Manage Risk to System ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An e-commerce company has a risk management process in place. During a quarterly review, the security team notices that a new regulation has been enacted that imposes stricter data protection requirements. This regulation could affect the company's current risk treatment decisions. What is the most appropriate action?

   • AWait until the regulation is enforced before making any changes
   • BUpdate the risk context to include the new regulation and reassess the risk posture
   • CImmediately implement all possible security controls to comply with the new regulation
   • DContinue with the current risk treatment plan because it was approved earlier
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When performing inherent risk analysis, which factors are considered?

   • AOnly the impact of the risk event
   • BLikelihood and impact after considering existing mitigations
   • COnly the likelihood of the risk event
   • DLikelihood and impact without considering existing mitigations
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   During the risk management process, which activity is performed when the organization defines the system's operational boundaries, identifies the assets and processes in scope, and establishes the risk evaluation criteria?

   • AMonitoring risk posture changes
   • BEstablishing the risk context
   • CIdentifying threats and vulnerabilities
   • DPerforming inherent risk analysis
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial regulator is evaluating the risk management practices of a bank. The bank has identified a risk of insider trading by employees. The inherent risk analysis shows a high likelihood and high impact. The bank has implemented a monitoring system that detects suspicious trading patterns. However, the monitoring system has a known false positive rate that could lead to alert fatigue. The bank must decide whether to accept, mitigate, or transfer this risk. Which decision is most appropriate?

   • ATransfer the risk by outsourcing trading activities to a third party
   • BMitigate the risk by improving the monitoring system to reduce false positives
   • CAccept the risk because the monitoring system reduces the likelihood to an acceptable level
   • DAvoid the risk by prohibiting all employee trading
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A defense contractor is conducting a risk assessment for a new military communication system. The system will be used in a coalition environment with allied forces. The team has identified a threat of electronic warfare (EW) attacks that could disrupt communications. They are now analyzing the inherent risk. Which factor is most critical to consider when analyzing the inherent risk of EW attacks?

   • AThe cost of implementing new countermeasures
   • BThe likelihood of an EW attack and the impact on mission-critical communications
   • CThe coalition partners' risk assessment results
   • DThe existing electronic countermeasures and their effectiveness
   Reveal Solution Discussion Select an answer first