Risk Management and Security Frameworks GSLC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of the NIST Cybersecurity Framework (CSF)?

   • ATo serve as a legal requirement for all organizations
   • BTo prescribe a specific set of software products that must be used
   • CTo replace all other security frameworks
   • DTo provide a risk-based approach for organizations to manage and reduce cybersecurity risk
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large enterprise has implemented a risk management program and identified a high-risk vulnerability in a legacy system that cannot be patched. The system is critical to operations. The CISO must communicate this risk to the executive team, who are focused on cost and operational continuity. The CISO has decided to accept the risk but wants to ensure ongoing monitoring. What is the MOST appropriate way to communicate and monitor this risk?

   • AQuietly accept the risk and document it in the risk register without informing the executive team.
   • BTransfer the risk by purchasing insurance and inform the executive team that the risk is covered.
   • CPresent the risk to the executive team with a clear explanation of the business impact, and implement compensating controls with regular reporting.
   • DSend a detailed technical report to the executive team and ask them to approve the risk acceptance.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A government agency has implemented a risk management program and identified a high-risk vulnerability in a public-facing web application. The agency has a low risk tolerance and must report to a congressional oversight committee. The CISO needs to communicate the risk and the agency's response to the committee, which is not technically sophisticated. What is the MOST effective way to communicate this risk?

   • AExplain the risk in terms of potential impact on citizens' data and the steps being taken to mitigate it.
   • BBlame the previous administration for the vulnerability.
   • CProvide a detailed technical briefing on the vulnerability and exploit techniques.
   • DState that the risk is being handled and provide no further details.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A mid-sized e-commerce company wants to improve its security posture but has limited staff and budget. The company is not required to comply with a specific security standard but wants a practical, prioritized list of actions to implement. Which framework would be the most suitable?

   • ACIS Controls
   • BCOBIT
   • CISO/IEC 27001
   • DNIST Cybersecurity Framework
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a risk assessment for a hospital's patient portal, the team identifies that the portal is vulnerable to a denial-of-service attack that could prevent patients from accessing their medical records. The team determines that the likelihood is low because the portal is behind a DDoS protection service, but the impact is high because patients rely on the portal for critical services. According to the risk assessment process, what should the team do after scoring the risk?

   • AAccept the risk because the likelihood is low.
   • BEvaluate the risk score against the hospital's risk acceptance criteria to decide if further action is needed.
   • CTreat the risk by implementing additional DDoS mitigation controls.
   • DCommunicate the risk to the hospital's board of directors immediately.
   Reveal Solution Discussion Select an answer first