Risk Management SY0-701 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An organization decides to stop using a third-party service that has a history of security breaches. This decision is an example of which risk strategy?

   • ARisk avoidance
   • BRisk transfer
   • CRisk mitigation
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A retail company is planning to migrate its point-of-sale (POS) system to a cloud provider. During the risk identification phase, the team brainstorms potential risks, including data breach, service outage, and vendor lock-in. What is the most appropriate next step for the team to take?

   • AImmediately implement security controls to mitigate the data breach risk.
   • BTransfer all risks to the cloud provider through the contract.
   • CDocument these risks in the risk register for further assessment.
   • DAccept the risks because the cloud provider is responsible for security.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A financial services firm is deciding how to handle the risk of a third-party payment processor outage. The BIA shows that a 2-hour outage would cost the firm $50,000 in lost transactions. The processor offers a service-level agreement (SLA) with a 99.9% uptime guarantee and a penalty clause that pays the firm $10,000 for each hour of downtime beyond the SLA. The firm's risk appetite is low for operational disruptions. What is the most appropriate risk strategy for this scenario?

   • AMitigate the risk by implementing a secondary payment processor as a backup.
   • BTransfer the risk by purchasing business interruption insurance.
   • CAvoid the risk by terminating the contract with the payment processor.
   • DAccept the risk because the SLA penalty covers the financial loss.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security analyst is reviewing a new cloud-based customer relationship management (CRM) system. Which activity is primarily associated with risk identification?

   • ACreating a list of potential threats and vulnerabilities that could affect the CRM system
   • BDeciding to accept the risk of a minor service disruption
   • CDetermining the annualized loss expectancy for a potential data breach
   • DCalculating the likelihood and impact of a ransomware attack
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A new chief information security officer (CISO) is joining a company that has historically avoided most security risks, resulting in slow product releases. The board wants to increase the company's competitiveness by releasing features faster. What should the CISO do to align the company's risk posture with the board's goal?

   • AIncrease the risk tolerance for all types of risk equally.
   • BImmediately approve all product releases without security review.
   • CMaintain the current risk avoidance posture to ensure security is never compromised.
   • DPropose a revised risk appetite statement that allows for more risk in product development.
   Reveal Solution Discussion Select an answer first