Risk Anticipation with Risk Management CND Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of maintaining an asset inventory in risk identification?

   • ATo assign monetary values to all assets
   • BTo track software licenses
   • CTo know what assets exist and their importance to the organization
   • DTo comply with data protection regulations
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A financial firm has implemented a risk treatment plan that includes regular patching and employee training. After a year, the firm's risk manager notices that the number of malware infections has decreased, but the number of phishing emails has increased. The risk manager is considering whether to update the risk assessment. Which action is most appropriate?

   • AUpdate the risk assessment to reflect the increased phishing threat and evaluate whether current controls are sufficient.
   • BIncrease the budget for patching because it is the only effective control.
   • CKeep the risk assessment unchanged because the controls are working.
   • DDiscontinue the employee training because it is not preventing phishing emails.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a widely recognized risk management framework used in cybersecurity?

   • ATCP/IP
   • BHTML5
   • CIEEE 802.11
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A hospital has identified a risk of patient data breach due to unencrypted laptops. The risk assessment shows a high likelihood and high impact. The hospital has a limited budget and must choose between purchasing encryption software for all laptops (cost: $20,000) and purchasing cyber insurance (cost: $15,000/year). The hospital's risk tolerance is low. Which treatment option is most appropriate?

   • AAvoid the risk by banning laptops from the hospital.
   • BPurchase encryption software, because it reduces the likelihood and impact of the risk.
   • CPurchase cyber insurance, because it is cheaper and transfers the financial risk.
   • DAccept the risk because the cost of treatment is too high.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of reviewing risk management strategies over time?

   • ATo comply with all international standards
   • BTo ensure the strategies remain effective and relevant
   • CTo reduce the cost of risk management
   • DTo increase the number of risks identified
   Reveal Solution Discussion Select an answer first