Question 1

A hospital's electronic health record (EHR) system is infected with ransomware, encrypting patient records. What is the primary consequence of this ransomware attack in terms of the CIA triad?

Options :

A : Financial losses due to paying the ransom.

B : Loss of availability of patient records for healthcare providers.

C : Unauthorized disclosure of patient health information.

D : Permanent deletion of patient records, impacting data integrity.

Answer: B

Question 2

A company's main website is hosted on an external cloud server. In terms of primary and supporting assets, how should the website and the cloud server be classified?

Options :

A : The cloud server as a primary asset; the website as a supporting asset.

B : Both the website and the cloud server as supporting assets.

C : Both the website and the cloud server as primary assets.

D : The website as a primary asset; the cloud server as a supporting asset.

Answer: D

Question 3

A healthcare organization wants to assess the effectiveness of its controls for protecting patient data. Which method would be most appropriate for identifying these controls?

Options :

A : Monitoring the physical security of data storage facilities.

B : Analyzing patient satisfaction survey results.

C : Conducting a gap analysis against health data protection regulations.

D : Reviewing IT system logs for unusual activities.

Answer: C

Question 4

A retail company has recently conducted a risk assessment for its new online store platform. The risk manager is responsible for documenting the results. What key elements should be included in the risk assessment documentation to ensure it is comprehensive and useful for risk management?

Options :

A : The personal opinions of the IT staff about the platform’s security.

B : Identification of risks, their likelihood, impact, existing controls, and recommended risk treatment options.

C : A record of sales figures since the platform’s launch.

D : A detailed list of all products sold on the platform.

Answer: B

Question 5

A healthcare provider is evaluating the risk of unauthorized access to electronic health records (EHRs). The provider's risk criteria prioritize patient confidentiality and regulatory compliance. How should the risk level be assessed in this scenario?

Options :

A : Moderate, given the presence of basic access controls.

B : High, due to the critical importance of maintaining patient confidentiality and meeting regulatory requirements.

C : Low, as there is a low probability of such an incident occurring.

D : Negligible, assuming the healthcare provider conducts regular security audits.

Answer: B

Free ISO-27005-LRM Mock Exam – Practice Online Confidently

Buying Options: