1.5 Describe the Purpose of Cyber Risk Insurance 350-201 Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A company's legal team is reviewing a cyber insurance policy. The policy includes first-party coverage for business interruption, data restoration, and forensic investigation. It also includes third-party coverage for privacy liability and regulatory defense. Which scenario would be covered under the third-party portion of this policy?

   • AThe company loses revenue while its systems are down for a week.
   • BThe company hires a forensic firm to determine the cause of a breach.
   • CThe company pays to restore data from backups after a ransomware attack.
   • DA customer sues the company after a data breach exposes their personal information.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An insurer is underwriting a cyber policy for a healthcare organization. The organization has implemented multi-factor authentication (MFA) for remote access, maintains offline backups, and conducts quarterly tabletop exercises. The insurer asks for evidence of these controls. What is the primary reason the insurer requests this information?

   • ATo ensure the organization complies with all industry regulations
   • BTo verify that the organization has never experienced a cyber incident
   • CTo determine the premium and coverage terms based on the organization's risk posture
   • DTo transfer the responsibility for security to the insurer
   Reveal Solution Discussion Select an answer first
3. 33application · medium

   An insurance underwriter is evaluating a healthcare organization's application for cyber risk insurance. The organization has implemented multi-factor authentication (MFA) for remote access, conducts quarterly vulnerability scans, and has an incident response plan that is tested annually. However, the organization has no documented patch management process and has not segmented its network. What is the most likely impact on the underwriting decision?

   • AThe insurer will deny coverage entirely because the organization lacks a documented patch management process.
   • BThe insurer will likely offer coverage with higher premiums, lower limits, or additional conditions due to the identified gaps.
   • CThe insurer will require the organization to implement network segmentation before binding coverage.
   • DThe insurer will offer coverage at a standard premium because MFA and vulnerability scans are sufficient controls.
   Reveal Solution Discussion Select an answer first