Manage Risk to Operations ISSEP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During the risk management process, which activity is performed when the organization defines the boundaries of the system, the risk evaluation criteria, and the constraints that will guide the risk assessment?

   • AIdentifying threats
   • BMonitoring risk posture
   • CEstablishing the risk context
   • DDetermining impact
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In inherent risk analysis, which two factors are combined to determine the level of risk?

   • AThreat and vulnerability
   • BCost and benefit
   • CVulnerability and impact
   • DLikelihood and impact
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A government agency has implemented a risk treatment plan for its citizen services portal. During a routine vulnerability scan, the agency discovers a new critical vulnerability in the web server software. Which action is most appropriate for monitoring risk posture changes?

   • ADocument the new vulnerability and update the risk assessment.
   • BIgnore the vulnerability because it is in the web server, not the application.
   • CWait for the next scheduled risk assessment to address the vulnerability.
   • DAssume the vulnerability does not affect the risk posture because the server is patched.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A utility company is assessing the risk of a cyberattack on its SCADA system that controls the water treatment plant. The system is connected to the corporate network for monitoring purposes. The risk team is determining the impact of a successful attack. Which impact consideration is most critical for this system?

   • ALegal penalties for violating environmental regulations.
   • BPotential contamination of the water supply, affecting public health.
   • CReputation damage to the utility company.
   • DFinancial loss from plant downtime and repair costs.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A bank has completed an inherent risk analysis for its online banking platform. The analysis identified a medium-risk vulnerability in the session management. The bank's risk tolerance is defined as 'medium risks are acceptable if they are documented and reviewed annually.' Which action is most appropriate for the risk evaluation step?

   • AIgnore the vulnerability because it is only medium risk.
   • BTreat the medium-risk vulnerability immediately because all risks should be eliminated.
   • CAccept the medium-risk vulnerability and document it for annual review.
   • DRe-assess the vulnerability using a different methodology to make it low risk.
   Reveal Solution Discussion Select an answer first