1.9 - Understand and Apply Risk Management Concepts CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A multinational organization must comply with the European Union's General Data Protection Regulation (GDPR) for its customer data. The organization is also required by its board to align its security program with a widely recognized framework. Which framework would be most appropriate to guide the organization's risk management and compliance efforts?

   • ASABSA
   • BPCI DSS
   • CISO/IEC 27001
   • DCOBIT
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of a threat?

   • AAn unencrypted database
   • BA missing security patch on a web server
   • CA hacker exploiting a weak password
   • DA firewall rule that is too permissive
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's risk management program is at a 'defined' maturity level, with documented processes but inconsistent execution across departments. The CISO wants to advance to a 'managed' level. Which initiative would most directly achieve this?

   • AImplementing a centralized risk register and requiring all departments to report risks and treatment plans through it
   • BUpdating the risk management policy document
   • CConducting a one-time risk awareness training for all employees
   • DHiring an external consultant to review the program annually
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is primarily associated with threat and vulnerability identification?

   • AConducting a vulnerability scan of network services
   • BSelecting safeguards to reduce risk
   • CCalculating the annualized loss expectancy for a risk
   • DReviewing audit logs for compliance
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A regional hospital is implementing a new patient portal that will be accessible over the internet. The security team is conducting a risk assessment and has identified a vulnerability in the web application framework that could allow an attacker to access another patient's records. The hospital's risk appetite is low, and they have a limited budget. Which risk response strategy should the security team recommend first?

   • AAcceptance by documenting the risk and proceeding with the launch to avoid delays
   • BMitigation by applying the vendor's security patch and conducting a penetration test before launch
   • CTransfer by purchasing cybersecurity insurance to cover potential breach costs
   • DAvoidance by canceling the patient portal project entirely
   Reveal Solution Discussion Select an answer first