Unit 6: Risk Management, Data Protection and Compliance - Practice Quiz

1 What is a risk in the context of information security?

2 Which risk treatment strategy involves purchasing insurance to shift the financial impact to another party?

3 What does ALE stand for in quantitative risk analysis?

4 The formula uses ARO to represent what?

5 Choosing not to perform a risky activity at all is an example of which strategy?

6 What does SLA stand for in vendor management?

7 Which document is a formal agreement that two or more parties establish to describe a broad intent to work together, often without being legally binding?

8 What is the main purpose of vendor due diligence?

9 A document that specifically defines the tasks, deliverables, and timelines for a project with a vendor is called a:

10 What is the purpose of an NDA (Non-Disclosure Agreement) with a vendor?

11 What is the primary purpose of a security audit?

12 Which type of audit is performed by an organization's own staff?

13 A penetration test is best described as:

14 What does a vulnerability assessment primarily do?

15 An attestation of findings in an audit refers to:

16 Which of the following is a common data classification level?

17 PII stands for which of the following?

18 Which regulation primarily governs the protection of personal data for individuals in the European Union?

19 The main goal of data classification is to:

20 The practice of requiring employees to take time off so irregularities can be detected is known as:

21 A security team calculates that a server failure causes a loss of $50,000 per incident and is expected to occur twice per year. What is the Annualized Loss Expectancy (ALE)?

22 An organization decides to purchase cyber insurance to offset the financial impact of a potential breach. Which risk response strategy is being used?

23 A company evaluates a risk by assigning labels of "High", "Medium", and "Low" to likelihood and impact instead of dollar figures. Which type of risk assessment is this?

24 After applying controls to a system, some risk still remains. The level of risk that remains after controls are implemented is best described as:

25 A business sets a Recovery Time Objective (RTO) of 4 hours for its order system. What does this value represent?

26 A company signs an agreement with a cloud provider that specifies 99.9% uptime and defined response times for support tickets. Which document defines these measurable performance commitments?

27 Before onboarding a new SaaS vendor, a security analyst reviews the vendor's financial stability, security certifications, and past breach history. This process is best described as:

28 An organization wants to ensure it can inspect a vendor's security controls at any time during the contract. Which contractual provision should it include?

29 A manufacturer relies on a single supplier for a critical hardware component. A security review flags this as a risk because the supplier could be compromised or go out of business. This concern falls under:

30 Two internal departments agree to share security monitoring responsibilities using an informal, non-binding document that outlines mutual expectations. This document is most likely a(n):

31 An external firm is hired to actively exploit vulnerabilities in a company's web application to demonstrate real-world impact. This activity is best described as:

32 A tester is given no prior knowledge of the target system's internal architecture and must discover everything from the outside. This testing approach is called:

33 A company undergoes an audit conducted by its own internal security team to prepare for an upcoming regulatory review. This is an example of a(n):

34 An assessor compares an organization's current security controls against the requirements of a target framework and documents the differences. This activity is known as a:

35 During an engagement, testers are allowed to attack systems while the defending blue team is unaware the test is happening. This exercise setup is typically called a:

36 A hospital must protect patient medical records in the United States. Which regulation primarily governs the handling of this data?

37 An organization labels data as Public, Internal, Confidential, and Restricted so that controls can be applied based on sensitivity. The primary purpose of this scheme is to:

38 A European customer requests that a company delete all personal data it holds about them. Which regulation grants this "right to erasure"?

39 An organization that stores and processes credit card transactions must comply with a specific security standard. That standard is:

40 The person responsible for determining the classification level of a data set and authorizing access to it is best described as the data:

41 An organization calculates that a server breach has a Single Loss Expectancy (SLE) of $50,000 and occurs on average twice per year. A proposed control costing $30,000 annually would reduce the Annualized Rate of Occurrence (ARO) to . What is the net annual benefit of implementing the control?

42 A CISO accepts a residual risk, documents the decision, and sets a date to formally revisit it in 12 months because a mitigating technology is expected to mature. Which risk treatment concept most precisely describes this action?

43 Two risks have identical qualitative ratings of "High." Risk A has low likelihood but catastrophic impact; Risk B has high likelihood but moderate impact. Why can relying solely on this qualitative label mislead prioritization decisions?

44 An organization adopts a risk appetite statement but repeatedly approves projects whose risk exceeds stated tolerance thresholds. What is the most accurate characterization of this governance failure?

45 A quantitative analysis yields an Exposure Factor (EF) of for an asset valued at $200,000, with an ARO of . Management wants ALE below $120,000. What minimum ARO reduction (as a new ARO value) achieves this without changing EF or asset value?

46 A company relies on a SaaS vendor that subcontracts data storage to a fourth party in another jurisdiction. Which contractual mechanism most directly addresses the risk introduced by this fourth party?

47 During vendor selection, a security team must choose between an RFP and an RFQ. The requirement is complex, outcome-based, and the team wants vendors to propose how they would meet security objectives. Which instrument is most appropriate and why?

48 A vendor provides a SOC 2 Type I report. The security team argues this is insufficient for ongoing assurance. What is the strongest justification for their position?

49 An organization wants to limit concentration risk from depending on a single critical cloud provider. Which strategy most directly mitigates this specific risk category?

50 A critical vendor is acquired by a competitor of your firm. Which contractual provision, if present, most directly protects your organization in this scenario?

51 An external auditor finds that a control is documented and designed correctly but was not consistently followed during the audit period. How should this finding be classified?

52 A penetration test and a vulnerability assessment are both proposed. The board wants evidence of exploitability and real-world attack impact, not just a list of weaknesses. Which engagement meets this requirement, and what is the key distinction?

53 An internal audit function reports directly to the CFO whose department it also audits. Which independence principle is most directly compromised?

54 A regulated firm must demonstrate compliance to a government agency. The firm engages a third party to perform the review and produce an authoritative determination. Which type of assessment best fits this requirement?

55 An attestation report states the auditor expresses "reasonable assurance" rather than "absolute assurance." What does this terminology most accurately convey?

56 A dataset contains names paired with purchase histories but all direct identifiers (SSNs, account numbers) are removed. Analysts can still re-identify individuals by linking the data to a public voter registry. Which concept most precisely describes the residual risk?

57 An organization operating under GDPR must transfer EU personal data to a processor in a country lacking an adequacy decision. Which mechanism most directly legitimizes this transfer?

58 A data owner classifies a dataset as "Confidential," but the custodian applies controls appropriate for "Public" data due to a misread policy. Who bears accountability for the classification decision, and who is responsible for implementing controls?

59 A company subject to both GDPR and a conflicting data-localization law in another jurisdiction cannot simultaneously comply with both. Which governance concept best frames the appropriate response?

60 An organization enforces mandatory vacation and job rotation for employees in sensitive financial roles. Beyond employee well-being, what is the primary security rationale for these policies?