Manage Risk to Operations ISSEP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A hospital is assessing the risk of a ransomware attack on its electronic health record (EHR) system. The risk team is determining the impact of a successful attack. Which impact is most critical for this system?

   • AFinancial loss from ransom payment and system restoration.
   • BInability to access patient records, leading to delayed or incorrect treatment.
   • CLoss of patient trust and reputation damage.
   • DLegal penalties for violating HIPAA.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A university is assessing the risk of its online learning platform. The platform allows students to upload assignments and access course materials. During threat identification, the team considers a disgruntled former employee who still has valid credentials. Which threat source is this?

   • AA malicious insider with authorized access.
   • BA natural disaster affecting the data center.
   • CAn accidental threat actor who unintentionally causes harm.
   • DAn external attacker exploiting a vulnerability in the platform.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of a change that would trigger an update to the risk assessment during monitoring?

   • AThe organization's mission statement is updated
   • BA new vulnerability is discovered in a system component
   • CA user changes their password
   • DA routine backup is completed
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial institution is conducting a risk assessment for its new mobile banking application. The team has identified that the application uses a third-party API for credit scoring. Which threat source should be explicitly considered in the threat identification step?

   • AA malicious insider with privileged access to the application's database.
   • BA natural disaster that could cause a data center outage.
   • CA nation-state actor seeking to disrupt financial services.
   • DA software vulnerability in the third-party API that could be exploited by an external attacker.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is typically included in risk posture documentation?

   • AThe organization's marketing strategy
   • BThe rationale for risk decisions
   • CThe names of all system users
   • DThe source code of the system
   Reveal Solution Discussion Select an answer first