1.2 - Understand the Risk Management Process CC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does risk tolerance influence risk management decisions?

   • AIt replaces the need for risk assessments
   • BIt sets the exact cost of every security control
   • CIt guarantees that all risks are eliminated
   • DIt determines which risks are accepted without additional treatment
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A retail company is evaluating the risk of a data breach from a point-of-sale (POS) system. The company has a moderate risk tolerance and is considering four treatment options: (1) accept the risk, (2) mitigate by upgrading the POS software, (3) transfer by purchasing cyber insurance, or (4) avoid by discontinuing the use of POS systems and switching to manual transactions. The cost of mitigation is $200,000, the insurance premium is $50,000 per year, and the potential loss from a breach is estimated at $1 million. The likelihood of a breach is medium. Which treatment option is most aligned with the company's risk tolerance and cost-effectiveness?

   • ATransfer by purchasing cyber insurance, because it is the cheapest option.
   • BAvoid by discontinuing POS systems, because it eliminates the risk entirely.
   • CAccept the risk, because the potential loss is less than the cost of mitigation.
   • DMitigate by upgrading the POS software, because it reduces the likelihood of a breach.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A university is conducting a risk assessment for its research data. The assessment identifies three risks: a ransomware attack on the research servers (likelihood: medium, impact: high), a power outage in the data center (likelihood: low, impact: medium), and a data breach due to a lost laptop (likelihood: high, impact: high). The university has limited budget for risk treatment. Which risk should be treated first?

   • AThe power outage, because it is the easiest to fix.
   • BAll three risks equally, because they all involve research data.
   • CThe ransomware attack, because it has a high impact.
   • DThe lost laptop data breach, because it has both high likelihood and high impact.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which risk treatment option is being used when an organization decides to stop a business activity because the risk is too high?

   • ARisk mitigation
   • BRisk acceptance
   • CRisk avoidance
   • DRisk transfer
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital stores patient records in an on-premises data center. A risk assessment identifies that a fire in the data center could destroy all patient records, with a low likelihood but very high impact. The hospital has a low risk tolerance for loss of patient data. Which risk treatment option would best address this risk?

   • AAccept the risk, because the likelihood of a fire is low.
   • BTransfer the risk by purchasing property insurance for the data center.
   • CAvoid the risk by shutting down the data center and moving all operations to a cloud provider.
   • DMitigate the risk by implementing fire suppression systems and off-site backups.
   Reveal Solution Discussion Select an answer first