3.3 Conduct Risk Assessments ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the context of risk assessment, which of the following is the best example of an internal risk factor?

   • AA competitor launching a new product that reduces the organization's market share
   • BA new data protection regulation that imposes fines for non-compliance
   • CA vulnerability in the organization's web application that allows SQL injection
   • DA regional power outage that could disrupt the organization's data center
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When communicating risk assessment results to senior management, which type of information is most important to include?

   • AThe complete list of all security controls currently implemented
   • BThe names of all employees involved in the assessment
   • CA prioritized list of risks with potential business impact
   • DDetailed technical descriptions of every vulnerability found
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A mid-sized healthcare organization must conduct its first enterprise-wide risk assessment. The board wants a defensible, repeatable process that can be completed within six weeks and does not require specialized statistical expertise. The organization has limited historical incident data and a diverse set of assets, including legacy systems. Which risk assessment approach should the organization select?

   • AHybrid, because it always combines the strengths of both approaches and is the only option that satisfies the board.
   • BCompliance-based, because regulatory requirements must be met regardless of other factors.
   • CQuantitative, because it provides the most objective and precise results for the board.
   • DQualitative, because it can be completed quickly using expert judgment and is suitable when historical data is scarce.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial firm is evaluating the risk of a ransomware attack on its customer database. The database is valued at $2,000,000. Based on industry data, the exposure factor is 25% and the annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?

   • A$2,500,000
   • B$100,000
   • C$400,000
   • D$500,000
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturing company is conducting a qualitative risk assessment. The risk of a supply chain disruption is rated as 'High' likelihood and 'High' impact on a 3x3 matrix. The risk of a minor data breach is rated as 'Low' likelihood and 'Medium' impact. Which risk should be prioritized for immediate risk treatment?

   • ABoth equally, because all risks should be treated with the same priority.
   • BThe minor data breach, because data breaches always have higher regulatory consequences.
   • CThe supply chain disruption, because it falls in the high-risk cell of the matrix.
   • DNeither, because qualitative analysis cannot be used to prioritize risks.
   Reveal Solution Discussion Select an answer first