Managing and Mitigating Cyber Risk GISF Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A small e-commerce company sells handmade crafts online. A risk assessment identifies that a distributed denial-of-service (DDoS) attack could take down the website for hours, causing significant revenue loss. The company has a limited IT budget and no dedicated security staff. Which risk mitigation strategy is most appropriate for this scenario?

   • ADisable the website during peak hours to reduce exposure.
   • BBuild an in-house DDoS mitigation system using open-source tools.
   • CPurchase a DDoS protection service from a cloud provider.
   • DAccept the risk because the company is too small to be targeted.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A government agency is required by law to protect classified information. The agency is considering using a public cloud service for some of its non-classified administrative data. The risk assessment shows that the public cloud provider has strong security controls, but the agency is concerned about the legal requirement that data be stored within the country. The provider offers a region within the country. The agency's risk appetite is low. Which risk treatment approach is most appropriate?

   • AAvoid the public cloud entirely and keep all data on-premises.
   • BUse the public cloud but accept the risk of non-compliance with the data location law.
   • CUse the in-country public cloud region with additional encryption and access controls.
   • DTransfer the risk to the cloud provider by requiring them to sign a compliance guarantee.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A regional bank is conducting its annual cyber risk assessment. The assessment team has identified customer transaction data as a critical asset, a threat actor profile of organized crime groups, and a known vulnerability in the online banking platform. They are now calculating the risk for this scenario. Which combination of factors should the team use to calculate the risk score?

   • AThe likelihood of the threat exploiting the vulnerability multiplied by the impact on the asset if it occurs
   • BThe sum of all threat likelihoods plus the sum of all asset impacts
   • CThe cost of the asset minus the cost of existing security controls
   • DThe number of vulnerabilities in the platform divided by the number of threats identified
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A company is evaluating how to handle a high-risk vulnerability in a customer-facing application. The vulnerability could lead to a data breach, and the company is subject to data protection regulations. Select all that apply: Which risk mitigation strategies are appropriate to consider?

   • ARisk transfer by purchasing cyber insurance
   • BRisk reduction by patching the vulnerability immediately
   • CRisk reduction by implementing a web application firewall (WAF) as a compensating control
   • DRisk avoidance by taking the application offline
   • ERisk acceptance by documenting the risk and taking no action
   Check answers Discussion Select an answer first
6. 5application · medium

   A retail company's security team is reviewing its incident response capabilities. After a recent malware infection, they realized that the antivirus software detected the malware only after it had encrypted several files. The team wants to add a control that detects malware earlier in the infection chain. Which control would best achieve this?

   • AIncrease the frequency of full disk backups.
   • BDeploy endpoint detection and response (EDR) tools that monitor behavioral indicators.
   • CPurchase additional antivirus licenses from a different vendor.
   • DTrain employees to recognize phishing emails.
   Reveal Solution Discussion Select an answer first