Apply Security Risk Management Principles ISSEP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A defense contractor is beginning the concept development phase for a new weapons system. The program manager wants to ensure that security considerations are not an afterthought. What is the most effective way to integrate security risk management at this stage?

   • AIncorporate security requirements and threat modeling into the initial system requirements and design trade-off analyses.
   • BAsk the security team to develop a list of security features that can be added during the operations phase if needed.
   • CDefer security analysis until the detailed design phase when the system architecture is more concrete.
   • DConduct a single, comprehensive risk assessment just before the system goes into production.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is in the initiation phase of a new project to develop a customer-facing web portal. The project sponsor wants to ensure that security is considered from the start. What is the most important activity to perform during this phase?

   • ADefine the security requirements and objectives for the project, aligned with the organization's risk appetite.
   • BWait until the design phase to identify security requirements when the architecture is being developed.
   • CConduct a penetration test on the existing systems to identify vulnerabilities.
   • DAsk the development team to use secure coding practices without defining specific requirements.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company is using a qualitative risk assessment approach. The security team has identified a risk of a point-of-sale (POS) malware infection. The likelihood is assessed as 'high' and the impact as 'moderate'. According to the company's 4x4 risk matrix, this results in a 'high' risk rating. The ERM committee is deciding how to respond. Which response is most appropriate given the risk rating?

   • AAvoid the risk by discontinuing the use of POS systems and switching to cash-only transactions.
   • BTransfer the risk by purchasing a cybersecurity insurance policy.
   • CImplement additional security controls to reduce the likelihood of infection, such as application whitelisting and network segmentation.
   • DAccept the risk because the impact is only moderate and the cost of controls may exceed the potential loss.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational corporation is adopting a new ERM framework that uses a 5x5 risk matrix with likelihood and impact scales. The security team is mapping its existing security risk register to the new framework. A risk of a ransomware attack is currently rated as 'high' in the security team's own 4x4 matrix. In the new ERM matrix, the same risk is rated as 'medium' because the impact scale focuses on financial loss and the likelihood is assessed as 'possible'. What is the most appropriate action for the security team?

   • AInsist that the ERM framework be changed to match the security team's rating scale.
   • BAccept the ERM rating but document the discrepancy and the rationale for the security team's higher rating, and continue to monitor the risk.
   • CRemove the risk from the security team's register because it is now rated as 'medium' in the ERM framework.
   • DRe-evaluate the risk using the ERM framework and accept the 'medium' rating without further discussion.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A hospital system is implementing a new electronic health record (EHR) system. The enterprise risk management (ERM) framework prioritizes risks based on patient safety impact. The security team identifies a risk that could allow unauthorized access to patient data, but the direct patient safety impact is low. The ERM committee is inclined to accept this risk. What is the most important consideration the security team should raise?

   • AThe security team should escalate the issue to the board of directors immediately.
   • BThe security team should accept the ERM committee's decision because patient safety is the primary concern.
   • CUnauthorized access to patient data can lead to identity theft and fraud, which indirectly affects patient safety and trust.
   • DThe ERM framework should be revised to prioritize data confidentiality over patient safety.
   Reveal Solution Discussion Select an answer first