Risk Anticipation with Risk Management CND Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A network defender has identified a critical vulnerability in the organization's customer database. The vulnerability could allow an attacker to access sensitive customer information. The defender has assessed the risk as high likelihood and high impact. The organization's risk committee is meeting next week to decide on treatment options. The defender wants to ensure that the risk is properly communicated and documented. What is the most appropriate action?

   • ASend an email to the risk committee with a link to the vulnerability scan report.
   • BWait for the committee meeting to discuss the risk verbally.
   • CPrepare a risk assessment report that includes the risk description, likelihood, impact, and recommended treatment options, and present it to the committee.
   • DImplement a temporary workaround to reduce the risk and then inform the committee.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In risk assessment, what does 'likelihood' refer to?

   • AThe potential financial loss if a risk occurs
   • BThe number of vulnerabilities in a system
   • CThe probability that a threat will exploit a vulnerability
   • DThe severity of the impact on business operations
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which risk assessment approach uses numerical values to calculate risk scores?

   • AQuantitative assessment
   • BVulnerability assessment
   • CCompliance assessment
   • DQualitative assessment
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A retail company's risk assessment identified a high risk of credit card data theft from point-of-sale (POS) systems. The CISO has decided to implement network segmentation and encryption. The board of directors needs to understand the financial impact and the rationale for the investment. What should the risk manager do?

   • ASend the board a copy of the technical vulnerability scan results.
   • BUpdate the risk register but do not share it with the board because it is confidential.
   • CPrepare a risk report that explains the risk, the treatment options considered, and the expected reduction in risk.
   • DWait until the controls are fully implemented before communicating the risk.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A retail company has implemented a risk treatment plan to mitigate the risk of point-of-sale (POS) malware by deploying endpoint protection and network segmentation. Six months later, the network defender wants to verify that the risk has been reduced as expected. What is the most appropriate action?

   • AReview the logs from the endpoint protection and network segmentation devices to ensure they are functioning correctly.
   • BConduct a new risk assessment to re-evaluate the likelihood and impact of POS malware, and compare the results with the original assessment.
   • CUpdate the risk register with the new controls and mark the risk as 'treated'.
   • DWait for the next scheduled annual risk assessment to see if the risk has changed.
   Reveal Solution Discussion Select an answer first