Cybersecurity & Risk Management Flashcards
7 cards from real TOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Cybersecurity & Risk Management flashcards as text
Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in the context of HR systems?
Answer: To identify critical HR processes and quantify the impact of their disruption
A Business Impact Analysis identifies critical processes and quantifies the operational, financial, and reputational impact if those processes are disrupted.
A talent optimization consultant recommends implementing a 'clean desk policy.' Which risk does this PRIMARILY mitigate?
Answer: Physical exposure of sensitive documents and credentials
A clean desk policy reduces the risk that sensitive documents, passwords, or access credentials left visible could be accessed by unauthorized individuals.
When employees work remotely, which security control BEST protects company HR data transmitted over public or home networks?
Answer: Requiring a VPN for all remote access to corporate systems
A VPN encrypts all traffic between the remote employee and corporate systems, protecting data from interception on untrusted networks.
An organization's cybersecurity risk register shows a risk with a residual risk score above the acceptable threshold after controls are applied. What should happen next?
Answer: Escalate to leadership and implement additional controls or transfer the risk
Residual risks exceeding the acceptable threshold must be escalated to leadership who can approve additional mitigations or risk transfer options like insurance.
A new HR technology vendor claims SOC 2 Type II compliance. What does this certification primarily assure?
Answer: The vendor's controls for security, availability, and confidentiality have been tested over a period of time
SOC 2 Type II audits verify that a vendor's controls have been operating effectively over a defined review period, not just at a point in time.
Which approach to identity management automatically removes system access when an employee transitions to a new role or department?
Answer: Role-based access control (RBAC) integrated with HRIS role changes
RBAC integrated with the HRIS automatically adjusts access rights when an employee's role is updated, ensuring permissions match their current responsibilities.
A cybersecurity awareness program shows low completion rates among high-performing sales employees. Using talent optimization principles, what is the BEST approach?
Answer: Analyze behavioral data to redesign training that aligns with how high-performers prefer to learn
Talent optimization applies people data and behavioral insights to design interventions that match how different employee segments are motivated to engage.