Risk Management SY0-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A manufacturing company is conducting a BIA to prioritize recovery efforts. The BIA reveals that the enterprise resource planning (ERP) system has a maximum tolerable downtime (MTD) of 4 hours, while the email system has an MTD of 24 hours. The company's risk register currently lists both systems with the same priority level. What should the risk manager do to align the risk register with the BIA findings?

   • ARemove the email system from the risk register because its MTD is longer.
   • BIncrease the MTD of the ERP system to match the email system to simplify recovery planning.
   • CKeep both systems at the same priority because the BIA does not affect risk prioritization.
   • DUpdate the risk register to assign a higher priority to the ERP system based on its shorter MTD.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A risk analyst is studying how a potential supply chain disruption could affect the company's ability to deliver products. This activity is best described as:

   • ARisk analysis
   • BRisk acceptance
   • CRisk identification
   • DRisk reporting
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A risk assessment team is evaluating the risk of a flood damaging a data center. They determine that the probability of a flood is low, but the impact would be catastrophic. This evaluation is primarily part of:

   • ARisk communication
   • BRisk assessment
   • CRisk mitigation
   • DRisk identification
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During a risk management review, the team uses a vulnerability scanner to identify missing patches on servers. This activity is an example of:

   • ARisk transfer
   • BRisk identification
   • CRisk acceptance
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency has a very low risk tolerance for any security incident that could compromise citizen data. The agency is evaluating a new cloud-based service that would improve efficiency but requires data to be stored in a third-party data center. The vendor offers strong security controls, but the agency is concerned about the risk. What is the most appropriate risk strategy?

   • ATransfer the risk by purchasing cyber liability insurance.
   • BAccept the risk because the vendor has strong security controls.
   • CMitigate the risk by requiring the vendor to sign a data processing agreement with strict security requirements.
   • DAvoid the risk by not using the cloud-based service.
   Reveal Solution Discussion Select an answer first