Security and Risk Management GISP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a key responsibility of an organization's board of directors or senior management in security governance?

   • ASetting the organization's risk appetite and providing oversight
   • BResponding to security incidents on a help desk
   • CConfiguring firewall rules
   • DPerforming daily backups of critical systems
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An organization is deciding between two risk assessment methodologies for a new project. The project team has limited historical data on the likelihood of cyber events. The risk manager needs to communicate the results to a non-technical board. Which approach is most appropriate?

   • AQuantitative assessment using Monte Carlo simulation to estimate annualized loss expectancy.
   • BSemi-quantitative assessment that assigns numeric scores to qualitative ratings.
   • CDefer the risk assessment until more historical data is collected.
   • DQualitative assessment using a risk matrix that rates likelihood and impact as high, medium, or low.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A healthcare organization uses a third-party cloud provider to store de-identified patient data. The provider announces that it will move data to a jurisdiction with weaker data-protection laws. The organization's legal team confirms that the transfer would violate the organization's obligations under applicable privacy regulations. Which risk response strategy best aligns with the organization's compliance requirements?

   • ATransfer the risk by requiring the provider to sign an indemnification clause.
   • BAccept the risk because the data is de-identified and therefore not subject to privacy regulations.
   • CMitigate the risk by encrypting all data at rest and in transit.
   • DAvoid the risk by moving the data to a provider with data centers in an approved jurisdiction.
   Reveal Solution Discussion Select an answer first
5. 29application · easy

   A risk manager is conducting a risk assessment for a new cloud-based customer relationship management (CRM) system. The team has identified a risk of data breach due to misconfigured cloud storage. What is the NEXT step in the risk management process?

   • AAnalyze the likelihood and impact of the risk.
   • BImplement security controls to mitigate the risk.
   • CMonitor the risk on an ongoing basis.
   • DDocument the risk in the risk register.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which risk assessment methodology uses numerical values, such as monetary amounts and percentages, to calculate risk?

   • AHybrid risk assessment
   • BQualitative risk assessment
   • CQuantitative risk assessment
   • DSemi-quantitative risk assessment
   Reveal Solution Discussion Select an answer first