HR Risk Assessment & Management 3

Question 1

A company decides to purchase cyber-liability insurance for its HR data systems. Which risk response strategy does this represent?

Accepted Answer

Risk transfer

Answer

Purchasing insurance shifts the financial consequences of a risk event to the insurer, which is risk transfer.

Question 2

Under the NIST Risk Management Framework (RMF), which step comes IMMEDIATELY after 'Categorize'?

Accepted Answer

Select

Answer

The RMF sequence is Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor.

Question 3

An HR system stores Social Security Numbers. Under NIST FIPS 199, what impact level would a breach of this data MOST likely be classified?

Accepted Answer

High

Answer

SSNs are personally identifiable information whose unauthorized disclosure can cause severe harm, warranting a High confidentiality impact.

Question 4

A risk owner differs from a risk manager primarily because the risk owner:

Accepted Answer

Is accountable for the outcome if the risk materializes

Answer

The risk owner is the senior person accountable for ensuring the risk is managed and bears responsibility for outcomes.

Question 5

Which type of HR risk assessment evaluates the likelihood that a new hire will engage in workplace misconduct?

Accepted Answer

Pre-employment background screening risk assessment

Answer

Pre-employment background screening assesses red flags that predict potential misconduct or dishonesty.

HR - Software Practice Test