Risk Anticipation with Risk Management CND Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the main goal of risk analysis?

   • ATo document risks for auditors
   • BTo prioritize risks based on their potential impact
   • CTo transfer risks to third parties
   • DTo eliminate all risks
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A hospital has implemented a risk treatment plan to reduce the risk of medical device ransomware. The plan includes network segmentation and regular patching. After six months, the security team wants to verify that the controls are effective. Which action is most appropriate?

   • AConduct a vulnerability scan and review segmentation rules against the original design.
   • BWait for an incident to occur to test the controls.
   • CAssume the controls are effective because they were implemented.
   • DUpdate the risk register to mark the risk as accepted.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A multinational company has a risk of data breach due to third-party vendors. The risk manager has identified that the risk is high and has recommended implementing vendor risk assessments. The board of directors is concerned about the cost and wants to know the potential financial impact. The risk manager has prepared a detailed report. Which communication approach is most effective?

   • AWait until the vendor risk assessments are complete before communicating.
   • BPresent a high-level summary with the financial impact and the recommended action, and offer to share the detailed report.
   • CExplain that the risk is too complex for the board to understand.
   • DSend the full detailed report to the board and let them read it.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A large enterprise has implemented a risk treatment plan that includes multi-factor authentication (MFA) for all remote access. After a year, the security team notices that the number of phishing attacks has increased, but the number of successful account compromises has decreased. The team is considering whether to continue the MFA investment. Which action is most appropriate?

   • ADiscontinue MFA because the number of phishing attacks has increased.
   • BContinue the MFA investment because the control is reducing the impact of phishing attacks.
   • CReassess the risk because the increase in phishing attacks means the original risk assessment is invalid.
   • DReplace MFA with a more advanced threat intelligence platform.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A multinational corporation wants to implement a risk management framework that provides a common language for risk and is internationally recognized. The organization also wants to align with ISO/IEC 27001 for information security management. Which framework is most appropriate?

   • ANIST SP 800-37
   • BCOBIT 2019
   • CISO/IEC 27005
   • DITIL 4
   Reveal Solution Discussion Select an answer first