Business Risk, Exposures and Threats CGEIT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An enterprise has a low risk appetite for data privacy risks. Which of the following actions is most consistent with this appetite?

   • AImplementing strong encryption and access controls to reduce privacy risk
   • BAccepting a high likelihood of a data breach to save costs
   • CTransferring all privacy risks to customers
   • DIgnoring privacy risks because they are unlikely to occur
   Reveal Solution Discussion Select an answer first
2. 17expert · hard · select all that apply

   A government agency is assessing threats to its online services. The agency has identified the following threats: (1) a state-sponsored hacking group targeting government networks, (2) a disgruntled employee leaking sensitive data, (3) a natural disaster affecting the data center, and (4) a new regulation requiring stricter data retention. Which of these are considered strategic threats? Select all that apply.

   • ANew regulation requiring stricter data retention
   • BDisgruntled employee leaking sensitive data
   • CNatural disaster affecting the data center
   • DState-sponsored hacking group targeting government networks
   Check answers Discussion Select an answer first
4. 18foundation · easy

   Which of the following best describes a compliance risk?

   • AThe risk of financial loss due to unauthorized access to sensitive data
   • BThe risk of legal or regulatory sanctions, fines, or reputational damage from failing to meet laws and regulations
   • CThe risk of loss due to inadequate or failed internal processes, people, and systems
   • DThe risk of loss from changes in market prices, such as interest rates or foreign exchange rates
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A multinational corporation operates in a country with strict data sovereignty laws. The company's cloud provider stores data in a region outside that country, which is a violation. The company is also facing a high risk of cyberattacks due to its industry. The IT director proposes moving all data to a local data center to comply with the law, but this would increase costs and reduce scalability. The board asks for a risk-based recommendation. What should the governance team recommend?

   • AEncrypt the data to avoid the regulatory requirement
   • BMove the data to a local data center to ensure compliance, accepting the higher costs and reduced scalability
   • CNegotiate with the cloud provider to store data in a compliant region within the same country
   • DKeep the data in the current cloud region and accept the regulatory risk
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services firm is reviewing its risk monitoring process. The risk manager notices that a new regulation on data localization is being debated in several countries where the firm operates. The firm currently stores customer data in a centralized cloud region. What should the risk team do to address this emerging risk?

   • AIgnore the trend until the regulations are formally enacted
   • BConduct a scenario analysis to assess the impact of potential data localization requirements on current operations
   • CImmediately migrate all customer data to local servers in every country of operation
   • DIncrease the risk appetite for data residency to accommodate potential changes
   Reveal Solution Discussion Select an answer first