Risk Management CCT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization is conducting a risk assessment for its new telehealth platform. The risk team needs to quickly categorize risks based on subjective ratings of likelihood and impact, without detailed financial data. Which risk assessment methodology should they use?

   • AQualitative risk assessment using a likelihood-impact matrix.
   • BAnnualized loss expectancy (ALE) analysis based on historical breach data.
   • CBusiness impact analysis (BIA) focused solely on recovery time objectives.
   • DQuantitative risk assessment using SLE and ALE calculations.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company has adopted the NIST RMF and is in the 'Monitor' step. The security team has implemented continuous monitoring tools that generate alerts for new vulnerabilities and misconfigurations. What is the primary purpose of this monitoring activity in the context of risk management?

   • ATo replace the need for periodic risk assessments.
   • BTo detect changes in the risk environment and ensure that risk responses remain effective.
   • CTo document risks for compliance audits only.
   • DTo automatically mitigate all identified risks without human intervention.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is continuous risk monitoring important in risk management?

   • AIt eliminates the need for periodic risk assessments
   • BIt ensures that risks are identified once and never change
   • CIt allows the organization to detect changes in the risk landscape and adjust controls accordingly
   • DIt guarantees that all risks will be fully eliminated
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A hospital's patient portal is vulnerable to a ransomware attack. The estimated ALE is $1,200,000. The hospital is considering two options: (1) purchasing cybersecurity insurance with an annual premium of $100,000, or (2) implementing an advanced endpoint detection and response (EDR) solution that costs $150,000 per year and is expected to reduce the ALE by 90%. Which option is more cost-effective based on quantitative analysis?

   • AThe EDR solution, because the residual risk after mitigation is $120,000, making the total annual cost $270,000, which is higher than the insurance premium.
   • BThe EDR solution, because it reduces the ALE to $120,000, which is lower than the insurance premium.
   • CThe insurance, because the annual cost of $100,000 is lower than the EDR's total annual cost of $270,000.
   • DThe insurance, because it eliminates the risk entirely.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A risk manager is updating the organization's risk register after a quarterly review. Which of the following should be included in the risk register for each risk?

   • AThe detailed financial statements of the organization
   • BOnly the risk description and the owner's name
   • CThe organization's marketing strategy
   • DRisk description, likelihood, impact, and current mitigation status
   Reveal Solution Discussion Select an answer first