Risk Anticipation with Risk Management CND Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which framework is specifically designed to help organizations integrate cybersecurity risk management with overall enterprise risk management?

   • ACOBIT
   • BITIL
   • COSI Model
   • DNIST Cybersecurity Framework (CSF)
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network defender is tasked with identifying risks to a new IoT deployment in a smart building. The IoT devices include sensors, cameras, and access control systems. The defender wants to identify potential threats and vulnerabilities specific to these devices. Which method is most effective?

   • AConduct a penetration test on the IoT devices to identify exploitable vulnerabilities.
   • BReview the vendor documentation for each IoT device to identify known vulnerabilities.
   • CPerform threat modeling using a structured approach like STRIDE to identify threats to each IoT component.
   • DInterview the building manager about any security incidents that have occurred.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is updating its risk management program. The network defender has been asked to identify potential risks to patient data. The organization uses a mix of on-premises servers and cloud-based EHR systems. Which approach is most effective for identifying risks across the entire environment?

   • AConduct a vulnerability scan of the on-premises servers and patch any identified vulnerabilities.
   • BInterview the IT staff to ask about any security concerns they have observed.
   • CCreate a comprehensive asset inventory that includes all hardware, software, data, and cloud services, and then perform threat modeling on each asset.
   • DReview the organization's incident response plan and update it based on recent security incidents.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An e-commerce company has identified three risks: a SQL injection vulnerability in the web application (likelihood: high, impact: high), a phishing campaign targeting employees (likelihood: medium, impact: medium), and a DDoS attack on the website (likelihood: low, impact: high). The company has limited resources and must prioritize. Which risk should be addressed first?

   • ADDoS attack
   • BPhishing campaign
   • CAll three should be addressed simultaneously.
   • DSQL injection vulnerability
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network defender is updating the organization's risk register after a risk assessment. The defender has identified a new risk that the organization's backup system could fail during a disaster, resulting in data loss. The risk has been assessed as high likelihood and high impact. What is the most important information to include in the risk register for this risk?

   • AThe cost of the backup system and the maintenance schedule.
   • BThe technical details of the backup system, including the vendor and version.
   • CThe risk owner, the likelihood and impact ratings, and the chosen risk treatment option.
   • DThe names of the IT staff responsible for the backup system.
   Reveal Solution Discussion Select an answer first