Risk Management ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is launching a new mobile payment app. The risk team has identified several risks: (1) insecure API endpoints, (2) lack of encryption in transit, (3) potential fraud from stolen credentials, and (4) regulatory fines for non-compliance with payment card standards. The team must prioritize which risks to address first. Which risk should be treated first?

   • AFraud from stolen credentials, because it directly affects customers
   • BLack of encryption in transit, because it is a direct violation of payment card standards
   • CRegulatory fines, because they are the highest financial impact
   • DInsecure API endpoints, because they are the most likely to be exploited
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has implemented a risk treatment plan to mitigate the risk of ransomware by deploying endpoint detection and response (EDR) tools. Six months later, the CISO wants to verify that the treatment is effective. What is the most appropriate action?

   • AImmediately purchase cyber insurance to transfer the risk
   • BRe-assess the inherent risk without considering the EDR deployment
   • CReview EDR alert metrics and conduct a red-team exercise to test detection capabilities
   • DAccept the risk based on the initial analysis and move on
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A multinational bank operates in multiple jurisdictions with conflicting data protection regulations. One jurisdiction requires data to be stored locally, while another requires global access for fraud detection. The bank must balance compliance with operational needs. What is the most appropriate approach?

   • AIgnore the conflicting regulations and store data in a single central location.
   • BStore all data in the jurisdiction with the strictest regulations and provide remote access.
   • CImplement a data residency strategy that stores data locally where required and uses approved transfer mechanisms for global access.
   • DTransfer all data processing to a third-party cloud provider.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's risk management program is failing because employees rarely report near-misses or operational issues. The CISO suspects a culture problem. Which initiative would most directly improve risk culture?

   • AOutsource risk management to a third-party consultant
   • BPurchase additional cyber insurance
   • CImplement a no-blame reporting policy and publicly recognize employees who report issues
   • DIncrease the frequency of risk assessments
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does integrating risk management with compliance requirements benefit an organization?

   • AIt focuses only on financial regulations and ignores other legal obligations
   • BIt ensures that compliance obligations are addressed in the context of the organization's risk priorities
   • CIt guarantees that all regulatory requirements are met without exception
   • DIt eliminates the need for external audits
   Reveal Solution Discussion Select an answer first