Question 1

A healthcare organization is evaluating risks to its patient data management system. To effectively identify risks, what approach should be used?

Options :

A : Conducting a comprehensive audit of the IT infrastructure.

B : Asset-based risk identification, including hardware, software, and data assets.

C : Focusing on the legal and regulatory compliance aspects of patient data.

D : Engaging external experts to perform a risk assessment.

Answer: B

Question 2

A government agency is adopting EBIOS to assess and manage risks related to a new public service application. The team is in the fifth workshop of EBIOS. What should be the focus of this workshop, and how does it contribute to the ongoing risk management of the public service application?

Options :

A : Developing a one-time risk mitigation strategy that addresses all identified risks.

B : Outsourcing risk mitigation to a third-party service provider without internal analysis.

C : Focusing solely on technological solutions to mitigate risks.

D : Creating and implementing risk mitigation plans that address the specific risks identified, including prioritizing actions and monitoring the effectiveness of these plans.

Answer: D

Question 3

A hospital's electronic health record (EHR) system is infected with ransomware, encrypting patient records. What is the primary consequence of this ransomware attack in terms of the CIA triad?

Options :

A : Financial losses due to paying the ransom.

B : Loss of availability of patient records for healthcare providers.

C : Unauthorized disclosure of patient health information.

D : Permanent deletion of patient records, impacting data integrity.

Answer: B

Question 4

A financial institution is evaluating the risks of implementing a new mobile banking application. The risk manager must gather input from various departments, including IT, compliance, and customer service. How should the risk manager facilitate the risk identification process to ensure all relevant risks are captured?

Options :

A : Organize a workshop where representatives from all departments can discuss and identify risks together.

B : Assume the most significant risks based on industry standards and inform the departments of these risks.

C : Rely solely on the IT department-s assessment, as they are most familiar with the technical aspects of the application.

D : Ask each department to independently submit their risk assessments and then compile them without further discussion.

Answer: A

Question 5

An online retailer is evaluating the risk of data breaches in its customer database. They are considering implementing advanced encryption, increasing cybersecurity insurance coverage, conducting regular penetration testing, or retaining the risk as is. Which option represents risk sharing according to ISO/IEC 27005?

Options :

A : Conducting regular penetration testing.

B : Increasing cybersecurity insurance coverage.

C : Retaining the risk as is.

D : Implementing advanced encryption.

Answer: B