1.2 - Understand the Risk Management Process CC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of the risk management process?

   • ATo eliminate all risks to the organization
   • BTo document risks for compliance purposes only
   • CTo identify, assess, and respond to risks in a structured way
   • DTo transfer all risks to insurance providers
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which risk treatment option involves implementing controls to reduce the likelihood or impact of a risk?

   • ARisk acceptance
   • BRisk avoidance
   • CRisk transfer
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A small law firm wants to implement a risk management process for its client data. The firm has never performed a formal risk assessment. Which of the following is the first step the firm should take?

   • ADetermine the firm's risk tolerance for data breaches.
   • BPurchase cyber liability insurance.
   • CImplement encryption for all client data.
   • DIdentify potential risks to client data, such as unauthorized access, data loss, and malware.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A government agency is assessing the risk of a cyberattack on its critical infrastructure. The agency has a very low risk tolerance for any disruption to its services. The risk assessment team is considering two scenarios: a ransomware attack that could encrypt data and disrupt services for days (likelihood: low, impact: very high) and a phishing attack that could lead to credential theft (likelihood: high, impact: medium). The agency has a limited budget and must choose which risk to address first. Which risk should be prioritized?

   • ABoth risks equally, because both are cyberattacks.
   • BThe ransomware attack, because the impact is very high, even though the likelihood is low.
   • CThe phishing attack, because the likelihood is high and it is easier to mitigate.
   • DNeither risk, because the agency has a low risk tolerance and should avoid all risks.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing company is planning to implement a new IoT-based monitoring system for its production line. The system will collect real-time data from sensors and transmit it to a cloud platform. During the risk identification phase, which of the following is the most important risk to consider?

   • AThe risk of unauthorized access to the cloud platform, which could compromise production data.
   • BThe risk of the cloud provider going out of business.
   • CThe risk of increased electricity costs from running the sensors.
   • DThe risk of employees resisting the new technology.
   Reveal Solution Discussion Select an answer first