Managing and Mitigating Cyber Risk GISF Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   A company purchases a cyber insurance policy to cover potential financial losses from a data breach. Which risk mitigation strategy does this represent?

   • ARisk avoidance
   • BRisk transfer
   • CRisk reduction
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company wants to ensure that only authorized personnel can access a sensitive database. Which control type should they implement?

   • ADetective control such as audit logging
   • BPreventive control such as role-based access control (RBAC)
   • CCorrective control such as incident response procedures
   • DDeterrent control such as warning banners
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company's risk management team has completed a risk assessment and implemented mitigation measures. To ensure the measures remain effective over time, what should they do?

   • ASchedule periodic reviews and update the risk register based on changes in the threat landscape
   • BOnly review the risk register after a security incident occurs
   • CRely on the initial assessment because the environment is unlikely to change
   • DFreeze the risk register to maintain a stable baseline
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A multinational bank operates in several countries, each with its own data protection regulations. The bank is planning to centralize its customer data in a single cloud region to reduce costs. The legal team identifies that one country's regulations require customer data to remain within that country's borders. The bank's security team is concerned about the risk of unauthorized access to the centralized data. Which approach best balances regulatory compliance, cost, and security?

   • AStore all data on-premises at the bank's headquarters to avoid cloud compliance issues.
   • BKeep the data for that country in a local cloud region and centralize the rest, applying strong encryption and access controls.
   • CCentralize all data in the single cloud region and rely on the cloud provider's compliance certifications.
   • DBuild a private cloud in each country to ensure full compliance and security.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A multinational company processes personal data of EU citizens and is subject to GDPR. The company is considering storing the data in a public cloud region located in the EU. The legal team confirms that the chosen region meets GDPR data residency requirements. However, the company's security team is concerned about the cloud provider's access to the data. Which additional measure best addresses the security team's concern while maintaining compliance?

   • ARely on the cloud provider's compliance certifications without additional controls.
   • BUse a private cloud model with dedicated hardware to ensure full control.
   • CMove the data to an on-premises data center outside the EU to avoid cloud risks.
   • DImplement customer-managed encryption keys for the data stored in the cloud.
   Reveal Solution Discussion Select an answer first