Risk Anticipation with Risk Management CND Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A regional bank is conducting a risk assessment for its new mobile banking application. The security team has identified a vulnerability in the third-party payment API that could allow unauthorized transactions. The team estimates the vulnerability has a 20% chance of being exploited in the next year, and if exploited, the financial loss would be $500,000. The bank's risk tolerance threshold for high-impact risks is $100,000. Which action should the team take first?

   • ACalculate the annualized loss expectancy (ALE) and compare it to the risk tolerance threshold.
   • BImmediately implement a web application firewall (WAF) rule to block the vulnerable API endpoint.
   • CTransfer the risk by purchasing cyber insurance for the full $500,000.
   • DAccept the risk because the probability is only 20%.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A network defender has implemented a risk treatment plan to reduce the risk of phishing attacks by deploying email filtering and conducting security awareness training. After six months, the defender wants to evaluate the effectiveness of the treatment. The defender has collected data on the number of phishing emails that reached users' inboxes and the number of users who clicked on a phishing link. What is the most appropriate way to evaluate the effectiveness?

   • AReview the logs from the email filter to see how many emails were blocked.
   • BCompare the number of users who clicked on a phishing link before and after the treatment.
   • CCompare the number of phishing emails that reached inboxes before and after the treatment.
   • DConduct a simulated phishing campaign and measure the click rate, then compare it to the baseline.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of documenting the risk management process?

   • ATo create a marketing document for customers
   • BTo replace the need for risk assessments
   • CTo transfer risks to third parties
   • DTo provide a record for audits and future reference
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A university has a risk of student data exposure due to a misconfigured cloud storage. The risk assessment shows a likelihood of 3 (moderate) and an impact of 4 (major) on a 5-point scale. The university's risk criteria state that any risk with a score of 12 or higher requires treatment. What should the university do?

   • ATransfer the risk to a third-party cloud provider.
   • BAccept the risk because the score is below the threshold.
   • CTreat the risk because the score is 12, which meets the threshold.
   • DReassess the risk using a different scale.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network defender has completed a risk assessment for a new cloud-based customer relationship management (CRM) system. The assessment identified a high-risk vulnerability in the CRM's authentication mechanism. The defender needs to communicate this risk to the executive team, who are not technical. What is the most effective way to communicate this risk?

   • APresent a detailed technical report that includes the CVE identifiers, exploit code, and proof-of-concept details.
   • BSend an email to the executive team with a link to the full risk assessment document and ask them to review it.
   • CSchedule a meeting with the IT team to discuss the technical details and then have the IT team inform the executives.
   • DProvide a summary that explains the potential business impact, the likelihood of exploitation, and the recommended treatment options in non-technical language.
   Reveal Solution Discussion Select an answer first