Risk Management CCT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of risk management in an organization?

   • ATo eliminate all possible threats to the organization
   • BTo document every risk without taking action
   • CTo transfer all risks to insurance providers
   • DTo identify, assess, and prioritize risks and apply resources to minimize their impact
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has implemented a risk management program based on ISO 31000. The risk manager has established a risk register and conducts quarterly reviews. However, a recent major incident revealed that a known risk was not adequately monitored because the risk owner had not updated the register after a change in the threat landscape. What is the most likely gap in the risk management process?

   • ALack of continuous monitoring and timely updates to the risk register.
   • BFailure to communicate risks to stakeholders.
   • CInadequate selection of risk response strategies.
   • DIncorrect application of quantitative risk assessment.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A startup company is launching a new online service. The founders are risk-averse and want to avoid any potential legal liability. They are considering not collecting any customer data to eliminate privacy risks. Which risk response strategy are they applying?

   • ARisk acceptance
   • BRisk avoidance
   • CRisk transfer
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is evaluating the risk of a data breach. The asset value is $2,000,000, and the exposure factor is 25%. The breach is expected to occur once every 3 years. What is the annualized loss expectancy (ALE)?

   • A$666,667
   • B$1,500,000
   • C$166,667
   • D$500,000
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A startup has a web application that processes user data. A risk assessment identifies a potential SQL injection vulnerability that could lead to a data breach. The cost to fix the vulnerability is $20,000. The ALE for a data breach is estimated at $50,000. The startup has limited budget and is considering whether to fix the vulnerability or accept the risk. What is the most appropriate decision based on the risk assessment?

   • AFix the vulnerability because the cost of mitigation is less than the ALE.
   • BAvoid the risk by shutting down the web application.
   • CAccept the risk because the startup has limited budget and the vulnerability may not be exploited.
   • DTransfer the risk by purchasing cyber insurance instead of fixing the vulnerability.
   Reveal Solution Discussion Select an answer first