Risk Management Lifecycle CGEIT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a risk identification activity?

   • AConducting a brainstorming session to list potential cybersecurity threats
   • BCalculating the potential financial loss from a data breach
   • CReviewing risk response effectiveness
   • DDeciding to purchase cyber insurance
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization has decided to mitigate the risk of phishing attacks by implementing multi-factor authentication (MFA) and conducting security awareness training. The risk response plan has been approved. Which of the following activities is part of the risk response implementation phase?

   • ARolling out MFA to all users and scheduling training sessions
   • BEvaluating the likelihood of phishing attacks after implementation
   • CUpdating the risk appetite statement to reflect the new controls
   • DConducting a cost-benefit analysis of MFA versus training
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's risk register contains three risks with the following annualized loss expectancies (ALE): Risk A = $50,000, Risk B = $120,000, Risk C = $80,000. The company's risk appetite allows for a maximum annual loss of $100,000 from all risks combined. The risk manager must prioritize responses. Which risk should be addressed first?

   • AAll three risks equally
   • BRisk A
   • CRisk C
   • DRisk B
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an output of the risk analysis phase?

   • AA list of potential risk responses
   • BA prioritized list of risks
   • CA risk rating based on likelihood and impact
   • DA decision to accept a risk
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is analyzing risks to its customer database. For a specific risk of data corruption, the risk team has determined that the impact would be $100,000 and the likelihood is 20% per year. However, the team is uncertain about the accuracy of the likelihood estimate because there is limited historical data. Which approach would best improve the quality of the risk analysis?

   • AIgnore the risk because the likelihood is uncertain
   • BUse the maximum possible impact as the risk score
   • CUse a qualitative analysis with expert judgment to validate the likelihood
   • DAssume the likelihood is 100% to be conservative
   Reveal Solution Discussion Select an answer first