70-413 Exam Risk Assessment & Management 5 — Questions and Answers
Question 1: You are designing a Windows Server 2012 R2 deployment for a healthcare organization. HIPAA requires you to implement safeguards proportionate to identified risks. Which process does HIPAA mandate as the starting point?
- Penetration testing
- Risk analysis (Correct answer)
- Disaster recovery planning
- Security awareness training
Correct answer: Risk analysis
HIPAA Security Rule requires covered entities to conduct a formal risk analysis as the foundational step before implementing security safeguards.
Question 2: An organization discovers that a third-party vendor with access to its network has poor security practices. Which risk management response involves requiring the vendor to meet specific security standards contractually?
- Risk avoidance by terminating the vendor
- Risk transference via contract SLA and security requirements (Correct answer)
- Risk acceptance with enhanced monitoring
- Risk mitigation by patching the vendor's systems
Correct answer: Risk transference via contract SLA and security requirements
Contractually requiring vendors to meet security standards transfers some responsibility and risk to the third party through legally binding terms.
Question 3: Which Windows Server feature allows administrators to track changes to security-sensitive files and registry keys, supporting the 'detective control' risk management strategy?
- Windows Defender Firewall
- File and Registry Auditing via Group Policy (Correct answer)
- BitLocker Drive Encryption
- Windows Server Update Services
Correct answer: File and Registry Auditing via Group Policy
File and registry auditing configured through Group Policy logs changes to sensitive objects, enabling detection of unauthorized modifications.
Question 4: A risk assessment reveals that a single administrator account is used by multiple IT staff members. What type of risk does this shared account create?
- Repudiation risk — inability to attribute actions to specific individuals (Correct answer)
- Availability risk — the account may be locked out
- Integrity risk — password complexity cannot be enforced
- Confidentiality risk — the password is written down
Correct answer: Repudiation risk — inability to attribute actions to specific individuals
Shared accounts eliminate non-repudiation because actions cannot be attributed to a specific individual, creating significant accountability and audit gaps.
Question 5: In risk management, what is the relationship between 'threat,' 'vulnerability,' and 'risk'?
- Risk = Threat × Vulnerability × Asset Value (Correct answer)
- Risk = Vulnerability + Threat
- Threat = Risk / Vulnerability
- Vulnerability = Risk - Asset Value
Correct answer: Risk = Threat × Vulnerability × Asset Value
Risk is a function of the threat exploiting a vulnerability against an asset, commonly expressed as Risk = Threat × Vulnerability × Asset Value.
Question 6: A company uses Hyper-V and wants to ensure that if a VM is compromised, the attacker cannot access the host OS. Which risk mitigation approach BEST addresses VM-to-host attack paths?
- Enable dynamic memory for all VMs
- Apply principle of least privilege to VM admin roles and disable unnecessary Hyper-V integration services (Correct answer)
- Use live migration to move VMs between hosts
- Enable Remote Desktop on the host for easier management
Correct answer: Apply principle of least privilege to VM admin roles and disable unnecessary Hyper-V integration services
Limiting VM admin privileges and disabling unnecessary integration services reduces the attack surface available for VM-to-host escape attempts.
Question 7: During a risk assessment, you find that the Recovery Time Objective (RTO) for a critical server is 4 hours, but the current disaster recovery plan requires 12 hours to restore. What risk does this gap represent?
- A compliance risk — regulatory penalties may apply
- An availability risk — the business cannot meet its recovery commitment (Correct answer)
- A confidentiality risk — data may be exposed during recovery
- A strategic risk — IT investment decisions are misaligned
Correct answer: An availability risk — the business cannot meet its recovery commitment
A gap between RTO and actual recovery time represents an availability risk — the organization cannot restore services within the business-required timeframe.
70-413 Exam Risk Assessment & Management 5
You are designing a Windows Server 2012 R2 deployment for a healthcare organization.
HIPAA requires you to implement safeguards proportionate to identified risks.
Which process does HIPAA mandate as the starting point?