Risk Management and Security Frameworks GSLC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which sequence correctly represents the main steps of the risk assessment process?

   • ARisk treatment, risk analysis, risk identification
   • BRisk identification, risk analysis, risk evaluation
   • CRisk analysis, risk evaluation, risk identification
   • DRisk evaluation, risk identification, risk analysis
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A regional bank is conducting a risk assessment of its new mobile banking application. The assessment team has identified that the app's session tokens are generated using a weak random number generator, which could allow an attacker to predict and hijack user sessions. During the risk analysis phase, the team assigns a likelihood score of 4 (high) and an impact score of 5 (critical). According to standard risk assessment methodology, what should the team do NEXT?

   • ACalculate the risk score by multiplying likelihood and impact, then compare it against the bank's risk acceptance criteria.
   • BImmediately implement a fix to replace the random number generator with a cryptographically secure one.
   • CDocument the risk in the risk register and move on to the next asset.
   • DReport the finding to the board of directors for approval of additional budget.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   During which step of the risk assessment process does an organization determine the level of risk for each identified risk?

   • ARisk treatment
   • BRisk analysis
   • CRisk identification
   • DRisk evaluation
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's board of directors wants to ensure that security risks are managed in alignment with the organization's business objectives and that the security strategy is reviewed regularly. Which governance practice would best support this requirement?

   • APurchase cyber insurance to cover all potential losses.
   • BDelegate all security decisions to the IT department.
   • CEstablish a security steering committee that meets quarterly to review risk posture and strategy.
   • DConduct a one-time risk assessment and present it to the board.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization is evaluating how to handle the risk of a ransomware attack on its patient records system. The organization has determined that the cost of implementing robust offline backups and recovery procedures is significantly lower than the potential fines and reputational damage from a data breach. Which risk treatment strategy is the organization applying?

   • ARisk transfer
   • BRisk avoidance
   • CRisk acceptance
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first