A startup is performing an inherent risk analysis for its new social media app. The app collects user location data and shares it with third-party advertisers. The team is assessing the likelihood of a data breach. Which factor is most important to consider?

The number of users who have opted out of data sharing.

The cost of implementing encryption for the data.

The sensitivity of the location data and the potential for misuse.

The number of security controls already in place.

A healthcare organization is assessing the risk of its patient portal. The portal allows patients to view lab results and communicate with providers. During vulnerability identification, the team discovers that the portal does not enforce multi-factor authentication (MFA) for patient accounts. Which vulnerability is most directly associated with this finding?

Missing MFA increases the risk of credential theft and unauthorized access.

Weak password policy that allows short, simple passwords.

Lack of account lockout after multiple failed login attempts.

Insufficient encryption of data in transit.

A technology company has completed a risk assessment for its cloud infrastructure. The risk team needs to document the risk posture for the board of directors, who are interested in the overall risk level and key decisions. Which documentation approach is most appropriate?

Share the raw risk assessment data in a spreadsheet for board members to analyze.

Provide a detailed list of all identified vulnerabilities and their CVSS scores.

Create an executive summary highlighting top risks, risk ratings, and treatment decisions.

Verbally present the risk posture without any written documentation.

Which of the following is an example of a threat source?

A software bug in the application

Information Systems Security Engineering Professional

Domain 2Objective 3

Manage Risk to Operations ISSEP Practice Questions (Page 7)

Part of the Risk Management domain, which accounts for 20% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

20%of the exam

Questions 31–35

31application · medium
A startup is performing an inherent risk analysis for its new social media app. The app collects user location data and shares it with third-party advertisers. The team is assessing the likelihood of a data breach. Which factor is most important to consider?
Select an answer first
32application · medium
A healthcare organization is assessing the risk of its patient portal. The portal allows patients to view lab results and communicate with providers. During vulnerability identification, the team discovers that the portal does not enforce multi-factor authentication (MFA) for patient accounts. Which vulnerability is most directly associated with this finding?
Select an answer first
33foundation · easy
In the risk management process, what is the term for a weakness in a system that could be exploited by a threat?
Select an answer first
34application · medium
A technology company has completed a risk assessment for its cloud infrastructure. The risk team needs to document the risk posture for the board of directors, who are interested in the overall risk level and key decisions. Which documentation approach is most appropriate?
Select an answer first
35foundation · easy
Which of the following is an example of a threat source?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.

Manage Risk to Operations ISSEP Practice Questions (Page 7)

Questions 31–35

A startup is performing an inherent risk analysis for its new social media app. The app collects user location data and shares it with third-party advertisers. The team is assessing the likelihood of a data breach. Which factor is most important to consider?

In the risk management process, what is the term for a weakness in a system that could be exploited by a threat?

A technology company has completed a risk assessment for its cloud infrastructure. The risk team needs to document the risk posture for the board of directors, who are interested in the overall risk level and key decisions. Which documentation approach is most appropriate?

Which of the following is an example of a threat source?

Keep studying — Risk Management