Risk Management CCOA Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A company is evaluating how to respond to the risk of a ransomware attack. The company has a low risk appetite and cannot tolerate any downtime. The cost of implementing robust backup and recovery solutions is high, but the cost of a potential attack is even higher. The company decides to invest in the backup solutions. Which risk response strategy is the company employing?

   • ARisk transfer, because they are transferring the risk to the backup provider.
   • BRisk mitigation, because they are reducing the impact of a ransomware attack.
   • CRisk acceptance, because they are accepting the risk and investing in backups.
   • DRisk avoidance, because they are avoiding the risk by having backups.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A hospital's electronic health record (EHR) system must be accessible to doctors at all times for patient care. During a recent risk assessment, the security team identified that a ransomware attack could encrypt patient data and make it unavailable. The hospital decides to implement offline backups and test restoration procedures regularly. Which cybersecurity objective is primarily being addressed by this control?

   • AIntegrity, because backups ensure data has not been altered.
   • BAvailability, because the control ensures that patient data can be restored and accessed after a ransomware attack.
   • CConfidentiality, because backups protect patient data from unauthorized access.
   • DNon-repudiation, because backups provide proof of data origin.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An organization decides to stop offering a service that carries an unacceptably high risk of data loss. Which risk response strategy are they employing?

   • ARisk acceptance
   • BRisk mitigation
   • CRisk transfer
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A startup company is launching a new mobile app that collects user location data. The company's legal team determines that the cost of complying with strict data privacy regulations would be very high and could delay the launch. The company decides to launch the app in a country with less stringent regulations, thereby avoiding the high compliance costs. Which risk response strategy is the company employing?

   • ARisk avoidance, because they are avoiding the risk by not operating in the high-regulation market.
   • BRisk acceptance, because they are accepting the risk of non-compliance.
   • CRisk mitigation, because they are reducing the risk by implementing some privacy controls.
   • DRisk transfer, because they are transferring the risk to users.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A university's IT department is designing a new student portal that will store grades and personal information. The department wants to ensure that students can only see their own grades and that grades cannot be altered by unauthorized users. Which two cybersecurity objectives are primarily being addressed?

   • AConfidentiality and integrity
   • BIntegrity and availability
   • CConfidentiality and non-repudiation
   • DConfidentiality and availability
   Reveal Solution Discussion Select an answer first