Risk Management ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard · select all that apply

   A company is conducting a risk identification workshop. Which of the following are examples of threats (as opposed to vulnerabilities or risks)? Select all that apply.

   • AA distributed denial-of-service (DDoS) attack
   • BLack of encryption on sensitive data at rest
   • CA disgruntled employee with access to sensitive data
   • DA phishing campaign targeting employees
   • EUnpatched software on a public-facing server
   Check answers Discussion Select an answer first
2. 27application · medium

   A risk assessment has identified four risks with the following characteristics: Risk A has a high likelihood and high impact; Risk B has a high likelihood and low impact; Risk C has a low likelihood and high impact; Risk D has a low likelihood and low impact. The organization has limited resources for risk treatment. Which risk should be prioritized first?

   • ARisk C
   • BRisk B
   • CRisk A
   • DRisk D
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A manufacturing company has identified a risk of production line downtime due to a single point of failure in a critical machine. The risk analysis shows a 20% annual probability of failure and an estimated impact of $2 million per incident. The company is considering a backup machine that costs $250,000 and would reduce the impact to $500,000. What is the most appropriate risk response based on this analysis?

   • ATransfer the risk by purchasing business interruption insurance
   • BAccept the risk because the annualized loss expectancy is less than the cost of the backup
   • CAvoid the risk by shutting down the production line
   • DMitigate the risk by purchasing the backup machine
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A CISO must communicate risk information to different stakeholders: the board, IT operations, and external auditors. Each group needs different detail. What is the best approach?

   • AReport only to the board and let them disseminate information
   • BSend the same detailed risk register to all stakeholders
   • CProvide real-time dashboards to everyone
   • DTailor reports to each audience: summary for the board, technical details for IT, and compliance evidence for auditors
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary difference between qualitative and quantitative risk analysis?

   • AQuantitative analysis is used only for financial risks
   • BQualitative analysis is performed after quantitative analysis
   • CQualitative analysis uses descriptive scales, while quantitative analysis uses numerical values
   • DQualitative analysis is always more accurate than quantitative analysis
   Reveal Solution Discussion Select an answer first