Security and Risk Management GISP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common topic covered in a security awareness program?

   • AForensic analysis techniques
   • BPhishing and social engineering
   • CAdvanced cryptography algorithms
   • DNetwork routing protocols
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common classification label used for information assets in a typical government or military environment?

   • APublic
   • BTop Secret
   • CInternal
   • DConfidential
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which role is responsible for classifying information and determining who can access it?

   • ASystem administrator
   • BData owner
   • CSecurity auditor
   • DData custodian
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A US-based company processes personal data of EU citizens and is subject to the GDPR. The company uses a third-party processor located in a country not recognized as adequate by the European Commission. Which measure is most appropriate to ensure compliance with GDPR data transfer requirements?

   • AObtain explicit consent from each data subject for the transfer.
   • BRely on the third-party processor's self-certification under the EU-US Data Privacy Framework.
   • CStore all EU data in the EU and only transfer pseudonymized data to the processor.
   • DImplement standard contractual clauses (SCCs) with the processor and conduct a transfer impact assessment.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A hospital's business continuity plan includes a recovery point objective (RPO) of 15 minutes for its electronic health record (EHR) system. The current backup solution performs full backups nightly and transaction log backups every hour. The hospital's risk appetite allows for up to 30 minutes of data loss. Which action is most appropriate?

   • ASwitch to full backups every 6 hours to reduce data loss.
   • BAccept the current backup schedule because the RPO is within the 30-minute risk appetite.
   • CPerform a risk assessment to determine if the RPO can be extended.
   • DIncrease the frequency of transaction log backups to every 10 minutes.
   Reveal Solution Discussion Select an answer first