Business Risk, Exposures and Threats CGEIT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which combination of factors typically results in the highest risk significance?

   • ALow impact and low likelihood
   • BLow impact and high likelihood
   • CHigh impact and high likelihood
   • DHigh impact and low likelihood
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing company's leadership is reviewing its risk register. The CISO warns that a recent ransomware campaign has targeted industrial control systems (ICS) in the sector. The company's ICS are isolated from the internet but share a network with the corporate IT environment. Which threat should the risk team assess as the most likely vector for a ransomware attack on the ICS?

   • APhishing emails that compromise corporate IT and pivot to the ICS network
   • BDirect exploitation of internet-facing ICS devices
   • CSupply chain compromise of a raw material supplier
   • DPhysical intrusion by an insider with access to the ICS floor
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which threat category is most directly concerned with the failure of internal processes or systems?

   • ACyber threat
   • BCompliance threat
   • CStrategic threat
   • DOperational threat
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A software company is assessing the risk of a critical vulnerability in its legacy customer database. The vulnerability is known and exploits are publicly available. The database contains sensitive customer information. The company has not yet patched the system. What is the most appropriate immediate action for the risk team?

   • AShut down the database immediately to eliminate the risk
   • BAccept the risk because the database has not been breached yet
   • CImplement a temporary workaround, such as network segmentation, while expediting the patch
   • DIncrease monitoring without any other action
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of a strategic threat?

   • AA data breach exposing customer information
   • BA new competitor entering the market with a disruptive business model
   • CA fire in a manufacturing facility
   • DA ransomware attack on the enterprise's servers
   Reveal Solution Discussion Select an answer first