Manage Risk to System ISSEP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of identifying risk events and their impacts?

   • ATo document the risk posture for external auditors
   • BTo select and implement security controls to mitigate risks
   • CTo determine the exact likelihood of each risk event occurring
   • DTo understand what could happen and how it might affect system objectives and assets
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of a vulnerability that would be identified during the 'identify threats and vulnerabilities' step?

   • AA missing security patch on a public-facing server
   • BA hurricane expected to hit the data center region
   • CA disgruntled employee with access to sensitive data
   • DA new regulation requiring stricter data protection
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A cloud service provider is monitoring its risk posture for a multi-tenant infrastructure. The provider has identified a new vulnerability in the hypervisor that could allow cross-tenant data access. The vulnerability is not yet exploited, but the provider must decide how to respond. The provider has a risk appetite that accepts low-likelihood risks but requires immediate action for high-impact risks. What should the provider do?

   • AImmediately patch the hypervisor without further analysis
   • BWait for an exploit to be observed before taking action
   • CAssess the likelihood and impact of the vulnerability and update the risk register
   • DInform tenants of the vulnerability but take no other action
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of monitoring and evaluating risk posture changes?

   • ATo establish the risk context for the system
   • BTo implement security controls to mitigate risks
   • CTo identify threats and vulnerabilities for the first time
   • DTo track new, changed, and residual risks over time
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A government agency has implemented a risk treatment plan for its citizen services portal. Six months later, the security team discovers that a new vulnerability has been disclosed that affects the portal's underlying framework. The vulnerability is not yet exploited, but it increases the likelihood of a data breach. What is the most appropriate action for the team to take?

   • ADocument the vulnerability but do not change the risk assessment until an exploit is observed
   • BImmediately implement a new security control to mitigate the vulnerability
   • CIgnore the vulnerability because it has not been exploited yet
   • DUpdate the risk register and reassess the risk posture for the portal
   Reveal Solution Discussion Select an answer first