Define How Security Controls Contribute to Business Operating Cost and Offsetting Risk. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When budgeting for a new security information and event management (SIEM) platform, which of the following is considered a direct cost?

   • AThe productivity loss of employees who must attend security awareness training
   • BThe annual license fee for the SIEM software
   • CThe opportunity cost of not investing in other business projects
   • DThe increased insurance premium due to the new control
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is considering a security control that costs $75,000/year. The control is expected to reduce the probability of a $500,000 breach from 15% to 5%. The company's risk appetite is moderate, and they are willing to accept some residual risk. What is the NET financial benefit of this control?

   • A$25,000 net benefit
   • B$50,000 net benefit
   • C$25,000 net loss
   • D$75,000 net loss
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a low risk appetite and is evaluating two security controls for a critical application. Control A costs $150,000/year and reduces the probability of a $1,000,000 breach from 10% to 2%. Control B costs $80,000/year and reduces the probability of the same breach from 10% to 5%. The company has a budget of $200,000 for security controls. Which option BEST aligns with the company's low risk appetite and budget?

   • AImplement neither control and accept the risk
   • BImplement both Control A and Control B for defense-in-depth
   • CImplement Control B only, as it is more cost-effective
   • DImplement Control A only, as it provides the greatest risk reduction
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is considering a security control that costs $100,000/year. The control is expected to reduce the probability of a $1,000,000 breach from 20% to 5%. The company's risk appetite is moderate, and they are willing to accept some residual risk. What is the ANNUALIZED LOSS EXPECTANCY (ALE) after implementing the control?

   • A$200,000
   • B$150,000
   • C$100,000
   • D$50,000
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A manufacturing company is considering two risk mitigation options for a legacy system that cannot be patched. Option A: implement a network segmentation control that isolates the system, costing $30,000/year. Option B: purchase a cyber insurance policy that covers losses from a breach of the system, costing $25,000/year. The company's risk appetite is low, and the system is critical to production. Which approach BEST aligns with the company's risk appetite?

   • AImplement network segmentation because it reduces the likelihood of a breach, aligning with a low risk appetite
   • BImplement both segmentation and insurance to maximize protection
   • CAccept the risk because the system is critical and cannot be isolated
   • DPurchase the insurance policy because it is cheaper and transfers financial risk
   Reveal Solution Discussion Select an answer first