Incorporate Integrated Risk Management Methods CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When a data breach occurs, which legal requirement typically obligates an organization to inform affected individuals and regulatory authorities?

   • AIntellectual property rights
   • BBreach notification laws
   • CData retention policies
   • DExport control regulations
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A software company is deciding whether to fix a critical vulnerability in a legacy system or replace the system entirely. The vulnerability could lead to a data breach with a potential cost of $10 million. Fixing the vulnerability costs $100,000 and reduces the risk by 90%. Replacing the system costs $2 million and eliminates the risk entirely. Which decision is most aligned with integrated risk management?

   • ATransfer the risk by purchasing cyber insurance.
   • BReplace the system because it eliminates the risk completely.
   • CFix the vulnerability because it is more cost-effective than replacement.
   • DAccept the risk because the vulnerability is in a legacy system.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a community-driven project that provides free resources, tools, and best practices for improving the security of software, particularly web applications?

   • ASAMM
   • BSAFECode
   • CBSIMM
   • DOWASP
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A software development team is working on a project for a healthcare client that must comply with HIPAA. The team is unfamiliar with security standards. Which standard or framework is most directly relevant to ensuring the software meets HIPAA security requirements?

   • ANIST SP 800-53
   • BPCI DSS
   • CISO/IEC 27001
   • DOWASP Top 10
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A software company is developing an app that aggregates health data from users. The app will be used in the EU and the US. The company's legal team is concerned about GDPR and HIPAA compliance. Which action is most critical to ensure compliance with both regulations?

   • AAnonymize all health data to avoid regulatory obligations.
   • BStore all data in the US to simplify compliance.
   • CImplement strong data encryption and access controls, and ensure data processing agreements are in place.
   • DObtain user consent once and use it for all purposes.
   Reveal Solution Discussion Select an answer first