Risk Assessment EDRP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A cloud service provider is assessing risks to its infrastructure. The risk team has identified a potential threat of a misconfigured storage bucket leading to a data breach. The team is using a qualitative risk assessment method. They have rated the likelihood as 'high' and the impact as 'high'. The company's risk matrix classifies this as 'extreme risk'. What is the most appropriate action?

   • AImplement automated configuration checks to prevent misconfigurations
   • BTransfer the risk by purchasing cyber insurance
   • CAccept the risk because it is a cloud environment
   • DDocument the risk and review it annually
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A government agency has completed a risk assessment for its citizen services portal. The findings indicate that a distributed denial-of-service (DDoS) attack is a high-risk event. The agency's DR plan currently includes a backup data center but does not address DDoS mitigation. What is the most important update to the DR plan?

   • ASchedule regular testing of the backup data center
   • BDevelop a communication plan for citizens
   • CIncrease the capacity of the backup data center
   • DAdd a DDoS mitigation service to the DR plan
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing company is performing a risk assessment for its production control system. The system is connected to the internet for remote monitoring. The risk team is identifying threats and vulnerabilities. Which finding represents a vulnerability rather than a threat?

   • AA lightning strike near the facility that could cause a power surge.
   • BAn unpatched firmware version on the control system's programmable logic controllers (PLCs).
   • CA disgruntled employee with administrative access to the control system.
   • DA distributed denial-of-service (DDoS) attack targeting the internet-facing interface.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   After evaluating a risk, an organization decides to implement additional security controls to reduce the likelihood of a cyberattack. Which risk treatment strategy is this?

   • ARisk mitigation
   • BRisk avoidance
   • CRisk transfer
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A logistics company's risk assessment identified a high likelihood of a regional flood affecting its primary warehouse. The warehouse is located in a flood-prone area and houses critical inventory. The company has a secondary warehouse in a safer location but with limited capacity. The risk team must decide on a treatment strategy. Which option best balances risk reduction and operational feasibility?

   • AMove the most critical inventory to the secondary warehouse and implement flood barriers at the primary site.
   • BAccept the risk because the secondary warehouse cannot hold all inventory.
   • CPurchase flood insurance to transfer the financial risk and take no other action.
   • DRelocate the entire operation to the secondary warehouse immediately.
   Reveal Solution Discussion Select an answer first