Risk Assessment EDRP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare provider is updating its risk assessment. The organization uses an electronic health record (EHR) system and also stores physical patient files. The risk team is identifying threats and vulnerabilities. Which scenario represents a threat that could exploit a vulnerability?

   • AA phishing email is sent to an employee who has not received security awareness training.
   • BA vendor fails to deliver new computers on time.
   • CA power outage occurs due to a regional storm.
   • DA fire in the server room destroys the EHR servers.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After completing a risk assessment for a logistics company, the risk team has documented the findings. What is the primary purpose of integrating these findings into the disaster recovery plan?

   • ATo provide a basis for prioritizing recovery strategies and resource allocation
   • BTo satisfy regulatory compliance requirements
   • CTo replace the need for regular risk assessments
   • DTo create a historical record for auditors only
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A hospital's risk assessment identified a high likelihood of a ransomware attack on its imaging systems. The estimated impact is $2 million, and the likelihood is 0.1 per year. The hospital's risk tolerance is $150,000. The risk team is evaluating treatment options. Which option is most aligned with the hospital's risk tolerance?

   • ADisconnect the imaging systems from the network to eliminate the risk.
   • BPurchase cyber insurance to transfer the financial risk, with no other controls.
   • CAccept the risk because the ALE is $200,000, which is close to the tolerance.
   • DImplement offline backups and staff training to reduce the likelihood and impact.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial institution has completed a risk assessment and is updating its disaster recovery plan. The assessment identified a high risk of a ransomware attack. The DR plan must include the risk treatment decisions. Which information should be documented to ensure the DR plan is complete?

   • AThe risk owner, the selected treatment (e.g., mitigation, transfer), and the residual risk level after treatment.
   • BThe names of all employees who attended the risk assessment meeting.
   • CThe cost of the risk assessment project itself.
   • DThe technical details of the ransomware strain and its encryption algorithm.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a vulnerability that could be exploited by a threat?

   • AA hurricane that could flood the facility.
   • BA disgruntled employee who might sabotage systems.
   • CAn outdated operating system with known security flaws.
   • DA power outage that could last for several hours.
   Reveal Solution Discussion Select an answer first