3.3 Conduct Risk Assessments ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large financial institution is deciding between a qualitative and a quantitative risk assessment for its new online banking platform. The institution has extensive historical fraud data and a team of data scientists. However, the board wants results that can be compared across different business units using a consistent scale. The CISO is concerned that a purely quantitative approach may not capture reputational risks. Which approach best balances these needs?

   • AHybrid, using quantitative analysis for financial risks and qualitative analysis for reputational risks, then mapping both to a common scale.
   • BQuantitative, because the historical data supports it and the board wants consistency.
   • CA purely qualitative approach, because it is faster and less expensive.
   • DQualitative, because it can capture reputational risks and provide a consistent scale.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a qualitative risk analysis, a risk is rated as having a likelihood of 'High' and an impact of 'Low'. Using a 3x3 risk matrix where risk level is determined by the combination of likelihood and impact, which risk level is most likely assigned?

   • ALow
   • BModerate
   • CCritical
   • DHigh
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hospital is conducting a qualitative risk assessment of patient data confidentiality. The risk of a phishing attack leading to data exposure is rated as 'Likely' and 'Major' on a 5x5 matrix. The risk of a natural disaster damaging the data center is rated as 'Rare' and 'Catastrophic'. Which risk should be reported as the highest priority to the risk committee?

   • AThe risk with the higher combined score on the matrix, which requires calculating the product of likelihood and impact.
   • BBoth risks should be treated equally, because they both involve patient data.
   • CThe phishing risk, because it is more likely to occur.
   • DThe natural disaster risk, because it has a higher impact.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of documenting the risk assessment process and results?

   • ATo satisfy all regulatory requirements automatically
   • BTo replace the need for ongoing risk monitoring
   • CTo support informed decision-making and provide a basis for risk treatment
   • DTo provide a legal defense in case of a security breach
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which factor is most important when deciding between a qualitative and a quantitative risk assessment approach?

   • AThe availability of reliable numerical data for loss estimates
   • BThe type of operating systems used in the environment
   • CThe number of security controls already in place
   • DThe size of the organization's IT department
   Reveal Solution Discussion Select an answer first