Select Two (Multi-Select) Questions

Potential for service downtime affecting patient care.

Why wrong: Downtime is an availability risk, not specifically privacy/compliance.

Loss of control over the cloud provider's internal access controls.

Why wrong: Loss of control is a general risk but not the most significant for privacy.

Vendor lock-in due to proprietary APIs.

Why wrong: Vendor lock-in is a business risk, not primarily privacy/compliance.

Detailed results of control testing

Why wrong: Control testing results are part of control assessments.

Cost-benefit analysis of risk responses

Why wrong: Cost-benefit analysis is performed during risk response selection.

Increase the risk appetite

Why wrong: Should not be adjusted for control failures.

Ignore if the deficiency is minor

Why wrong: All deficiencies should be addressed.

Immediately terminate the control owner

Why wrong: Extreme and not appropriate.

Automated collection of risk data from all sources.

Why wrong: Data collection is a prerequisite, not a component of the framework.

Statistical models for predicting future risks.

Why wrong: Predictive analytics is advanced, not a core component.

Rewrite the order matching engine in a memory-safe language

Why wrong: Rewriting the code removes the vulnerability, which is remediation, not a compensating control.

Deploy a Web Application Firewall (WAF) to block malicious payloads

Why wrong: A WAF is a preventive control that blocks attacks but does not compensate for the vulnerability; it's a separate security layer.

Enable detailed logging for all order matching transactions

Why wrong: Logging is detective and helps in forensics but does not reduce the likelihood or impact of the vulnerability.

The risk owner's signature

Why wrong: Signature is not a core component; approval is often documented elsewhere.

A detailed budget

Why wrong: Budget may be separate; the plan focuses on actions.

Risk mitigation

Why wrong: Risk mitigation is a treatment, not identification.

Risk transfer

Why wrong: Risk transfer is a response strategy, not identification.

Access control implementation

Why wrong: Access control is a control, not an identification technique.

Installing intrusion detection systems

Why wrong: IDS detects but does not prevent the initial infection.

Conducting periodic vulnerability scans

Why wrong: Scans identify vulnerabilities but do not mitigate them directly.

Regularly backing up critical data

Why wrong: Backups reduce impact, not likelihood.

A comprehensive list of all controls in the organization.

Why wrong: Monitoring should focus on key controls, not all.

A manual checklist for each control reviewed daily.

Why wrong: Manual checklists are not essential; automation is often used.

Real-time alerting for all control failures.

Why wrong: Real-time alerting is not always feasible or necessary.

Security baseline

Why wrong: A security baseline is a control, not a source for identification.

Risk treatment plan

Why wrong: The risk treatment plan is an output of risk management, not a source for identification.

Firewall logs

Why wrong: Firewall logs are operational data, not a primary source for project risk identification.

Segregation of duties

Why wrong: Segregation of duties is a control, not an identification technique.

Risk acceptance

Why wrong: Risk acceptance is a risk response, not identification.

Residual risk after implementing firewalls

Why wrong: Residual risk is after controls, not inherent.

Risk appetite defined by the board

Why wrong: Risk appetite is a threshold, not a risk itself.

Risk reduction achieved by multifactor authentication

Why wrong: This describes control effectiveness, not inherent risk.

Copies of vendor contracts

Why wrong: Contracts are reference documents, not typically in the report.

Network topology diagram

Why wrong: Network diagrams may be appendix but not a key component.

Residual risk assessment

Why wrong: Residual risk is evaluated after controls are applied.

Risk aggregation

Why wrong: Risk aggregation combines risks, not identifies them.

Monte Carlo simulation

Why wrong: Monte Carlo is used for quantitative analysis, not identification.

Risk appetite statements

Why wrong: Guides risk taking, not monitoring component.

Quarterly board reporting

Why wrong: Reporting is an output, not component.

Annual risk assessment updates

Why wrong: Part of risk management, not monitoring program.

Reduced need for manual controls

Why wrong: Not a common challenge; may be an outcome.

Improved decision-making

Why wrong: This is a goal, not a challenge.

They are based on historical data.

Why wrong: Lagging indicators are historical.

They measure past events and losses.

Why wrong: Lagging indicator characteristic.

Backup and recovery procedures.

Why wrong: Corrective control.

Firewall rules blocking unauthorized traffic.

Why wrong: Preventive control.

Separation of duties in financial systems.

Why wrong: Preventive control.

Control effectiveness rating

Why wrong: Control effectiveness is used in residual risk calculation, not directly in ALE.

Inherent risk score

Why wrong: Inherent risk score is a qualitative measure, not a quantitative input for ALE.

Risk appetite threshold

Why wrong: Risk appetite is a qualitative factor, not a quantitative input for ALE.

To calculate the financial impact of control failures.

Why wrong: Impact analysis is separate.

To determine the design adequacy of controls.

Why wrong: Design adequacy is assessed before implementation.

To identify new risks that were not previously assessed.

Why wrong: This is part of risk identification, not monitoring.