Risk Anticipation with Risk Management CND Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A government contractor must implement a risk management framework that aligns with federal requirements and provides a structured approach to assessing and treating risks. The organization wants a framework that is widely recognized and includes specific steps for risk assessment, risk response, and risk monitoring. Which framework is most appropriate?

   • ACOBIT 2019
   • BITIL 4
   • CISO/IEC 27005
   • DNIST SP 800-37
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A network defender is analyzing two risks for a financial institution. Risk 1 is a data breach that could result in regulatory fines and reputational damage. The likelihood is 10% per year, and the impact is estimated at $5 million. Risk 2 is a system failure that could cause a 1-day outage, with a likelihood of 30% per year and an impact of $1 million. The organization has a risk tolerance of $1 million for any single risk. The defender must prioritize which risk to treat first. Which risk should be treated first, and why?

   • ARisk 1, because its annualized loss expectancy (ALE) is $500,000, which is higher than Risk 2's ALE of $300,000.
   • BRisk 2, because its ALE is $300,000, which is lower than Risk 1's ALE of $500,000, so it is more manageable.
   • CRisk 1, because it has the highest impact.
   • DRisk 2, because it has the highest likelihood.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A multinational corporation has a risk of data breach due to unpatched vulnerabilities. The risk manager has prepared a detailed risk assessment report. Which audience would require the most simplified, high-level summary of the risk?

   • ABoard of directors
   • BNetwork administrators
   • CExternal auditors
   • DIT security team
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of risk management in an organization?

   • ATo eliminate all possible threats to the organization
   • BTo transfer all risks to insurance providers
   • CTo identify, assess, and prioritize risks and apply resources to minimize their impact
   • DTo document past security incidents for compliance purposes
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small business is conducting a risk assessment for its customer database. The owner wants a quick, low-cost method that does not require detailed financial calculations. Which risk assessment method is most appropriate?

   • ARisk avoidance by deleting the customer database
   • BQualitative risk assessment using a likelihood and impact matrix
   • CFormal penetration testing of the database
   • DQuantitative risk assessment using ALE and SLE calculations
   Reveal Solution Discussion Select an answer first