Risk and Compliance Management CISA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization is conducting its annual IT risk assessment. The risk team has identified a legacy patient records system that is no longer patched by the vendor. The system contains sensitive personal health information (PHI). The team is now analyzing the likelihood and impact of a data breach. Which of the following steps should the team perform NEXT in the risk assessment process?

   • ADocument the risk in the risk register and assign an owner to monitor it on a quarterly basis.
   • BCalculate the annualized loss expectancy (ALE) and compare it to the cost of replacing the system.
   • CEvaluate the risk against the organization's risk criteria to determine if it is acceptable or requires treatment.
   • DImmediately implement a compensating control, such as network segmentation, to reduce the likelihood of exploitation.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary role of a data protection officer (DPO) in a privacy program?

   • ATo oversee the organization's data protection strategy and ensure compliance with privacy regulations
   • BTo develop marketing campaigns that use personal data
   • CTo conduct external audits of the organization's financial statements
   • DTo manage the day-to-day operations of the IT help desk
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational bank is adopting an enterprise risk management (ERM) framework. The board has approved a risk appetite statement that permits a maximum of 0.5% annualized loss from cyber incidents across the entire loan portfolio. During the annual risk assessment, the IT risk team identifies a new third-party payment processor vulnerability that could cause a 1.2% loss if exploited. The team calculates that implementing an additional compensating control would reduce the exposure to 0.4%. Which of the following is the MOST appropriate initial action for the IT risk team?

   • ATransfer the risk to the third-party processor by renegotiating the contract to hold them liable for any losses.
   • BAccept the risk because the loss is below the annualized loss threshold of 1.5% used by the industry benchmark.
   • CImmediately implement the compensating control because the risk exceeds the tolerance level, and document the decision in the risk register.
   • DEscalate the residual risk to the board because it exceeds the approved risk appetite, and propose the compensating control as a mitigation option.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the IT risk assessment process, which step involves determining the likelihood and impact of identified risks?

   • ARisk analysis
   • BRisk evaluation
   • CRisk prioritization
   • DRisk identification
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency classifies its data into four levels: Public, Internal, Confidential, and Secret. A new cloud-based collaboration tool is being deployed, and the agency wants to ensure that data is handled appropriately. Which of the following is the MOST important control to implement for Confidential and Secret data?

   • AEnsure that data is stored in a specific geographic region to comply with data residency requirements.
   • BRequire all users to sign a non-disclosure agreement (NDA) before accessing the collaboration tool.
   • CImplement data loss prevention (DLP) tools to monitor and block unauthorized transfers of data.
   • DEncrypt data in transit and at rest, and restrict access to authorized personnel with multi-factor authentication (MFA).
   Reveal Solution Discussion Select an answer first