Manage Risk to System ISSEP Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A software company has completed a risk assessment for its new cloud-based product. The assessment identified several risks, and the company decided to accept a low-impact risk related to data loss in a non-critical database. To ensure accountability and support future audits, what should the company do?

   • ADelete the risk from the risk register since it was accepted
   • BReclassify the risk as a non-risk because it was accepted
   • CDocument the risk, the decision to accept it, and the rationale in the risk register
   • DCommunicate the decision verbally to the management team but do not record it
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an example of a risk event that could impact a system's availability objective?

   • AA phishing email leading to credential theft
   • BA misconfigured firewall blocking legitimate traffic
   • CAn employee accidentally deleting a critical database
   • DA distributed denial-of-service (DDoS) attack overwhelming the web server
   Reveal Solution Discussion Select an answer first