Risk Anticipation with Risk Management CND Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it important to communicate risk information to stakeholders?

   • ATo transfer risks to stakeholders
   • BTo satisfy all stakeholder demands
   • CTo hide risks from external parties
   • DTo ensure stakeholders understand risks and support risk management decisions
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A network defender is explaining the role of risk management to a new manager. The manager asks, 'Why do we need a formal risk management process instead of just reacting to security incidents as they occur?' Which response best describes the role of risk management in anticipating threats?

   • ARisk management is primarily about documenting incidents for regulatory compliance.
   • BRisk management is only necessary for organizations that are required to comply with specific regulations.
   • CRisk management ensures that all security incidents are prevented, so the organization does not need to react to them.
   • DRisk management allows the organization to identify and assess potential threats before they occur, enabling proactive mitigation and informed decision-making.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing company wants to identify risks to its industrial control systems (ICS) before a scheduled upgrade. The security team has a limited budget and needs to focus on the most critical assets. Which approach would best support risk identification and prioritization?

   • APurchase a commercial vulnerability scanner and scan all network segments.
   • BCreate an asset inventory and use threat modeling to identify threats to each critical asset.
   • CReview past incident reports and patch logs for the last five years.
   • DInterview senior executives to gather their opinions on the most likely threats.
   Reveal Solution Discussion Select an answer first
5. 9application · medium · select all that apply

   A logistics company wants to identify risks to its supply chain management system. Which methods are appropriate for risk identification? (Select all that apply.)

   • AConducting a threat modeling exercise for the system
   • BReviewing the asset inventory to identify critical components
   • CInterviewing system users about past incidents and concerns
   • DImplementing a firewall to protect the system
   • ECalculating the annualized loss expectancy (ALE) for each asset
   Check answers Discussion Select an answer first
6. 10foundation · easy

   In the context of risk management, what does 'anticipating organizational threats' primarily involve?

   • AProactively identifying potential risks before they materialize
   • BComplying with all regulatory requirements
   • CPurchasing cybersecurity insurance to cover potential losses
   • DResponding quickly to incidents after they occur
   Reveal Solution Discussion Select an answer first