Risk Management and Security Frameworks GSLC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A multinational corporation is subject to the General Data Protection Regulation (GDPR) and needs to demonstrate that it has appropriate technical and organizational measures to protect personal data. The company has implemented a comprehensive risk management program. What is the PRIMARY way this program supports GDPR compliance?

   • AIt guarantees that all personal data is stored within the EU.
   • BIt eliminates the need for a Data Protection Impact Assessment (DPIA).
   • CIt automatically ensures compliance with all GDPR requirements.
   • DIt provides evidence of a systematic approach to identifying and mitigating risks to personal data.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A healthcare organization is subject to HIPAA and must demonstrate compliance with its security rule. The organization has implemented a risk management program but has not formally adopted a security framework. The compliance officer wants to use a framework to help organize and demonstrate compliance. Which framework is MOST appropriate for this purpose?

   • ACOBIT
   • BCIS Controls
   • CISO/IEC 27001
   • DNIST Cybersecurity Framework
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise has a diverse portfolio of risks, including legacy systems with known vulnerabilities, new cloud deployments, and third-party vendor risks. The risk team has limited resources and must prioritize which risks to assess in detail. What is the most effective prioritization strategy?

   • AAssess all risks equally to ensure comprehensive coverage.
   • BFocus on risks with the highest combination of likelihood and impact, regardless of asset value.
   • CDefer assessment of legacy systems because they are scheduled for replacement.
   • DPrioritize based on the criticality of the assets and the potential business impact.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A retail company is considering implementing the NIST Cybersecurity Framework (CSF). The company has a mature security program but wants to improve communication about cybersecurity risk with its board of directors. Which aspect of the NIST CSF would be MOST helpful for this goal?

   • AThe Framework Implementation Tiers describe the rigor of risk management practices.
   • BThe Framework Core's functions (Identify, Protect, Detect, Respond, Recover) provide a common language for discussing risk.
   • CThe Framework's informative references map to other standards.
   • DThe Framework Profiles help align security activities with business requirements.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional bank is conducting its annual risk assessment. The CISO asks the security team to identify assets, threats, and vulnerabilities, then determine the likelihood and impact of potential events. The team has completed the identification and analysis phases. What is the next step in the risk assessment process?

   • AEvaluate the risks against the organization's risk criteria and prioritize them for treatment.
   • BImmediately implement controls for all identified risks to reduce exposure.
   • CCommunicate the risk analysis results to the board for approval before any further action.
   • DDocument the risk assessment methodology and archive the findings for audit purposes.
   Reveal Solution Discussion Select an answer first