Which of the following BEST measures the impact of business interruptions caused by an IT service outage?
Correct Answer: A
Question 72
Which of the following come under the phases of risk identification and evaluation? Each correct answer represents a complete solution. Choose three.
Correct Answer: A,B,C
is incorrect. It comes under risk management process, and not in risk identification and evaluation process.
Question 73
Which of the following would BEST help to ensure that suspicious network activity is identified?
Correct Answer: A
Question 74
One of the risk events you've identified is classified as force majeure. What risk response is likely to be used?
Correct Answer: A
Section: Volume B Explanation: Force majeure describes acts of God (Natural disaster), such as tornados and fires, and are usually accepted because there's little than can be done to mitigate these risks. Incorrect Answers: B: Transference transfers the risk ownership to a third party, usually for a fee. C: Enhance is used for a positive risk event, not for force majeure. D: Mitigation isn't the best choice, as this lowers the probability and/or impact of the risk event.
Question 75
Which of the following laws applies to organizations handling health care information?
Correct Answer: B
Section: Volume C Explanation: HIPAA handles health care information of an organization. The Health Insurance Portability and Accountability Act (HIPAA) were introduced in 1996. It ensures that health information data is protected. Before HIPAA, personal medical information was often available to anyone. Security to protect the data was lax, and the data was often misused. If your organization handles health information, HIPAA applies. HIPAA defines health information as any data that is created or received by health care providers, health plans, public health authorities, employers, life insurers, schools or universities, and health care clearinghouses. HIPAA defines any data that is related to the health of an individual, including past/present/future health, physical/mental health, and past/present/future payments for health care. Creating a HIPAA compliance plan involves following phases: * Assessment: An assessment helps in identifying whether organization is covered by HIPAA. If it is, then further requirement is to identify what data is needed to protect. * Risk analysis: A risk analysis helps to identify the risks. In this phase, analyzing method of handling data of organization is done. * Plan creation: After identifying the risks, plan is created. This plan includes methods to reduce the risk. * Plan implementation: In this plan is being implemented. * Continuous monitoring: Security in depth requires continuous monitoring. Monitor regulations for changes. Monitor risks for changes. Monitor the plan to ensure it is still used. * Assessment: Regular reviews are conducted to ensure that the organization remains in compliance. Incorrect Answers: A: GLBA is not used for handling health care information. C: SOX designed to hold executives and board members personally responsible for financial data. D: FISMA ensures protection of data of federal agencies.
