3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of organizational risk analysis?

   • ATo guarantee that all risks are eliminated
   • BTo assign blame for security incidents
   • CTo document risks without assessing their likelihood or impact
   • DTo identify threats, vulnerabilities, and potential impacts to assets and operations
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After a risk assessment, a bank has agreed on a risk treatment plan that includes implementing multi-factor authentication (MFA) for all remote access. The plan assigns the task to the IT operations team with a deadline of six months. What is the most important next step for the risk manager?

   • AImmediately conduct a penetration test to verify that MFA is working.
   • BInform the board that the risk is fully mitigated because a treatment plan exists.
   • CClose the risk in the risk register because a treatment has been agreed upon.
   • DDocument the treatment in the risk register, including the owner, timeline, and status, and schedule regular progress reviews.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A manufacturing company has identified a risk of ransomware affecting its production control systems. The risk analysis shows that the potential impact is high, but the likelihood is moderate. The company is considering several countermeasures. Which countermeasure would be most effective in reducing the risk to an acceptable level?

   • AAccept the risk because the company has never experienced a ransomware attack.
   • BDisconnect the production control systems from the network entirely.
   • CPurchase cyber insurance to cover the costs of a potential ransomware incident.
   • DImplement network segmentation and offline backups for the production control systems.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A university is conducting a risk analysis for its research data. The analysis team has identified that the data is stored on a mix of on-premises servers and cloud storage. They are unsure if all data locations are included in the asset inventory. What is the most important action to ensure the risk analysis is accurate?

   • AAssume that the cloud provider is responsible for all risks to the data.
   • BFocus the risk analysis only on the on-premises servers because they are more critical.
   • CVerify that the asset inventory includes all data repositories, including cloud storage and shadow IT.
   • DDelay the risk analysis until a complete inventory is available.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following best describes risk appetite?

   • AThe minimum level of risk required for business operations
   • BThe amount of risk an organization is willing to accept in pursuit of its objectives
   • CThe level of risk that triggers mandatory reporting to regulators
   • DThe maximum amount of risk that can be transferred to insurance
   Reveal Solution Discussion Select an answer first