A European online retailer processes personal data of EU citizens. The data protection officer (DPO) is reviewing the risk management process to ensure compliance with GDPR. Which practice is most directly required by GDPR as part of risk management?

Performing annual penetration tests on all systems

Purchasing cyber insurance to cover potential fines

Implementing a quantitative risk assessment for all processing activities

Conducting a data protection impact assessment (DPIA) for high-risk processing activities

A security team is performing a risk assessment using a qualitative approach. They categorize the likelihood of a data breach as 'high' and the impact as 'critical'. According to a risk matrix, this combination results in a 'severe' risk rating. What is the primary advantage of using this qualitative approach over a quantitative one?

It is more objective than quantitative assessment

It provides precise monetary values for risk

It is faster and easier to perform when data is scarce

It eliminates the need for risk mitigation

During a risk assessment, a security analyst identifies that a legacy application has a known vulnerability that could allow remote code execution. The application is critical to business operations and cannot be patched immediately. Which of the following best describes the vulnerability in this scenario?

The weakness in the application that could be exploited

The threat actor who might exploit the vulnerability

The likelihood that the vulnerability will be exploited

The potential impact if the vulnerability is exploited

A company is implementing ISO 27001 and needs to define a set of documents that support the information security management system (ISMS). The company wants to ensure that the documents are aligned with the organization's risk management process. Which document hierarchy is most appropriate?

Guideline, procedure, standard, policy

Policy, standard, procedure, guideline

Procedure, policy, guideline, standard

Standard, policy, procedure, guideline

EC-CouncilCertified Ethical Hacker

Domain 1Objective 7

Information Assurance and Risk Management CEH Practice Questions (Page 6)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 26–30

26application · medium
A European online retailer processes personal data of EU citizens. The data protection officer (DPO) is reviewing the risk management process to ensure compliance with GDPR. Which practice is most directly required by GDPR as part of risk management?
Select an answer first
27application · medium
A security team is performing a risk assessment using a qualitative approach. They categorize the likelihood of a data breach as 'high' and the impact as 'critical'. According to a risk matrix, this combination results in a 'severe' risk rating. What is the primary advantage of using this qualitative approach over a quantitative one?
Select an answer first
28application · medium
During a risk assessment, a security analyst identifies that a legacy application has a known vulnerability that could allow remote code execution. The application is critical to business operations and cannot be patched immediately. Which of the following best describes the vulnerability in this scenario?
Select an answer first
29expert · hard
A company is implementing ISO 27001 and needs to define a set of documents that support the information security management system (ISMS). The company wants to ensure that the documents are aligned with the organization's risk management process. Which document hierarchy is most appropriate?
Select an answer first
30foundation · easy
Which risk management framework is published by the National Institute of Standards and Technology and is widely used by US federal agencies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Information Assurance and Risk Management CEH Practice Questions (Page 6)

Questions 26–30

A European online retailer processes personal data of EU citizens. The data protection officer (DPO) is reviewing the risk management process to ensure compliance with GDPR. Which practice is most directly required by GDPR as part of risk management?

A company is implementing ISO 27001 and needs to define a set of documents that support the information security management system (ISMS). The company wants to ensure that the documents are aligned with the organization's risk management process. Which document hierarchy is most appropriate?

Which risk management framework is published by the National Institute of Standards and Technology and is widely used by US federal agencies?

Keep studying — Information Security and Ethical Hacking Overview