Risk Management CCT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An international company operates in multiple countries and needs a risk management framework that provides principles and guidelines applicable to any type of organization, regardless of industry or location. Which framework is most appropriate?

   • AISO 31000
   • BISO 27001
   • CNIST RMF
   • DCOBIT
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A logistics company's fleet management system is critical. A cyberattack could cause a loss of $2 million per incident. Based on industry data, such an attack is likely to occur once every 4 years. The company is considering a security solution that costs $400,000 per year. What is the annualized loss expectancy (ALE) and should the company implement the solution?

   • AALE = $500,000; implement because the ALE exceeds the annual cost.
   • BALE = $8,000,000; do not implement because the ALE is too high.
   • CALE = $500,000; do not implement because the ALE is less than the annual cost.
   • DALE = $2,000,000; implement because the ALE exceeds the annual cost.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which risk response strategy involves purchasing an insurance policy to cover potential losses?

   • AMitigation
   • BAcceptance
   • CTransfer
   • DAvoidance
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a risk identification workshop, a manufacturing company identifies the following items: (1) a fire in the server room, (2) outdated firewall firmware, (3) a disgruntled employee with access to sensitive data, and (4) a lack of backup procedures. Which of these is correctly categorized as a threat?

   • AOutdated firewall firmware
   • BA fire in the server room
   • CA disgruntled employee with access to sensitive data
   • DA lack of backup procedures
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A mid-sized e-commerce company faces a risk of credit card data breach due to a legacy payment processing system. The estimated annualized loss expectancy (ALE) is $250,000. The company is evaluating four risk response options. Which option represents risk transfer?

   • AUpgrade the legacy payment system to a modern, PCI-DSS-compliant platform.
   • BDiscontinue accepting credit card payments and switch to a different payment method.
   • CDocument the risk in the risk register and continue operations without additional controls.
   • DPurchase a cyber liability insurance policy that covers breach-related costs.
   Reveal Solution Discussion Select an answer first