Risk Management CCOA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A hospital's IT department has identified a critical vulnerability in its patient portal that could expose protected health information (PHI). The vulnerability is in a custom application that is integral to patient scheduling. The hospital has limited budget and must decide among the following options: (1) take the portal offline until a patch is developed, (2) implement a web application firewall (WAF) and monitor logs, (3) purchase cyber insurance, or (4) do nothing and accept the risk. The hospital's leadership is risk-averse and wants to minimize the chance of a breach, but also needs to maintain patient access to scheduling. Which strategy best balances these constraints?

   • APurchase cyber insurance to cover potential breach costs.
   • BTake the portal offline until a patch is developed.
   • CAccept the risk because the budget is limited.
   • DImplement a WAF and monitor logs while developing a patch.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A regional bank processes card payments and stores customer data. After a risk assessment, the bank identifies that a legacy payment application has a critical vulnerability that could allow remote code execution. The vendor no longer provides patches, and the application is essential to daily operations. The bank's leadership wants to continue using the application while minimizing risk. What is the most appropriate risk response strategy?

   • ARisk mitigation, by implementing compensating controls such as network segmentation and strict access controls.
   • BRisk transfer, by purchasing cyber insurance to cover potential losses from exploitation.
   • CRisk avoidance, by immediately decommissioning the application and migrating to a modern system.
   • DRisk acceptance, because the vulnerability is known and the bank accepts the potential impact.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A risk analyst assigns a monetary value to the potential loss from a cyber attack and calculates the annualized loss expectancy. Which risk assessment method is being used?

   • AHybrid assessment
   • BQualitative assessment
   • CQuantitative assessment
   • DSemi-quantitative assessment
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A manufacturing company is conducting a risk assessment for its industrial control systems (ICS). The team has identified that a specific type of malware could exploit a known vulnerability in the ICS software. They are now determining the likelihood of this threat exploiting the vulnerability and the potential impact on production. Which step of the risk management process are they performing?

   • ARisk mitigation, because they are implementing controls to reduce the risk.
   • BRisk monitoring, because they are tracking the risk over time.
   • CRisk identification, because they are listing potential threats and vulnerabilities.
   • DRisk assessment, because they are analyzing the likelihood and impact of the identified risk.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a risk assessment, an analyst notes that a company's web server is running an outdated version of Apache with a known vulnerability. An attacker could exploit this vulnerability to gain unauthorized access. In this scenario, what is the threat?

   • AThe web server itself
   • BThe outdated Apache version
   • CThe unauthorized access to the server
   • DThe attacker who could exploit the vulnerability
   Reveal Solution Discussion Select an answer first