Manage Risk to System ISSEP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A bank has performed an inherent risk analysis for its mobile banking app. The risks identified include a high-likelihood, low-impact risk of phishing attacks and a low-likelihood, high-impact risk of a core system failure. The bank's risk criteria prioritize risks that could cause significant financial loss or regulatory penalties. Based on these criteria, which risk should be prioritized for treatment?

   • AThe core system failure risk because it has high impact
   • BBoth risks equally because all risks should be treated
   • CNeither risk because inherent risk does not consider existing controls
   • DThe phishing risk because it is more likely to occur
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the purpose of risk evaluation?

   • ATo implement security controls to reduce risk
   • BTo prioritize risks and determine which ones require treatment
   • CTo calculate the inherent risk without considering mitigations
   • DTo identify all potential threats and vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a change in risk posture that should be monitored?

   • AThe initial identification of threats during the first risk assessment
   • BThe establishment of risk evaluation criteria
   • CThe implementation of a risk treatment plan
   • DA new vulnerability is discovered in a critical system component
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During risk evaluation, what are inherent risks compared against?

   • AThe organization's security policies
   • BThe list of identified vulnerabilities
   • CRisk criteria established during risk context
   • DThe residual risk levels after treatment
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A global logistics company is establishing a risk management program for its new IoT-based tracking system. The system will be deployed across multiple countries, each with different data protection laws. The company wants to ensure that the risk management process is consistent yet compliant with local regulations. The risk team is defining the risk context. Which approach best balances consistency and compliance?

   • ADefine the risk context based on the headquarters' country laws only
   • BDefine a global risk context with regional criteria that incorporate local legal requirements
   • CDefine a single global risk context with uniform criteria for all regions
   • DDefine separate risk contexts for each country with no global alignment
   Reveal Solution Discussion Select an answer first