ACI Risk Management & Mitigation 3

Question 1

An investigator finds that an employee accessed sensitive HR files outside business hours for 30 consecutive days. In risk terms, this pattern is BEST classified as:

Accepted Answer

An insider threat indicator

Answer

Repeated after-hours access to sensitive data by an authorized user is a classic insider threat behavioral indicator.

Question 2

Which document formally authorizes an investigator to proceed with a digital forensic examination and limits legal risk to the organization?

Accepted Answer

Written authorization or consent form

Answer

Written authorization or consent ensures the investigation is legally sanctioned and protects the investigator and organization from unauthorized search claims.

Question 3

A risk mitigation plan identifies that patching a critical vulnerability will take 30 days. What should the organization implement in the interim?

Accepted Answer

Implement compensating controls to reduce exposure

Answer

Compensating controls (such as additional monitoring, network segmentation, or access restrictions) reduce risk exposure while a permanent fix is pending.

Question 4

During an investigation into a data breach, the ACI examiner must determine which assets were affected. What is this process called?

Accepted Answer

Asset inventory and classification

Answer

Asset inventory and classification identifies and categorizes all resources so investigators can determine what was exposed or compromised.

Question 5

Which type of risk analysis assigns numeric values to likelihood and impact to produce a quantitative risk score?

Accepted Answer

Quantitative risk analysis

Answer

Quantitative risk analysis uses numerical values (e.g., Annual Loss Expectancy) to objectively measure and compare risks.

(ACI) AccessData Certified Investigator Practice Test

(ACI) AccessData Certified Investigator Practice Test

ACI Risk Management & Mitigation 3