Information Assurance and Risk Management CEH Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is conducting a risk assessment for a new web application. They identify a critical vulnerability that could allow SQL injection. The team estimates that the likelihood of exploitation is high and the impact is high. The organization's risk appetite is moderate. Which of the following is the most appropriate risk treatment decision?

   • AMitigate the risk by implementing input validation and parameterized queries
   • BTransfer the risk by purchasing insurance
   • CAccept the risk because the application is not critical
   • DAvoid the risk by taking the application offline
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company wants to prioritize its security investments. The risk team has identified three risks: Risk A has a 30% likelihood and a $200,000 impact; Risk B has a 10% likelihood and a $1,000,000 impact; Risk C has a 50% likelihood and a $50,000 impact. Using a quantitative approach, which risk should be prioritized first?

   • ARisk C
   • BRisk B
   • CRisk A
   • DAll risks have equal priority
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large enterprise is deciding between NIST RMF and ISO 31000 for its risk management program. The enterprise operates in a highly regulated industry and must demonstrate compliance to auditors. The CISO wants a framework that provides a structured, auditable process. Which framework should be chosen?

   • ANIST RMF, because it provides a structured, auditable process
   • BISO 31000, because it is more flexible
   • COCTAVE, because it is a risk assessment methodology
   • DCOBIT, because it focuses on IT governance
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is implementing a new security policy that requires all employees to use multi-factor authentication (MFA) for remote access. The policy is approved by management. What is the next step to ensure the policy is effectively enforced?

   • AConduct a one-time training session on MFA
   • BDevelop a standard that specifies the MFA technology and configuration
   • CPublish the policy on the company intranet
   • DCreate a guideline recommending MFA usage
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In quantitative risk assessment, how is risk typically calculated?

   • ARisk = Likelihood × Impact
   • BRisk = Threat × Vulnerability
   • CRisk = Asset Value ÷ Threat Level
   • DRisk = Impact − Likelihood
   Reveal Solution Discussion Select an answer first