1.5 Describe the Purpose of Cyber Risk Insurance 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A cyber insurance policy includes coverage for legal defense costs and settlements when a customer sues the organization for failing to protect their personal data. This type of coverage is known as:

   • ANetwork business interruption coverage
   • BCyber extortion coverage
   • CFirst-party coverage
   • DThird-party coverage
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is considering whether to invest in additional security controls or purchase a higher cyber insurance limit. The company's risk manager notes that the insurer's underwriting questionnaire asks about the company's backup strategy and incident response capabilities. The company has a limited budget and must choose between improving backups and increasing the policy limit. Which consideration should drive the decision?

   • AImproving backups is always better because it reduces the likelihood of a claim.
   • BIncreasing the policy limit is always better because it transfers more risk to the insurer.
   • CThe decision should weigh the insurer's requirements and the company's specific risk profile, since both controls and coverage affect overall risk.
   • DThe company should choose the option that costs less, regardless of risk impact.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the fundamental purpose of cyber risk insurance for an organization?

   • ATo eliminate all cybersecurity risks and prevent any cyber incident from occurring
   • BTo replace the need for an organization's internal security controls and incident response plan
   • CTo transfer a portion of the financial risk of a cyber incident to the insurer in exchange for premium payments
   • DTo guarantee that an organization will never suffer a data breach or ransomware attack
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A hospital system is applying for cyber insurance. The insurer's underwriting questionnaire asks about the use of MFA, backup frequency, and incident response plan testing. The hospital has MFA for remote access but not for all internal administrative accounts. Backups are performed daily but stored on the same network segment as production systems. Incident response plans are reviewed annually but not tested. The insurer offers a policy with a significant premium discount if the hospital implements MFA for all admin accounts, moves backups offline, and conducts a tabletop exercise within 90 days. The hospital's IT team is concerned about the operational impact of MFA on administrative workflows. What is the most appropriate response to balance security improvement and operational concerns?

   • AAsk the insurer to waive the requirements in exchange for a higher deductible
   • BImplement MFA for all admin accounts, move backups offline, and conduct the tabletop exercise within 90 days
   • CReject the insurer's requirements because they are too operationally disruptive
   • DImplement only MFA for admin accounts and defer the other requirements until after the policy is issued
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In the context of risk management, cyber risk insurance is primarily used to:

   • ATransfer the financial impact of certain cyber losses to an insurance provider
   • BEliminate the need for cybersecurity investments and employee training
   • CReduce the likelihood of a cyber attack by improving technical defenses
   • DProvide legal immunity to organizations that experience a data breach
   Reveal Solution Discussion Select an answer first