Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   After applying mitigation controls, a risk remains that is within the organization's acceptable threshold. What should be done with this risk?

   • ADocument it as a residual risk and formally accept it
   • BEliminate it by removing the feature
   • CIgnore it because it is within the threshold
   • DTransfer it to a third party
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of documenting residual risks in the risk register?

   • ATo provide a record for management oversight and future audits
   • BTo transfer the risks to the security team
   • CTo prove that all risks have been mitigated
   • DTo automatically eliminate the risks
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of a risk acceptance criterion?

   • AThe risk is eliminated by removing the feature.
   • BThe risk is mitigated with a WAF.
   • CThe risk is transferred to an insurance provider.
   • DThe residual risk has a low likelihood and low impact, and the cost of mitigation exceeds the potential loss.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A project has a residual risk of a data breach due to a third-party API. The risk owner has accepted the risk, but the organization's risk tolerance is low. The security team believes that the residual risk is still too high. Which action is most appropriate?

   • ADocument the acceptance and move on.
   • BRe-evaluate the risk and implement additional controls to reduce it further.
   • CTransfer the risk to the API provider.
   • DAvoid the risk by discontinuing use of the API.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large enterprise is developing a customer relationship management (CRM) system. The risk assessment identifies a high risk of data exfiltration via a third-party analytics SDK. The SDK is critical for business intelligence, and the marketing department strongly opposes removing it. The security team has limited budget for additional controls. Which strategy best balances the need for analytics with the security risk?

   • AAvoid the risk by removing the SDK entirely.
   • BTransfer the risk by signing an indemnification agreement with the SDK vendor.
   • CMitigate by implementing a data loss prevention (DLP) solution that monitors and blocks sensitive data sent to the SDK.
   • DAccept the risk and document it as residual.
   Reveal Solution Discussion Select an answer first