1.2 - Understand the Risk Management Process CC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium · select all that apply

   A risk assessment team is analyzing the risk of a ransomware attack on a company's file servers. Which of the following factors should be considered when assessing this risk? (Select all that apply.)

   • AThe company's risk tolerance for data loss.
   • BThe cost of implementing anti-ransomware controls.
   • CThe likelihood of the company being targeted by ransomware.
   • DThe value of the data stored on the file servers.
   • EThe potential impact on business operations if files are encrypted.
   Check answers Discussion Select an answer first
2. 22application · medium · select all that apply

   A company has identified a risk of a data breach due to weak passwords. The company has a moderate risk tolerance. Which of the following are appropriate risk treatment options? (Select all that apply.)

   • APurchasing cyber liability insurance.
   • BAccepting the risk because the company has a moderate tolerance.
   • CDiscontinuing the use of passwords and switching to biometric authentication.
   • DIgnoring the risk because it has not occurred yet.
   • EImplementing a policy requiring multi-factor authentication.
   Check answers Discussion Select an answer first
4. 23application · medium

   A startup company is developing a new mobile app. The CEO states that the company can tolerate a moderate level of risk to achieve rapid growth, but cannot accept any risk that could result in a data breach of customer information. During a risk assessment, the team identifies a potential vulnerability in the app's authentication mechanism that could lead to unauthorized access to user data. The likelihood is assessed as medium and the impact as high. What should the company do with this risk?

   • AAccept the risk, because the company has a high risk tolerance for growth.
   • BMitigate the risk by implementing stronger authentication controls, such as multi-factor authentication.
   • CAvoid the risk by discontinuing the mobile app project entirely.
   • DTransfer the risk by purchasing cyber insurance, and continue development without changes.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A healthcare organization is implementing a risk management process for the first time. The organization has a limited budget and needs to comply with regulations that require regular risk assessments. The risk management team is deciding whether to conduct a qualitative or quantitative risk assessment. Which approach is most appropriate for this organization?

   • AQualitative assessment, because it is faster and requires less data, which is suitable for a first-time implementation with limited budget.
   • BBoth qualitative and quantitative assessments, because they are required by regulations.
   • CNeither, because the organization should focus on risk treatment instead of assessment.
   • DQuantitative assessment, because it provides precise monetary values for risks.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software development company is considering using a third-party cloud provider to host its application. The company's risk assessment identifies that the cloud provider could suffer a service outage, causing downtime for the application. The company decides to sign a contract with the provider that includes financial penalties for downtime. Which risk treatment option is the company using?

   • AAvoidance, because the company is avoiding the risk of downtime by using a cloud provider.
   • BAcceptance, because the company is accepting the risk of downtime and doing nothing about it.
   • CTransfer, because the company is shifting the financial risk of downtime to the cloud provider.
   • DMitigation, because the company is reducing the likelihood of downtime.
   Reveal Solution Discussion Select an answer first