Risk Management CCT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A manufacturing company's production line relies on a legacy control system that is not patched because the vendor no longer provides updates. The system is connected to the corporate network for reporting. A risk assessment identifies that a malware infection could halt production for a week, costing $200,000. The company decides to segment the network and implement strict access controls to reduce the likelihood of infection. Which risk response strategy is being applied?

   • ATransfer
   • BMitigation
   • CAcceptance
   • DAvoidance
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary focus of the ISO 31000 risk management standard?

   • AMandating the use of quantitative risk assessment only
   • BProviding principles and guidelines for managing any type of risk
   • CDefining specific security controls for IT systems
   • DFocusing exclusively on financial risk management
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital is conducting a risk assessment for its patient records system. The risk management team has limited historical data on cyberattacks against similar hospitals. They need to quickly prioritize risks for a board meeting next week. Which approach is most appropriate for this situation?

   • AQualitative assessment using a risk matrix with likelihood and impact ratings.
   • BDefer the risk assessment until more historical data is collected from other hospitals.
   • CQuantitative assessment using SLE, ARO, and ALE calculations for each threat.
   • DUse a quantitative assessment based on industry benchmarks for hospital cyberattacks.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard · select all that apply

   A risk manager is creating a risk register for a new project. The register should support ongoing risk management decisions. Which of the following elements should be included in the risk register? (Select all that apply.)

   • ARisk owner and assigned responsibilities
   • BDetailed remediation code for each risk
   • CRisk description and unique identifier
   • DLikelihood and impact ratings or scores
   Check answers Discussion Select an answer first
6. 25application · medium

   A logistics company's fleet management system is critical to operations. A risk assessment estimates that a ransomware attack could cause a loss of $1,000,000 (SLE) and that such an attack is likely to occur once every 5 years (ARO = 0.2). The company is considering a backup solution that would reduce the SLE to $200,000. The solution costs $50,000 per year. What is the annualized loss expectancy (ALE) after implementing the backup solution?

   • A$200,000
   • B$40,000
   • C$250,000
   • D$50,000
   Reveal Solution Discussion Select an answer first