Security and Risk Management practice questions

Answer: A) Due diligence

Investigating and verifying a third party's security before committing is due diligence. Due care is the follow-up of acting reasonably on that knowledge.

• ADue diligence is the investigation and verification done to understand risk before acting or committing, for example researching a provider's security posture before signing. All common framings of the term agree on this.
• BDue care is acting reasonably on what you know, for example putting appropriate safeguards and contract clauses in place, as a prudent person would. Researching the provider before the decision is due diligence.
• CRisk transference shifts the financial impact of a risk to another party, for example through insurance or contractual indemnity. Reviewing the provider's reports does not transfer any risk.
• DLeast privilege limits each subject's access to what its tasks require. It is an access control principle, not the act of evaluating a supplier.

Answer: A) Risk transfer (sharing); senior management / the data owner formally accepts any residual risk that remains

• AInsurance transfers financial impact to a third party but never removes all risk (reputational harm, deductibles, uninsured losses remain); accountable senior leadership must accept that residual amount.
• BAvoidance means ceasing the risky activity entirely, and residual-risk acceptance is a management responsibility, not the security team's.
• CBuying insurance is transfer, not mitigation, and residual risk always requires documented acceptance.
• D'Ignoring' risk is not an accepted treatment, and auditors assess rather than accept risk on the organization's behalf.

Answer: A) HIPAA Privacy and Security Rules, which apply to the company as a business associate

Patient diagnosis and treatment records are PHI. HIPAA's Privacy and Security Rules apply to covered entities and also to their business associates, such as a cloud provider that processes PHI for a hospital.

• ACorrect. HIPAA governs protected health information (PHI). It applies to covered entities such as health care providers, and also to business associates that create, receive, maintain or transmit PHI for them. The analytics company is a business associate, so the Privacy and Security Rules apply to it.
• BIncorrect. SOX deals with the accuracy of financial reporting at public companies. It does not regulate how patient health records are protected.
• CIncorrect. PCI DSS is a payment card industry standard that applies to cardholder data. Diagnosis and treatment records are not cardholder data.
• DIncorrect. GLBA applies to customer financial information held by financial institutions. A hospital's clinical records are not covered by it.

Answer: A) Disclosing a critical vulnerability responsibly to the affected vendor rather than exploiting it or selling it

• AResponsible disclosure protects the broader public and infrastructure rather than causing or profiting from harm.
• BThat directly harms public trust and safety for personal gain.
• CUnauthorized exploitation violates law and ethics regardless of intent.
• DConcealing known risk from those accountable for the organization violates professional obligations.

Answer: A) DRP is a subset of BCP that focuses on restoring IT systems, and both take recovery priorities from the BIA

BCP is the broad program for keeping critical business functions running, and DRP is the IT-recovery subset within it. Both get their priorities and RTO/RPO targets from the business impact analysis.

• ABCP is the umbrella program for sustaining critical business functions across people, processes, facilities, and technology. DRP is its technology-recovery component. Both are driven by the business impact analysis, which sets priorities and RTO/RPO targets.
• BThis reverses the relationship. The DR plan should be part of the broader BCP, because restoring IT alone does not guarantee the business can operate.
• CThe plans must be coordinated, and DR targets come from the same business impact analysis. A standalone DR plan can restore a system that the business still cannot use.
• DScope is not split by type of threat. Both plans address disruptions from any cause; they differ in breadth (whole business versus IT recovery).

Answer: A) PASTA

PASTA is the risk-centric threat modeling methodology whose seven stages link business objectives to technical analysis, attack simulation and risk and impact analysis. STRIDE classifies threats, DREAD rates their severity, and LINDDUN covers privacy threats.

• ACorrect. PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric threat modeling methodology. Its seven stages run from defining business objectives to attack modeling and risk and impact analysis.
• BIncorrect. STRIDE sorts threats into six categories (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege). It is a way to classify threats, not a seven-stage, business-driven process.
• CIncorrect. DREAD rates how severe an individual threat is (damage potential, reproducibility, exploitability, affected users, discoverability). It doesn't take you from business objectives through attack simulation.
• DIncorrect. LINDDUN is a privacy threat modeling framework that focuses on data protection risks. It is not the seven-stage, risk-centric attack simulation methodology described.

Answer: A) The NIST Cybersecurity Framework (CSF)

• AThe NIST CSF is organized into those core functions (plus Govern in CSF 2.0) and is widely used to assess and communicate cybersecurity posture; ISO 27001 is a certifiable ISMS standard, COBIT is IT governance, and CIS Controls is a prioritized control list.
• BPCI DSS is a prescriptive, mandatory standard for cardholder data, not a voluntary function-based framework.
• COSI describes network layers, not a cybersecurity program framework.
• DITIL is an IT service management framework, not a cybersecurity-outcome framework.

Answer: A) (1) policy, (2) standard, (3) procedure, (4) guideline

Policies are mandatory high-level statements of management intent. Standards are mandatory specific requirements. Procedures are step-by-step instructions. Guidelines are optional recommendations.

• ACorrect. A policy is management's mandatory, high-level statement of intent. A standard makes a specific choice mandatory, such as TLS 1.2 or later. A procedure gives detailed step-by-step instructions. A guideline is advice that is recommended but optional.
• BIncorrect. This swaps standard and guideline. The TLS 1.2 requirement is mandatory, so it is a standard. The cipher-suite advice is optional and adaptable, so it is a guideline.
• CIncorrect. The broad statement from management is the policy, not a standard. Step-by-step instructions are a procedure, and optional advice is a guideline, not a procedure.
• DIncorrect. A specific mandatory technical requirement such as TLS 1.2 or later is a standard. Detailed how-to instructions are a procedure, not a standard.

Answer: A) A contractual requirement enforced through the acquirer and the card brands

PCI DSS is an industry standard created by the card brands. It binds merchants through contracts with acquirers and payment brands, not through statute or government regulation.

• ACorrect. PCI DSS is a proprietary standard mandated by the card brands and administered by the PCI SSC. Payment brands and acquirers enforce compliance through their agreements with merchants.
• BNo government agency issues or enforces PCI DSS. Enforcement comes from the payment brands and acquirers, not from a regulator.
• CThe scenario says no law refers to PCI DSS. The standard comes from the PCI Security Standards Council, which the card brands founded, not from legislation.
• DPCI DSS is not optional for merchants that handle cardholder data. Acquirers and card brands can enforce it under their agreements.

Answer: A) The Delphi technique

The Delphi technique combines anonymity, controlled feedback and repeated rounds to reach expert consensus without group pressure. Brainstorming, interviews and group scoring sessions each lack anonymity, iteration or both.

• ACorrect. Delphi gathers anonymous expert opinions, feeds back the aggregated results, and repeats the process over several rounds until consensus emerges. Because no one knows who said what, the influence of authority and group pressure is reduced.
• BIncorrect. Brainstorming produces many ideas quickly, but participants contribute openly in the same room. That exposes the group to the pressure from dominant or senior voices that the team wants to avoid, and it isn't an anonymous, multi-round process.
• CIncorrect. Interviews collect each expert's view privately, but they don't feed back the panel's aggregated responses or drive revisions across rounds toward consensus.
• DIncorrect. The group agrees on likelihood and impact ratings together in open discussion, so ratings aren't anonymous and senior participants can steer the outcome.