Risk Management and Security Frameworks GSLC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A manufacturing company has completed a risk assessment and identified that its legacy industrial control systems (ICS) have unpatched vulnerabilities. The CISO needs to communicate this risk to the plant operations manager, who is not technically savvy. What is the MOST effective way to communicate this risk?

   • AEscalate directly to the board of directors, bypassing the plant manager.
   • BPresent the risk in terms of potential production downtime and safety impact, using non-technical language.
   • CProvide a detailed list of CVEs and exploit details to demonstrate the severity.
   • DSend a formal email with the full risk assessment report and ask for a response.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A multinational corporation operates in multiple countries with varying data protection laws. The company wants to adopt a single security framework that can be applied consistently across all subsidiaries while satisfying local regulatory requirements. Which approach is the most effective?

   • AUse different frameworks in each country to meet local regulations exactly.
   • BAdopt ISO/IEC 27001 as a baseline and map local regulatory requirements to its controls.
   • CRely on each subsidiary's existing practices without a common framework.
   • DImplement only the NIST Cybersecurity Framework globally.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A public utility company is subject to a new regulation that requires it to demonstrate a formal, documented process for identifying and managing cybersecurity risks. The company already has a risk register and conducts annual risk assessments. What is the MOST important additional step to satisfy the regulation?

   • AImplement a new security framework such as NIST CSF.
   • BPurchase cyber insurance to cover potential losses.
   • CEstablish a formal risk management policy that defines roles, responsibilities, and the risk assessment process.
   • DIncrease the frequency of risk assessments to quarterly.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has identified a high-risk vulnerability in its customer database that could lead to a major data breach. The cost to fix the vulnerability is significant, and the company is considering accepting the risk because the likelihood of exploitation is low. However, the regulatory environment is strict, and a breach would result in heavy fines. What is the most appropriate decision?

   • ATransfer the risk by purchasing cyber insurance.
   • BAvoid the risk by discontinuing the customer database.
   • CMitigate the risk by implementing controls, even if the cost is high.
   • DAccept the risk because the likelihood is low and the cost of mitigation is high.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A software development company is conducting a risk assessment for a new customer-facing application. The team has identified that the application stores sensitive customer data and that a data breach could result in regulatory fines and reputational damage. They have analyzed the likelihood and impact and determined the risk level. What should the team do next?

   • AImplement encryption and access controls immediately to reduce the risk.
   • BReport the risk to the CEO and ask for a decision on whether to launch the application.
   • CEvaluate the risk against the company's risk tolerance and decide whether to accept, mitigate, transfer, or avoid it.
   • DDocument the risk in the risk register and move on to the next risk.
   Reveal Solution Discussion Select an answer first