Cybersecurity & Risk Management Flashcards

In a risk matrix, a threat with HIGH likelihood and LOW impact should be handled with which risk response strategy?

Answer: Monitor and mitigate

High-likelihood, low-impact risks should be actively monitored and mitigated to reduce their frequency while managing their limited consequences.

Which principle dictates that employees should only have access to the systems and data necessary for their specific job functions?

Answer: Least privilege

The principle of least privilege restricts user access rights to the minimum necessary to perform their job duties.

An organization wants to ensure that no single employee can complete a sensitive HR transaction—such as a salary change—without a second approval. This control is called:

Answer: Separation of duties

Separation of duties requires multiple individuals to complete sensitive transactions, reducing the risk of fraud or error.

A talent consultant is helping redesign onboarding to include cybersecurity awareness training. Which training format has been shown to be MOST effective at changing employee behavior?

Answer: Short, frequent, scenario-based micro-learning modules

Short, frequent, scenario-based micro-learning is more effective at sustaining behavioral change than infrequent, lengthy training sessions.

Which regulation specifically requires US healthcare organizations to protect employee and patient health information (PHI) through administrative, physical, and technical safeguards?

Answer: HIPAA

HIPAA's Security Rule mandates administrative, physical, and technical safeguards to protect electronic protected health information (ePHI).

During a talent optimization project, a consultant identifies that the client stores sensitive applicant background check data in unencrypted spreadsheets. This represents which type of risk?

Answer: Data at rest vulnerability

Unencrypted data at rest is a vulnerability that exposes sensitive information if storage media is accessed or stolen.

A company experiences a breach where attackers accessed the ATS by exploiting a vulnerability in a third-party recruiting plugin. This is an example of which attack vector?

Answer: Supply chain or third-party attack

Supply chain attacks exploit vulnerabilities in third-party vendors or software that has trusted access to the target organization's systems.