Apply Security Risk Management Principles ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A government agency is decommissioning an old system that contains sensitive data. The system is being replaced by a new one. What is the most critical security risk management activity during the disposal phase?

   • ADocument the system's configuration and user manuals for historical reference.
   • BArchive all data from the old system to a tape backup and store it indefinitely.
   • CEnsure that all sensitive data is securely erased from the old system's storage media before it is repurposed or discarded.
   • DTransfer all data to the new system and then immediately dispose of the old hardware without further action.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which statement best describes the relationship between security risk management and enterprise risk management?

   • AEnterprise risk management is a subset of security risk management that deals with non-technical risks
   • BSecurity risk management is a subset of enterprise risk management that focuses on risks to information assets
   • CEnterprise risk management replaces the need for security risk management
   • DSecurity risk management and enterprise risk management are independent processes with no overlap
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A multinational corporation's enterprise risk management (ERM) function uses a 5x5 risk matrix with impact measured in financial loss. The security team identifies a critical vulnerability that could lead to a data breach with high financial impact but low likelihood. The ERM committee is reluctant to fund the remediation because the likelihood is low. The CISO argues that the risk should be treated as high priority. What is the most compelling justification for the CISO's position?

   • AThe ERM matrix does not capture reputational damage and regulatory fines, which are significant for this type of breach, so the risk is understated.
   • BThe ERM framework should be changed to always prioritize security risks over other business risks.
   • CThe security team's risk assessment is more accurate than the ERM team's because they have better data.
   • DThe likelihood of a breach is never truly low because attackers are persistent and will eventually succeed.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team is developing a new mobile application that will handle financial transactions. During the requirements phase, they are defining the security requirements. Which activity is most aligned with integrating risk management into this phase?

   • AAsk the marketing team to define the security requirements based on customer expectations.
   • BConduct a threat modeling exercise to identify potential threats and derive security requirements from the identified risks.
   • CWait until the design phase to consider security requirements when the architecture is being developed.
   • DUse a generic list of security requirements from a previous project without modification.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A global bank's ERM framework uses a quantitative risk assessment model that calculates Annualized Loss Expectancy (ALE). The security team identifies a new threat that could cause a one-time loss of $5 million with a 10% annual probability. The ERM committee is debating whether to fund a $1 million control that would reduce the probability to 1%. What is the most financially sound decision based on the ALE model?

   • AFund the control because the ALE without the control is $500,000, and with the control it is $50,000, resulting in a net benefit of $450,000 per year.
   • BDo not fund the control because the probability is too low to matter.
   • CFund the control only if the bank can afford the $5 million loss, otherwise accept the risk.
   • DDo not fund the control because the one-time loss of $5 million is less than the $1 million control cost.
   Reveal Solution Discussion Select an answer first