CASP+ Risk Management and Compliance 2

Question 1

Which risk treatment option is demonstrated when an organization purchases cyber liability insurance?

Accepted Answer

Risk transference

Answer

Cyber liability insurance transfers the financial consequences of a risk to an insurance provider, though the operational risk remains with the organization.

Question 2

A vendor assessment reveals that a critical third-party provider has no incident response plan. Which contractual mechanism BEST addresses this risk?

Accepted Answer

Including security requirements and audit rights in the contract (right-to-audit clause)

Answer

Contract clauses that specify security requirements and grant audit rights enable the organization to verify compliance and mandate remediation, providing enforceable protection.

Question 3

Which quantitative risk analysis technique uses probability distributions and repeated simulations to model the range of possible outcomes?

Accepted Answer

Monte Carlo simulation

Answer

Monte Carlo simulation runs thousands of iterations with random values drawn from probability distributions to produce a range of risk outcomes and their likelihoods.

Question 4

An organization subject to GDPR must respond to a personal data breach notification requirement within what timeframe?

Accepted Answer

72 hours of becoming aware of the breach (if it poses a risk to individuals)

Answer

Article 33 of the GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights.

Question 5

A CASP+ analyst applies threat modeling to a new application. Which methodology uses the mnemonic STRIDE to categorize threats?

Accepted Answer

Microsoft STRIDE threat modeling

Answer

Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Risk Management and Compliance 2