Incorporate Integrated Risk Management Methods CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A software company is developing an e-commerce platform that will handle payment card transactions. The company must comply with PCI DSS. Which practice is most directly required by PCI DSS?

   • AImplement a software development lifecycle that includes security testing.
   • BUse only open-source software to reduce costs.
   • CConduct annual penetration testing.
   • DEncrypt cardholder data during transmission and storage.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which type of risk is directly related to the potential for financial loss, reputational damage, or legal liability to the organization?

   • ABusiness risk
   • BOperational risk
   • CSecurity risk
   • DTechnical risk
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A global software company is developing a product that will be sold to government agencies in multiple countries. The company must comply with various regulations and standards. Which approach best ensures compliance across different jurisdictions?

   • AComply with only the regulations of the company's home country.
   • BImplement a baseline set of security controls based on NIST and ISO standards, then map additional requirements per jurisdiction.
   • CUse a single framework like OWASP to ensure all security requirements are met.
   • DComply with the strictest regulation globally and apply it to all markets.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A software company is developing a new customer-facing web application that will process credit card payments. The security team has identified a critical vulnerability in the payment processing module that could allow an attacker to steal cardholder data. The business team is concerned about the cost of delaying the release to fix the vulnerability. Which approach best aligns with integrated risk management methods?

   • APerform a risk assessment to quantify the potential financial impact of a data breach and compare it with the cost of remediation and delay.
   • BImmediately fix the vulnerability without considering the business impact of the delay.
   • CRelease the application on schedule and monitor for any signs of a breach after launch.
   • DEscalate the decision to the legal department to determine if the vulnerability violates any regulations.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In risk management, what is the term for the potential for loss or harm when a threat exploits a vulnerability?

   • AImpact
   • BRisk
   • CVulnerability
   • DThreat
   Reveal Solution Discussion Select an answer first