers all losses up to the policy limit, so security controls are less important.
   • DInsurance is only useful for large enterprises that can afford high premiums.
   Reveal Solution Discussion Select an answer first