Domain 4 – Information Governance and Risk Management

Question 1

An organization maintains Protected Health Information in the cloud, on local systems in its offices, and on paper records. Which form of information has the greatest impact on the organization if it is breached?

A. Paper based records
B. Cloud based records
C. Local system based records
D. The impact is the same regardless of media

Answer 1

D. The impact is the same regardless of media

Question 2

An oncology practice has outsourced its infrastructure to XYZ corporation. Due to no contract limitations, XYZ corporation has further sub-contracted the infrastructure work to another firm, ABC Group. The oncology practice’s infrastructure is responsible for processing, storing, and transmitting the PHI of oncology patients. In this scenario, which organization is affiliated with the information owner/steward who would be held accountable in a breach?

A. The oncology practice
B. XYZ corporation
C. ABC Group
D. None as the contracting relationship has created a transference of risk.

Answer 2

A. The oncology practice

Question 3

The following represents four basic steps in managing risk. Place them in the correct sequential order:

1. Monitoring risk - continuously monitor the risk environment
2. Assessing risk – identify threats, vulnerabilities, impact, likelihood, and determine risk
3. Framing risk - produce the risk strategy, identify risk tolerance, assumptions, and constraints
4. Responding to risk – identify a consistent manner to respond to risk from an organization-wide perspective

A. 1, 2, 3, 4
B. 4, 3, 2, 1
C. 3, 2, 4, 1
D. 2, 1, 4, 3

Answer 3

C. 3, 2, 4, 1

Question 4

Organizational risk tolerance is BEST established by

A. Senior leadership.
B. Information system owner.
C. Information system security officer.
D. Information owner.

Answer 4

A. Senior leadership.

Question 5

An organization is reviewing their financial exposure should a breach occur. A senior penetration tester has determined in the past they have been breached two times a year, and each time it has cost the organization U.S. $100,000 to mitigate the breach and offer credit monitoring. What is the annual loss expectancy (ALE) for the organization?

A. U.S. $50,000
B. U.S. $25,000
C. U.S. $200,000
D. U.S. $250,000

Answer 5

C. U.S. $200,000

Question 6

Annual loss expectancy or ALE is a form of:

A. Qualitative risk assessment.
B. Quantitative risk assessment.
C. Qualitative and quantitative risk assessment.
D. Continuous monitoring.

Answer 6

B. Quantitative risk assessment.

Question 7

Which of the following classes of controls are primarily implemented and executed through mechanisms contained in the hardware, software, and firmware of the components of the system?

A. Technical Controls
B. Managerial Controls
C. Operational Controls
D. Physical Controls

Answer 7

A. Technical Controls

Question 8

An organization has just completed a risk assessment. The assessment returned a single finding with a “low” risk to the organization. The cost to mitigate or transfer the risk would be U.S. $1.5 million dollars, and if the risk were exploited, no PHI or sensitive information would be lost, but the organization’s public website would be down for 10 to 15 seconds no more than twice a year. The organization earns about U.S. $1 million dollars of revenue every year. What is the BEST risk treatment approach?

A. Transfer risk
B. Avoid risk
C. Mitigate risk
D. Accept risk

Answer 8

D. Accept risk

Question 9

Consider the NIST risk management framework below: If an organization has adopted NIST as its risk management framework, which step is MOST important in ensuring proper risk management?

A. Continuous monitoring
B. Implement security controls
C. Authorize information system
D. Categorize information system

Answer 9

D. Categorize information system

Question 10

A remediation plan or plan of actions and milestones (POA&M) is MOST effective when it contains the following:

A. system downtime, resources required, responsible person, and a date for completion
B. list of activities, resources required, responsible person, and a date for completion
C. list of activities, system downtime, responsible person, and a date for completion
D. list of activities, resources required, responsible person, and system downtime

Answer 10

B. list of activities, resources required, responsible person, and a date for completion