Managing and Mitigating Cyber Risk GISF Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A utility company operates both corporate IT and industrial control systems (ICS) for power generation. The security team is designing a monitoring solution. They have a limited number of security analysts and need to detect both external attacks and insider threats. The ICS network has legacy equipment that cannot support modern security agents. The corporate network has modern endpoints that can support agents. Which approach best balances detection coverage and resource constraints?

   • AFocus all monitoring on the corporate network and ignore the ICS network.
   • BUse only network-based monitoring for both networks to simplify management.
   • CDeploy endpoint agents on the ICS network and rely on them for all monitoring.
   • DDeploy network-based monitoring on the ICS network and endpoint agents on the corporate network.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which statement best defines cyber risk in the context of organizational risk management?

   • AThe number of vulnerabilities present in an organization's IT systems
   • BThe total cost of all security controls implemented by an organization
   • CThe certainty that a specific cyberattack will occur and result in a data breach
   • DThe likelihood that a threat will exploit a vulnerability, potentially causing harm to an organization's assets or objectives
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A global company is subject to both GDPR and the U.S. Health Insurance Portability and Accountability Act (HIPAA). They are evaluating a cloud storage provider that offers data centers in the EU and the U.S. The company wants to minimize compliance risk while maintaining performance. What should they do?

   • AStore EU personal data in EU data centers and U.S. health data in U.S. data centers, ensuring appropriate safeguards for any cross-border transfers
   • BUse a single global data center to reduce costs
   • CStore all data in the U.S. to simplify management
   • DStore all data in the EU to ensure GDPR compliance
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   A company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). How does this contractual/regulatory requirement affect its risk mitigation approach?

   • AIt only applies if the company experiences a data breach
   • BIt requires the company to implement specific security controls, such as encryption and access controls, to protect cardholder data
   • CIt has no impact on risk management because it is a voluntary industry guideline
   • DIt allows the company to accept any level of risk as long as it discloses the risk to customers
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of periodically reviewing and updating the organization's risk management process?

   • ATo permanently eliminate all identified risks
   • BTo satisfy auditors without making any actual changes to security practices
   • CTo ensure the process remains aligned with current business objectives, threat landscape, and regulatory requirements
   • DTo replace the need for continuous monitoring
   Reveal Solution Discussion Select an answer first