Managing and Mitigating Cyber Risk GISF Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm is required by regulators to maintain a certain level of cybersecurity insurance. They have identified a risk that is too costly to mitigate fully. Which strategy should they use to address the residual risk?

   • ARisk acceptance by documenting the risk and taking no further action
   • BRisk avoidance by discontinuing the business process that creates the risk
   • CRisk reduction by implementing all possible controls regardless of cost
   • DRisk transfer by purchasing cyber liability insurance
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A startup is developing a mobile app that collects user location data. The founders want to minimize cyber risk but have limited resources. They are deciding which risks to address first. The risk assessment shows that a data breach could result in regulatory fines and loss of user trust, while a temporary app outage would cause minor inconvenience. Which approach best aligns with the startup's limited resources?

   • ATreat both risks equally because all risks matter.
   • BIgnore both risks until the app has more users.
   • CPrioritize mitigating the data breach risk because it has higher impact and regulatory consequences.
   • DAddress the app outage first because it is easier to fix.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A bank is designing a new online banking platform. They must balance customer convenience with security. They are considering implementing multi-factor authentication (MFA) for all users. The marketing team is concerned that MFA will reduce user adoption. The compliance team notes that regulators require strong authentication for financial transactions. What is the best approach?

   • ADelay MFA implementation until customer feedback is collected
   • BUse a risk-based authentication system that prompts for MFA only when unusual activity is detected
   • CImplement MFA for all users, with a user-friendly method such as push notifications, and educate customers on its importance
   • DImplement MFA only for high-value transactions to minimize friction
   Reveal Solution Discussion Select an answer first
5. 9expert · hard · select all that apply

   A company has implemented a risk management program and is now in the monitoring phase. They have deployed new IoT devices and a new cloud-based CRM system. Select all that apply: Which actions should they take to ensure the risk management process remains effective?

   • AWait for the next scheduled annual review to address the changes
   • BUpdate the risk register with the new assets and associated risks
   • CFreeze the risk register to maintain a stable baseline
   • DReview and adjust security controls based on the new risk assessment
   • EConduct a new risk assessment to identify risks introduced by the IoT devices and CRM system
   Check answers Discussion Select an answer first
6. 10application · medium

   A university's IT department is performing a risk assessment for its student records system. They have identified that the system contains sensitive personal data, the primary threat is a ransomware attack, and the system has a known vulnerability in its web interface. The team calculates the likelihood as high and the impact as high. According to standard risk calculation, what is the next step in the risk assessment process?

   • AImmediately implement a firewall to block all external access to the web interface.
   • BDocument the vulnerability and move on to the next asset.
   • CReport the risk to the board and ask for more budget.
   • DDetermine the risk level by combining likelihood and impact, then compare it to the university's risk appetite.
   Reveal Solution Discussion Select an answer first