Managing and Mitigating Cyber Risk GISF Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How do legal and regulatory requirements influence an organization's cyber risk management decisions?

   • AThey are optional guidelines that organizations can choose to follow
   • BThey only apply to organizations in the public sector
   • CThey may mandate specific security controls or practices that the organization must implement, regardless of its own risk appetite
   • DThey override all other risk management considerations, making business objectives irrelevant
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a risk assessment, a manufacturing company identifies that a legacy industrial control system (ICS) has a known vulnerability that could allow remote attackers to disrupt production. The system is critical and cannot be patched immediately. Which approach best manages the risk in the short term?

   • AImplement network segmentation and strict access controls to reduce the likelihood of exploitation
   • BIncrease the frequency of backups to reduce the impact of a disruption
   • CDisconnect the system from the network entirely
   • DAccept the risk because the system is legacy and will be replaced soon
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a cyber risk assessment, which step involves determining the potential impact of a threat exploiting a vulnerability?

   • ARisk calculation
   • BAsset identification
   • CThreat identification
   • DVulnerability analysis
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A hospital's IT team is implementing controls to protect patient records. They have already installed an intrusion detection system (IDS) that alerts on suspicious network activity. Now they want to add a control that actively prevents unauthorized access to the electronic health record (EHR) system. Which control should they implement?

   • AA log review process that identifies failed login attempts after they occur.
   • BA data backup procedure that restores EHR data after a ransomware attack.
   • CA security awareness training session for staff on phishing emails.
   • DA network firewall rule that blocks traffic from unauthorized IP addresses to the EHR subnet.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A cloud service provider is assessing the risk of a data breach involving customer data. They have identified a vulnerability in their API that could be exploited by external attackers. The provider is subject to GDPR and must notify regulators within 72 hours of a breach. They are considering whether to implement additional logging and monitoring controls. Which factor is most critical in their risk calculation?

   • AThe likelihood of exploitation and the impact of a breach, including regulatory penalties and notification costs
   • BThe number of customers affected by a potential breach
   • CThe cost of implementing logging and monitoring controls
   • DThe time required to notify regulators
   Reveal Solution Discussion Select an answer first