Managing and Mitigating Cyber Risk GISF Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of implementing a cyber risk management program within an organization?

   • ATo transfer all cyber risks to an insurance provider, removing the need for internal security controls
   • BTo eliminate all cyber threats and ensure no security incidents ever occur
   • CTo comply with all applicable laws and regulations, regardless of the actual risk level
   • DTo identify, assess, and prioritize risks so that resources are allocated effectively to protect the organization
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare provider handles protected health information (PHI) and is subject to HIPAA. They have identified a high risk of data breach through unencrypted laptops. The cost of implementing full-disk encryption is significant but far less than the potential fines and reputational damage. Which risk mitigation strategy should the provider adopt?

   • ARisk reduction by implementing full-disk encryption on all laptops
   • BRisk acceptance by documenting the risk and continuing current practices
   • CRisk transfer by purchasing cyber liability insurance
   • DRisk avoidance by discontinuing the use of laptops entirely
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a corrective security control?

   • AA firewall rule that blocks unauthorized inbound traffic
   • BA security camera that records activity in a server room
   • CA sign warning that unauthorized access is prohibited
   • DA backup and restore procedure that restores data after a ransomware attack
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An organization decides to discontinue a legacy online service that is no longer profitable and poses a high security risk. Which risk mitigation strategy is being applied?

   • ARisk reduction
   • BRisk avoidance
   • CRisk transfer
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A software company stores customer data and is subject to the California Consumer Privacy Act (CCPA). They are designing a new data storage solution. Which requirement must they incorporate into their risk management decisions?

   • AThe ability to transfer data to any country without restrictions
   • BThe ability to delete a consumer's personal information upon request
   • CThe requirement to store data for at least 10 years
   • DThe requirement to use only on-premises storage
   Reveal Solution Discussion Select an answer first