Managing and Mitigating Cyber Risk GISF Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A software development company stores source code in a cloud repository. A new contract with a client requires that all source code be encrypted at rest and that access be logged. The company's current cloud provider offers encryption by default and access logging. What is the company's primary obligation under this contractual requirement?

   • ARequest a waiver from the client because the provider already encrypts data.
   • BVerify that the provider's default encryption and logging meet the contract's specific requirements.
   • CAssume the provider's default settings are sufficient because they are industry standard.
   • DMove the source code to an on-premises server to avoid cloud compliance issues.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A hospital is evaluating the risk of ransomware attacks on its patient records. The IT director proposes purchasing cyber insurance to cover potential ransom payments and business interruption costs. The compliance officer notes that insurance does not reduce the likelihood of an attack and that HIPAA requires safeguards to protect ePHI. The hospital has a limited budget. Which approach best balances risk transfer and compliance?

   • APurchase cyber insurance only, since it covers the financial impact
   • BImplement all possible technical controls and forgo insurance to save costs
   • CAccept the risk because insurance is too expensive and controls are not guaranteed
   • DPurchase cyber insurance and implement essential technical safeguards such as email filtering and endpoint protection
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A manufacturing company relies on a legacy system that is critical to production. The system has known vulnerabilities that cannot be patched because the vendor no longer supports it. The company has a low risk tolerance and cannot afford to replace the system this year. Which combination of strategies best manages the risk?

   • AImplement network segmentation, monitor the system closely, and accept the residual risk
   • BPurchase cyber insurance to cover potential losses
   • CReplace the system immediately, even if it exceeds the budget
   • DDisconnect the system from the network and operate it in isolation
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has implemented a risk management program and conducted an initial risk assessment. Six months later, they have deployed new cloud services and changed their business processes. What should the risk management team do to ensure the program remains effective?

   • AOnly monitor the new cloud services, ignoring existing on-premises systems
   • BContinue with the existing risk register without updates until the next annual review
   • CRemove all previously identified risks because the environment has changed
   • DConduct a new risk assessment to identify new assets, threats, and vulnerabilities introduced by the changes
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization has implemented a risk management program and is required by regulation to review its risk posture regularly. The security team has set up automated vulnerability scanning and weekly review meetings. However, the team notices that new critical vulnerabilities are being disclosed daily, and some are not covered by the current scanning tools. What should the team do to improve its risk monitoring?

   • AIncrease the frequency of vulnerability scans to every hour.
   • BWait for the next quarterly risk review to address new vulnerabilities.
   • CSubscribe to threat intelligence feeds and incorporate emerging vulnerability information into the monitoring process.
   • DDisable the automated scanning because it is not catching all vulnerabilities.
   Reveal Solution Discussion Select an answer first