Define How Security Controls Contribute to Business Operating Cost and Offsetting Risk. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization is considering a cyber insurance policy to cover costs associated with a potential data breach. The annual premium is $50,000, and the policy has a $100,000 deductible. The organization's risk assessment estimates a 5% annual probability of a breach with a potential $2 million impact. Which statement BEST describes how this insurance policy functions as a risk offset mechanism?

   • AIt eliminates the risk of a data breach entirely by shifting liability to the insurer
   • BIt converts the variable cost of a breach into a fixed annual cost with no residual financial exposure
   • CIt reduces the probability of a breach because the insurer mandates security controls
   • DIt transfers a portion of the financial risk to the insurer, but the organization retains the deductible and premium costs
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a potential negative impact of a security control on business operating costs?

   • AReduced risk of data breaches
   • BDecreased efficiency due to additional authentication steps
   • CLower insurance premiums due to improved security posture
   • DIncreased employee productivity due to streamlined access
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of an indirect cost associated with a security control?

   • AThe salary of the security engineer who configures the firewall
   • BThe reduced productivity of employees who must use multi-factor authentication every login
   • CThe cost of the hardware appliance for a firewall
   • DThe annual maintenance fee for the firewall software
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An organization with a low risk appetite is deciding how much to invest in security controls. Which approach best aligns with its risk appetite?

   • AInvest only in controls that are required by law
   • BInvest in controls that reduce risk to a level the organization is willing to accept
   • CInvest the same amount as industry peers regardless of risk
   • DAvoid investing in controls to minimize costs
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retail company is deciding between two security controls: a cloud-based email filtering service at $15,000/year with no additional staffing, and an on-premises email security appliance at $40,000 one-time cost plus $10,000/year maintenance, requiring 0.5 FTE to manage. The company's risk assessment shows phishing is the primary threat vector. Which cost component is MOST likely to be overlooked when comparing these two options?

   • AThe direct cost of the cloud service subscription fee
   • BThe annual maintenance fee for the on-premises appliance
   • CThe indirect cost of staff time spent managing the on-premises appliance
   • DThe one-time capital expenditure for the on-premises appliance
   Reveal Solution Discussion Select an answer first