Manage Risk to System ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is typically included in risk posture documentation?

   • AThe detailed source code of the system
   • BThe personal information of all system users
   • CThe rationale behind risk treatment decisions
   • DThe marketing strategy for the system
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A defense contractor is establishing a risk management program for a new weapon system. The system will operate in a coalition environment with allied nations, and the contractor must comply with both U.S. export control regulations and allied data-handling rules. During the initial risk context definition, which action is most critical to ensure the risk management process is scoped correctly?

   • ADefine the system boundaries, operational environment, and risk evaluation criteria
   • BImplement security controls to mitigate identified risks
   • CDocument the residual risk posture for the system
   • DIdentify all threat sources and vulnerabilities applicable to the system
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital is assessing the risk of a ransomware attack on its electronic health records (EHR) system. The security team has identified that the system is vulnerable to phishing attacks and has no endpoint protection. They are now calculating the inherent risk by considering the likelihood of a successful attack and the potential impact on patient care. Which statement best describes what they are doing?

   • AThey are documenting the risk posture and decisions for accountability
   • BThey are identifying the threat sources and vulnerabilities that could affect the EHR system
   • CThey are analyzing the risk without considering existing mitigations to determine the inherent risk
   • DThey are evaluating the risk against the hospital's risk criteria to decide if treatment is needed
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A manufacturing company is conducting a risk assessment for its industrial control systems (ICS). The team has identified that a cyber-physical attack could cause physical damage to equipment and endanger workers. They are now analyzing the risk events and impacts. Which approach best captures the full scope of impacts?

   • AFocus on the likelihood of the attack rather than the impact
   • BConsider only the operational impact on production downtime
   • CConsider both the financial impact and the potential for worker injury
   • DFocus only on the financial impact of equipment damage
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A manufacturing company has completed an inherent risk analysis for its industrial control systems. The risks identified include a potential cyber-physical attack that could cause equipment damage and a data breach that could expose proprietary designs. The company's risk criteria state that any risk with a potential impact above $1 million requires treatment. The cyber-physical attack has a potential impact of $5 million, while the data breach has a potential impact of $500,000. Based on this information, what should the company do next?

   • AAccept both risks because the analysis is only inherent and does not consider existing controls
   • BDocument both risks and defer treatment decisions until a full residual risk analysis is completed
   • CTreat the cyber-physical attack risk and accept the data breach risk
   • DTreat both risks because any risk to critical infrastructure should be mitigated
   Reveal Solution Discussion Select an answer first