Risk Management CCISO Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A hospital is evaluating two risks: (1) a ransomware attack on its electronic health records (EHR) system, and (2) a failure of its backup power generator during a regional outage. The EHR risk has a high likelihood and high impact, while the generator risk has a low likelihood but very high impact. The hospital's risk appetite is low for patient safety risks but moderate for operational disruptions. The CISO has a limited budget and cannot fully mitigate both risks. Which approach should the CISO take?

   • APrioritize the generator risk because patient safety is the top priority, even though its likelihood is low.
   • BMitigate both risks equally by splitting the budget between them.
   • CPrioritize the EHR risk because it has a higher likelihood and impact.
   • DAccept both risks because the budget is limited.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A newly appointed CISO is asked by the board to explain how risk management supports the organization's strategic objectives. Which explanation best describes the role of risk management?

   • ARisk management helps the organization identify, assess, and respond to uncertainties that could affect its objectives.
   • BRisk management is the responsibility of the IT department and focuses only on cybersecurity risks.
   • CRisk management is primarily about avoiding all risks to ensure the organization never experiences a loss.
   • DRisk management is a compliance activity that is only necessary to satisfy regulators.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk response strategy does this represent?

   • ARisk transfer
   • BRisk mitigation
   • CRisk avoidance
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software company relies on a third-party cloud provider for its customer database. The provider announces that it will discontinue the current service tier, forcing the company to migrate to a new platform. The CISO assesses that the migration could introduce data integrity issues and service downtime. The company's risk appetite is low for data integrity but moderate for short service interruptions. Which risk response strategy should the CISO choose?

   • AMitigate the risk by developing a detailed migration plan with data validation checks and rollback procedures.
   • BTransfer the risk by requiring the provider to sign a new SLA with penalties for data loss.
   • CAvoid the risk by moving all data to an on-premises database immediately.
   • DAccept the risk because the provider is responsible for the migration.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which risk response strategy involves taking actions to reduce the likelihood or impact of a risk?

   • ARisk avoidance
   • BRisk mitigation
   • CRisk transfer
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first