Incorporate Integrated Risk Management Methods CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A risk analyst is performing a qualitative risk assessment for a software project. Which output is most characteristic of a qualitative assessment?

   • AA probability percentage for each risk.
   • BA monetary value assigned to each risk.
   • CA prioritized list of risks rated as high, medium, or low.
   • DA detailed cost-benefit analysis of mitigation options.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A software company is developing a new product that uses open-source libraries. The legal team is concerned about intellectual property risks. Which action is most important to mitigate IP risks?

   • AUse only proprietary libraries to avoid any open-source risks.
   • BReview the licenses of all open-source components to ensure compliance.
   • CRely on the open-source community to identify security issues.
   • DRemove all open-source components from the product.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In risk assessment, what is the term for the process of assigning a numerical value to the likelihood and impact of a risk?

   • AQualitative risk analysis
   • BRisk response planning
   • CQuantitative risk analysis
   • DRisk identification
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A software company is developing a mobile app that collects personal data from users in the EU. The company is based in the US. Which legal consideration is most relevant to this scenario?

   • AHIPAA compliance for health data.
   • BPCI DSS compliance for payment data.
   • CSOX compliance for financial reporting.
   • DGDPR compliance for handling EU residents' personal data.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security manager is introducing a risk management process to a development team. The team is unfamiliar with the terminology. Which definition best describes 'risk assessment'?

   • AThe process of transferring risk to a third party.
   • BThe process of documenting security controls.
   • CThe process of identifying, analyzing, and evaluating risk.
   • DThe process of eliminating all risks from a system.
   Reveal Solution Discussion Select an answer first