ARM - Associate in Risk Management Cyber and Data Security Risk Questions and Answers

Question 1

A financial services firm discovers that an unauthorized third party accessed and potentially exfiltrated a database containing the names, addresses, and social security numbers of thousands of its customers.
According to most U.S. state data breach notification laws, which of the following is the firm's most critical and immediate responsibility?

Accepted Answer

Notifying affected individuals, and potentially regulators, without unreasonable delay.

Answer

Determining the financial impact on the firm.

Answer

Launching a public relations campaign to manage reputational damage.

Answer

Terminating the employees responsible for the security lapse.

Question 2

A risk manager is developing a strategy to mitigate the risk of a successful phishing attack. Which of the following is the MOST effective control measure to address the human element of this risk?

Accepted Answer

Conducting regular, mandatory security awareness training and phishing simulations for all employees.

Answer

Implementing an advanced email filtering system to block malicious emails.

Answer

Purchasing a comprehensive cyber insurance policy.

Answer

Encrypting all sensitive data at rest and in transit.

Question 3

Which of the following best describes the primary purpose of network segmentation as a cyber risk control measure?

Accepted Answer

To contain the impact of a breach by limiting an attacker's ability to move laterally across the network.

Answer

To encrypt all data that travels between different parts of the network.

Answer

To ensure all employees have access to the resources they need.

Answer

To monitor all incoming and outgoing network traffic for viruses.

Question 4

A manufacturing company relies on a third-party cloud provider to host its critical production and inventory management software. A vulnerability in the cloud provider's platform leads to a significant data breach, exposing the manufacturer's sensitive operational data. This scenario is a prime example of which type of cyber risk?

Accepted Answer

Supply chain risk

Answer

Insider threat

Answer

Operational risk

Answer

Reputational risk

Question 5

According to the NIST Risk Management Framework (RMF), what is the first step an organization should take when managing information security risk?

Accepted Answer

Categorize the information and the system based on its criticality and sensitivity.

Answer

Select and implement security controls.

Answer

Assess the effectiveness of existing controls.

Answer

Authorize the information system for operation.

Question 6

An organization is implementing multi-factor authentication (MFA) as a security control. This measure is primarily designed to mitigate the risk associated with what common cyber threat?

Accepted Answer

Compromised credentials

Answer

Distributed Denial-of-Service (DDoS) attacks

Answer

Fileless malware

Answer

Unpatched software vulnerabilities