Risk Assessment EDRP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After completing a risk assessment, a retail company's risk manager must document the findings and integrate them into the disaster recovery plan. The documentation should include the identified risks, their likelihood and impact, and the chosen treatment strategies. Which additional element is essential to include in the risk assessment report to ensure the DR plan remains actionable?

   • AThe version number of the risk assessment software used.
   • BThe risk owner and the target date for implementing each treatment action.
   • CThe names of all employees who participated in the risk assessment workshops.
   • DThe organization's mission statement and strategic goals.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of documenting risk assessment findings in the disaster recovery plan?

   • ATo replace the need for ongoing risk monitoring.
   • BTo provide a historical record of past incidents for legal purposes.
   • CTo satisfy regulatory compliance requirements only.
   • DTo ensure that the risk assessment process is repeatable and that findings are communicated to stakeholders.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services firm is evaluating risks to its trading platform. The risk assessment identified a potential DDoS attack with a high likelihood and high impact. The firm has a limited budget for risk treatment. Which of the following is the most cost-effective mitigation strategy?

   • AAccept the risk because the budget is limited
   • BPurchase a business interruption insurance policy
   • CDevelop a detailed incident response plan only
   • DImplement a DDoS protection service
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company is performing a risk assessment for its production control systems. The team has identified a potential failure of the cooling system in the server room as a threat. Which of the following would be the most appropriate way to characterize this threat in the risk assessment?

   • AAs a control because it can be mitigated by a backup generator
   • BAs a threat event that could exploit a vulnerability in the cooling system
   • CAs a vulnerability because it is a weakness in the physical environment
   • DAs a risk because it has a probability and impact
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an example of a threat that could impact business operations?

   • AA fire in the data center.
   • BA weak password policy.
   • CA lack of employee training on security procedures.
   • DAn unpatched software vulnerability.
   Reveal Solution Discussion Select an answer first