Risk Assessment EDRP Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A multinational corporation is conducting a risk assessment for its global supply chain management system. The risk team has identified a high-impact risk of a regional data center outage. The company has a risk appetite that allows for some risk in non-critical areas but requires strict mitigation for critical systems. The system is considered critical. The team has two mitigation options: (1) implement a redundant data center in another region, which is expensive but reduces the risk to a low level; (2) purchase a business interruption insurance policy, which is cheaper but does not reduce the likelihood or impact. The company's budget is limited. What is the most appropriate risk treatment decision?

   • AImplement the redundant data center despite the cost
   • BAccept the risk because the budget is limited
   • CPurchase the insurance policy because it is cheaper
   • DDefer the decision until the next budget cycle
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A multinational corporation operates a data center in a region prone to earthquakes. The risk assessment identified a high risk of seismic activity damaging the facility. The estimated impact is $50 million, and the likelihood is 0.02 per year. The corporation's risk tolerance is $1 million. The risk team is evaluating treatment options, but the CFO is concerned about the cost of mitigation. Which approach best balances risk reduction and cost?

   • ATransfer the risk by purchasing earthquake insurance, with no other controls.
   • BAccept the risk because the ALE is exactly at the tolerance level.
   • CRelocate the data center to a seismically stable region immediately.
   • DImplement seismic bracing and redundant cooling systems to reduce the likelihood of damage.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   An organization decides to purchase business interruption insurance to cover potential losses from a natural disaster. Which risk treatment strategy does this represent?

   • ARisk avoidance
   • BRisk transfer
   • CRisk acceptance
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A small e-commerce company is performing its first risk assessment. The company relies on a single cloud provider for hosting and a third-party payment processor. The risk team is identifying threats. Which item is a threat that could impact business operations?

   • AA prolonged outage of the cloud provider's regional data center.
   • BThe payment processor's transaction fee structure.
   • CThe lack of a backup generator at the company's office.
   • DThe company's website code containing a SQL injection flaw.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of a risk assessment in the context of disaster recovery planning?

   • ATo guarantee that all possible disasters are prevented from occurring.
   • BTo identify and evaluate potential threats and vulnerabilities so that the organization can prioritize and implement appropriate mitigation measures.
   • CTo document the organization's recovery time objectives for each critical system.
   • DTo provide a detailed inventory of all hardware and software assets.
   Reveal Solution Discussion Select an answer first