Describe Risk Assessment. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational corporation is conducting a risk assessment for its global IT infrastructure. The risk team has historical data on the frequency of cyber incidents and the financial losses associated with each type of incident. They need to compare risks across different business units and justify investments in risk mitigation. However, some risks, such as reputational damage, are difficult to quantify in monetary terms. What is the best approach for this risk assessment?

   • AUse only expert judgment to rate all risks
   • BUse qualitative analysis for all risks to avoid the difficulty of quantification
   • CUse a hybrid approach: quantitative analysis for risks with sufficient data, and qualitative analysis for risks that are difficult to quantify
   • DUse quantitative analysis for all risks to ensure consistency
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the context of the NIST Cybersecurity Framework, what is the primary purpose of a risk assessment within the Identify function?

   • ATo eliminate all identified vulnerabilities from the organization's systems
   • BTo understand and document the risks to organizational assets, data, and capabilities
   • CTo implement security controls that automatically prevent all cyber threats
   • DTo transfer all identified risks to an external insurance provider
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is conducting a risk assessment for its patient portal. The risk team has assigned a monetary value to the potential loss from a data breach and calculated the annualized loss expectancy based on the probability of occurrence. Which risk analysis method are they using?

   • AQualitative analysis
   • BThreat modeling
   • CSemi-quantitative analysis
   • DQuantitative analysis
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A hospital is conducting a risk assessment and has identified two critical risks: a ransomware attack that could disrupt patient care systems, and a data breach of electronic health records (EHR). The ransomware risk has a likelihood rating of 4 and an impact rating of 5. The data breach risk has a likelihood rating of 2 and an impact rating of 5. The hospital has a limited budget and can only mitigate one risk this year. The risk team is divided: some argue that the ransomware risk should be prioritized because of its higher likelihood, while others argue that the data breach risk is more important because of regulatory penalties. Which approach should the hospital take to prioritize these risks?

   • APrioritize the data breach risk because regulatory penalties are more severe than the impact of ransomware
   • BUse a risk matrix that incorporates both likelihood and impact, and then adjust for regulatory and compliance factors
   • CPrioritize both risks equally because they both have an impact rating of 5
   • DPrioritize the ransomware risk because it has a higher likelihood and impact score
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A government agency is conducting a risk assessment for a new system. They need to compare risks across different departments, but they have limited historical data and the risks are difficult to quantify in monetary terms. Which risk analysis method is most appropriate for this situation?

   • AQualitative analysis
   • BThreat intelligence analysis
   • CCost-benefit analysis
   • DQuantitative analysis
   Reveal Solution Discussion Select an answer first