Cyber and Data Security Risk Flashcards

Which California law gives consumers rights to know, delete, and opt out of the sale of their personal information?

Answer: California Consumer Privacy Act

The CCPA, as amended by the CPRA, grants California residents these privacy rights.

Which element of a cyber incident response plan should typically come first after an attack is confirmed?

Answer: Containment to limit spread

Containment stops the damage from spreading before eradication and recovery begin.

An organization keeps offline, immutable backups tested regularly. This control most directly mitigates which risk?

Answer: Ransomware-driven data loss

Offline, immutable backups allow restoration without paying ransom because attackers cannot encrypt them.

Which statement about cyber risk aggregation is most accurate for insurers?

Answer: A single widespread event, like a cloud outage, can trigger many correlated claims at once

Shared technology dependencies mean one event can hit many insureds simultaneously, creating accumulation risk.

Security awareness training for employees is best classified as which type of risk control?

Answer: Administrative loss prevention control

Training is an administrative control aimed at reducing the frequency of losses such as phishing.

Under the HIPAA Breach Notification Rule, a breach affecting more than 500 residents of a state requires notifying which party in addition to individuals and HHS?

Answer: Prominent media outlets serving that state

Breaches of unsecured PHI affecting more than 500 residents of a state or jurisdiction require media notice.

A risk manager wants leading indicators of cyber exposure. Which is the best key risk indicator?

Answer: Percentage of critical systems with overdue security patches

Patch backlog signals rising vulnerability before a loss happens, making it a leading indicator.