ARM Cyber and Data Security Risk 5 — Questions and Answers
Question 1: Which California law gives consumers rights to know, delete, and opt out of the sale of their personal information?
- CAN-SPAM Act
- California Consumer Privacy Act (Correct answer)
- Electronic Communications Privacy Act
- Sarbanes-Oxley Act
Correct answer: California Consumer Privacy Act
The CCPA, as amended by the CPRA, grants California residents these privacy rights.
Question 2: Which element of a cyber incident response plan should typically come first after an attack is confirmed?
- Public press release
- Lessons-learned review
- Containment to limit spread (Correct answer)
- Restoring from backups
Correct answer: Containment to limit spread
Containment stops the damage from spreading before eradication and recovery begin.
Question 3: An organization keeps offline, immutable backups tested regularly. This control most directly mitigates which risk?
- Phishing emails reaching inboxes
- Insider theft of trade secrets
- Regulatory fines for late notification
- Ransomware-driven data loss (Correct answer)
Correct answer: Ransomware-driven data loss
Offline, immutable backups allow restoration without paying ransom because attackers cannot encrypt them.
Question 4: Which statement about cyber risk aggregation is most accurate for insurers?
- A single widespread event, like a cloud outage, can trigger many correlated claims at once (Correct answer)
- Cyber losses are independent like auto accidents
- Aggregation only affects property insurers
- Aggregation is eliminated by small deductibles
Correct answer: A single widespread event, like a cloud outage, can trigger many correlated claims at once
Shared technology dependencies mean one event can hit many insureds simultaneously, creating accumulation risk.
Question 5: Security awareness training for employees is best classified as which type of risk control?
- Risk financing
- Administrative loss prevention control (Correct answer)
- Physical control
- Risk transfer
Correct answer: Administrative loss prevention control
Training is an administrative control aimed at reducing the frequency of losses such as phishing.
Question 6: Under the HIPAA Breach Notification Rule, a breach affecting more than 500 residents of a state requires notifying which party in addition to individuals and HHS?
- The FBI
- The covered entity's auditors
- Prominent media outlets serving that state (Correct answer)
- The state insurance department
Correct answer: Prominent media outlets serving that state
Breaches of unsecured PHI affecting more than 500 residents of a state or jurisdiction require media notice.
Question 7: A risk manager wants leading indicators of cyber exposure. Which is the best key risk indicator?
- Total cyber claims paid last year
- Number of past breaches
- Annual IT budget
- Percentage of critical systems with overdue security patches (Correct answer)
Correct answer: Percentage of critical systems with overdue security patches
Patch backlog signals rising vulnerability before a loss happens, making it a leading indicator.
