Review Questions - SYS701 - 17 - Risk Management and Privacy

Jen identified a missing patch on a Windows server that might allow an attacker to gain remote control of the system. After consulting with her manager, she applied the patch. From a risk management perspective, what has she done?

You notice a high number of SQL injection attacks against a web application run by your organization, so you install a web application firewall to block many of these attacks before they reach the server. How have you altered the severity of this risk?

Aziz is responsible for the administration of an e-commerce website that generates $100,000 per day in revenue for his firm. The website uses a database that contains sensitive information about the firm’s customers. He expects that a compromise of that database would result in $500,000 of fines against his firm.

Aziz is assessing the risk of a SQL injection attack against the database where the attacker would steal all of the customer personally identifiable information (PII) from the database. After consulting threat intelligence, he believes that there is a 5 percent chance of a successful attack in any given year.

What is the asset value (AV)?

What is the exposure factor (EF)?

What is the single loss expectancy (SLE)?

What is the annualized rate of occurrence (ARO)?

What is the annualized loss expectancy (ALE)?

Grace recently completed a risk assessment of her organization’s exposure to data breaches and determined that there is a high level of risk related to the loss of sensitive personal information. She is considering a variety of approaches to managing this risk.

Grace's first idea is to add a web application firewall to protect her organization against SQL injection attacks. What risk management strategy does this approach adopt?

Business leaders are considering dropping the customer activities that collect and store sensitive personal information. What risk management strategy would this approach use?

Grace's company decided to install the web application firewall and continue doing business. They are still worried about other risks to the information that were not addressed by the firewall and are considering purchasing an insurance policy to cover those risks. What strategy does this use?

In the end, Grace's risk managers found that the insurance policy was too expensive and opted not to purchase it. They are taking no additional action. What risk management strategy is being used in this situation?

Under the European Union's GDPR, what term is assigned to the individual who leads an organization's privacy efforts?

Helen's organization maintains medical records on behalf of its customers, who are individual physicians. What term best describes the role of Helen's organization?

Gene recently conducted an assessment and determined that his organization can be without its main transaction database for a maximum of two hours before unacceptable damage occurs to the business. What metric has Gene identified?

Tina works for a hospital system and manages the system's patient records. What category of personal information best describes the information that is likely to be found in those records?

Asa believes that her organization is taking data collected from customers for technical support and using it for marketing without their permission. What principle is most likely being violated?

Which one of the following U.S. government classification levels requires the highest degree of security control?

Which type of analysis uses numeric data in the analysis, resulting in assessments that allow the very straightforward prioritization of risk?

What term is given to an individual or organization who determines the reasons for processing personal information?

Brian recently conducted a risk mitigation exercise and has determined the level of risk that remains after implementing a series of controls. What term best describes this risk?

Vulnerability Removal

Risk Probability Reduction

Asset Value (AV)

Exposure Factor (EF)

Single Loss Expectancy (SLE)

Annualized Rate of Occurrence (ARO)

Annualized Loss Expectancy (ALE)

Risk Mitigation

Risk Avoidance

Risk Transference

Risk Acceptance

Data Protection Officer (DPO)

Data Processor

Recovery Time Objective (RTO)

PHI

Purpose Limitation

Top Secret

Quantitative Analysis

Data Controller

Residual Risk