Risk Management Lifecycle CGEIT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare provider is implementing a new patient portal that will store sensitive health data. During the risk identification phase, the risk team has listed several potential risks. Which of the following is the most appropriate example of a risk to include in the risk register?

   • AThe project is behind schedule by two weeks
   • BThe project team has completed the requirements gathering phase
   • CThe portal will be hosted in a public cloud
   • DA data breach could expose patient records due to insufficient access controls
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization conducts an annual risk management process review. They find that the risk identification phase consistently misses risks related to third-party vendors. What is the most effective way to apply continuous improvement to this issue?

   • AOutsource all vendor management to a third party
   • BIncrease the risk appetite for vendor-related risks
   • CRemove vendor-related risks from the risk register
   • DAdd a requirement to the risk identification process to include vendor risk assessments
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of the risk response implementation phase?

   • ATo monitor the effectiveness of responses
   • BTo identify new risks that have emerged
   • CTo put the selected risk responses into action and integrate them into operations
   • DTo evaluate risks against risk appetite
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A retail company has identified a high-impact, high-likelihood risk of a distributed denial-of-service (DDoS) attack on its e-commerce site. The risk is above the company's risk tolerance. The risk manager is considering response options. Which response strategy would be most effective in reducing the risk to an acceptable level?

   • AMitigate the risk by implementing a web application firewall and DDoS protection service
   • BTransfer the risk by purchasing business interruption insurance
   • CAccept the risk and document it in the risk register
   • DAvoid the risk by shutting down the e-commerce site
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturing company is analyzing risks to its ERP system. The risk team has identified a potential ransomware attack. They estimate that if the attack occurs, the company would lose $5 million in revenue and incur $1 million in recovery costs. Based on historical data and threat intelligence, they assess the likelihood of occurrence at 10% per year. What is the annualized loss expectancy (ALE) for this risk?

   • A$6,000,000
   • B$60,000
   • C$500,000
   • D$600,000
   Reveal Solution Discussion Select an answer first