Risk Management and Security Frameworks GSLC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A hospital is conducting a risk assessment for its new telemedicine platform. The platform will store sensitive patient health information and be accessible via the internet. The risk assessment team has identified a critical vulnerability in the platform's authentication mechanism. The team has limited resources and must decide whether to fix the vulnerability immediately or wait for the next scheduled release. The vulnerability has a high likelihood of exploitation and a high impact on patient privacy. The hospital's risk tolerance is low. What is the BEST course of action?

   • ATransfer the risk by purchasing cyber insurance before launching.
   • BLaunch the platform as scheduled and accept the risk because the team is resource-constrained.
   • CMitigate the risk by adding a warning message to the login page.
   • DPrioritize fixing the vulnerability before the platform goes live, even if it delays the launch.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team has completed a risk assessment and presented the findings to senior management. Management is concerned about the number of high-risk items and asks the team to reduce the risk levels quickly. The team has limited time and budget. What is the most effective approach to address management's concern?

   • APrioritize risks based on cost-benefit analysis and implement the most cost-effective controls.
   • BImplement quick fixes for the most critical risks and communicate the residual risk.
   • CRe-evaluate the risk assessment to lower the risk levels.
   • DAccept all risks and inform management that no action is needed.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's risk management process is well-established, but the board of directors is not receiving regular updates on the effectiveness of the security program. The CISO wants to improve governance by providing meaningful metrics to the board. What is the most effective metric to report?

   • ANumber of security incidents in the past year
   • BPercentage of critical risks with mitigation plans in place
   • CTotal amount spent on security tools
   • DNumber of security staff hired
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In the context of organizational security, what does 'risk' represent?

   • AThe cost of implementing all possible security controls
   • BThe certainty that a specific threat will exploit a vulnerability
   • CThe total number of vulnerabilities present in a system
   • DThe potential for loss or damage when a threat exploits a vulnerability
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which risk treatment strategy involves discontinuing the activity that creates the risk?

   • ARisk transfer
   • BRisk avoidance
   • CRisk acceptance
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first