3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key output of organizational risk analysis?

   • AA prioritized list of risks based on their likelihood and impact
   • BA set of insurance policies for the organization
   • CA list of all employees and their roles
   • DA detailed network diagram of the organization
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of countermeasures and mitigating controls in risk management?

   • ATo reduce the likelihood or impact of identified risks
   • BTo eliminate the need for risk assessments
   • CTo document risks for regulatory compliance only
   • DTo transfer all risks to external parties
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A hospital is evaluating risk treatments for a legacy patient records system that has a known critical vulnerability. The vulnerability could lead to a data breach with an estimated impact of $5 million and a likelihood of 20% per year. The hospital is considering two options: (1) patching the system at a cost of $100,000, which would reduce the likelihood to 2%, and (2) purchasing cyber insurance with a premium of $150,000 per year that covers the full impact. The hospital's risk appetite allows for a maximum annual loss of $500,000 from data breaches. Which option should the hospital choose?

   • APurchase the insurance because it fully covers the impact and is within the risk appetite.
   • BAccept the risk because the current ALE of $1,000,000 is within the risk appetite.
   • CPatch the system because it reduces the annualized loss expectancy (ALE) to $100,000, which is within the risk appetite.
   • DImplement both patching and insurance to eliminate the risk completely.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare organization is updating its risk management program. The previous asset inventory is two years old and known to be incomplete. The risk manager needs to ensure that the new risk analysis is based on a reliable inventory. What is the most effective first step?

   • AConduct a discovery scan of the network and reconcile the results with the existing inventory, including physical assets and data repositories.
   • BStart the risk analysis immediately and update the inventory as risks are identified.
   • CUse the existing inventory as a baseline and only add new assets that are known to the IT department.
   • DAsk each department to submit a list of their critical assets without verification.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A logistics company is evaluating two risk treatment options for a high-impact risk: implementing an advanced intrusion detection system (IDS) at a cost of $200,000 per year, or purchasing cyber insurance with an annual premium of $50,000. The risk analysis estimates that the annualized loss expectancy (ALE) without treatment is $500,000. The IDS is expected to reduce the ALE by 80%. Which option should the company choose based on cost-benefit analysis?

   • APurchase the insurance because it is cheaper than the IDS.
   • BImplement the IDS because it reduces the ALE by $400,000, resulting in a net benefit of $200,000.
   • CAccept the risk because the cost of either treatment exceeds the expected loss.
   • DImplement the IDS and purchase insurance to fully eliminate the risk.
   Reveal Solution Discussion Select an answer first