Risk Management and Security Frameworks GSLC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A hospital is evaluating its risk management approach. The IT director proposes implementing a comprehensive security program that includes risk assessment, treatment, and monitoring. The CFO argues that the hospital should focus on purchasing cyber insurance to cover potential breaches. The CISO must decide how to balance these perspectives. What is the most effective approach?

   • ARely primarily on cyber insurance to transfer all risks.
   • BConduct a risk assessment but do not implement any controls.
   • CImplement a risk management program that includes insurance as one of several treatment options.
   • DFocus only on technical controls and ignore insurance.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization has implemented a risk treatment plan to reduce the risk of ransomware. The CISO wants to ensure that the controls remain effective over time and that new risks are identified. What should the CISO do?

   • ARely on the initial risk assessment report and take no further action.
   • BConduct periodic risk reviews and update the risk register with new findings.
   • COnly review the controls if a security incident occurs.
   • DWait until the next annual risk assessment to review the controls.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   An organization decides to purchase cybersecurity insurance to cover potential losses from a data breach. Which risk treatment strategy does this represent?

   • ARisk avoidance
   • BRisk mitigation
   • CRisk transfer
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A startup company has limited resources and is launching a new online service. The founders want to move quickly and are considering skipping the risk assessment to save time. The CISO advises that risk management is essential. What is the most compelling argument the CISO can make?

   • ARisk management will guarantee the success of the new service.
   • BRisk management is required by law for all companies.
   • CRisk management is a standard practice that all competitors use.
   • DRisk management helps identify potential issues that could disrupt the business and ensures resources are focused on the most critical risks.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A manufacturing company is conducting a risk assessment for its production network. The network is isolated from the internet but is connected to the corporate network. The risk assessment team has identified that a malware infection on the corporate network could spread to the production network and cause significant downtime. The team is debating whether to treat this risk by isolating the production network further or by accepting the risk because the likelihood is low. The company's risk tolerance is moderate, and the cost of further isolation is high. What is the BEST decision?

   • AAccept the risk because the likelihood is low and the cost of mitigation is high.
   • BAvoid the risk by disconnecting the production network from the corporate network entirely.
   • CTransfer the risk by purchasing business interruption insurance.
   • DImplement additional network segmentation controls to reduce the likelihood of malware spreading.
   Reveal Solution Discussion Select an answer first