70-413 Exam Risk Assessment & Management 5

Question 1

You are designing a Windows Server 2012 R2 deployment for a healthcare organization. HIPAA requires you to implement safeguards proportionate to identified risks. Which process does HIPAA mandate as the starting point?

Accepted Answer

Risk analysis

Answer

HIPAA Security Rule requires covered entities to conduct a formal risk analysis as the foundational step before implementing security safeguards.

Question 2

An organization discovers that a third-party vendor with access to its network has poor security practices. Which risk management response involves requiring the vendor to meet specific security standards contractually?

Accepted Answer

Risk transference via contract SLA and security requirements

Answer

Contractually requiring vendors to meet security standards transfers some responsibility and risk to the third party through legally binding terms.

Question 3

Which Windows Server feature allows administrators to track changes to security-sensitive files and registry keys, supporting the 'detective control' risk management strategy?

Accepted Answer

File and Registry Auditing via Group Policy

Answer

File and registry auditing configured through Group Policy logs changes to sensitive objects, enabling detection of unauthorized modifications.

Question 4

A risk assessment reveals that a single administrator account is used by multiple IT staff members. What type of risk does this shared account create?

Accepted Answer

Repudiation risk — inability to attribute actions to specific individuals

Answer

Shared accounts eliminate non-repudiation because actions cannot be attributed to a specific individual, creating significant accountability and audit gaps.

Question 5

In risk management, what is the relationship between 'threat,' 'vulnerability,' and 'risk'?

Accepted Answer

Risk = Threat × Vulnerability × Asset Value

Answer

Risk is a function of the threat exploiting a vulnerability against an asset, commonly expressed as Risk = Threat × Vulnerability × Asset Value.

70-413 Exam Practice Test

70-413 Exam Practice Test

70-413 Exam Risk Assessment & Management 5