Cyber Risk Analyst

Sample question 1

Verano Pay, a fintech company, is wiring a third-party large language model into its fraud review workflow through new plugins that read transaction records and write to the internal case management system. Executive leadership asks the cyber risk analyst to develop a cybersecurity risk management plan for the integration before it goes live. Which deliverable best fulfills the request?

1. A.Threats specific to the integration, such as prompt injection through case notes and plugin permission abuse, rated for likelihood and impact, with prioritized controls, named owners, and a reassessment schedule.
2. B.A registration of the integration in the enterprise risk register under the existing third-party technology category, inheriting the data handling, access control, and incident response requirements the enterprise security policy already defines.
3. C.A vendor agreement package covering uptime commitments, data processing terms, breach notification windows, and audit rights, negotiated with the model provider's counsel and reviewed annually at contract renewal.
4. D.A pre-launch penetration test of the plugin layer, with remediation of critical and high findings gated before go-live and a retest scheduled at the first anniversary of the deployment.

Sample question 2

Novara Biotech is onboarding a new business unit, a contract research subsidiary that stores unpublished clinical trial data and connects to several external contract research organizations over site-to-site VPN links. Leadership asks you to develop a cybersecurity risk profile for this business unit ahead of its integration into the parent company's risk program. What should the risk profile primarily characterize?

1. A.The unit's technical vulnerability state: the specific weaknesses surfaced by its most recent vulnerability scans and penetration tests, each ranked by CVSS severity, mapped to its exploitability and current patch status, and tracked against remediation deadlines, because the concentration of exploitable technical flaws is what most directly drives the unit's exposure ahead of integration.
2. B.The unit's regulatory conformance: the clinical-data regulations and the data-protection clauses in its contracts with external research organizations, the control gaps found when auditing it against the relevant framework, the remediation owners assigned to each gap, and the target closure dates, because conformance to its required controls is the firmest signal of the unit's risk ahead of integration.
3. C.The unit's overall risk exposure: which of its assets and data are most critical and sensitive, the threats it plausibly faces given its clinical trial data and external VPN links, the maturity of its existing controls, and the risk posture that results, so the risk program gains a structured baseline to monitor and prioritize against over time.
4. D.The unit's threat environment: the adversaries likely to pursue unpublished clinical trial data, the motivations and techniques those actors typically rely on, the attack paths its external VPN links to research partners expose, and recent intrusion campaigns against biotech targets, because a detailed picture of who might attack and how is the substance of a risk profile.

Sample question 3

You are the Cyber Risk Analyst at Meridian Health Partners, a regional healthcare payer. The CISO has asked you to build a FAIR-based loss-exceedance model for the scenario "ransomware disables claims-processing systems for 5 or more consecutive business days," to support a board decision on cyber insurance retention. You have gathered threat intelligence putting ransomware incidents against similar payers at roughly once every 8 years, along with claims-team estimates of downtime costs. The CFO, who has no security background, asks you to summarize the model before the board meeting. Which approach best reflects sound FAIR practice?

1. A.Provide the CFO with the single most likely annual loss figure calculated from the median threat frequency and median loss magnitude, since a single number is easier for a non-technical board to act on than a probability distribution.
2. B.Calculate threat event frequency from the exact historical ransomware base rate reported by a single vendor threat report, and present the expected loss to the nearest thousand dollars to demonstrate analytical rigor to the board.
3. C.Present threat-event-frequency and loss-magnitude as calibrated ranges (e.g., 90% confidence intervals) derived from structured estimation, and show the resulting loss-exceedance curve so the board can see the probability of exceeding various loss thresholds, rather than a single number.
4. D.Replace the numeric threat and loss estimates with a qualitative high, medium, or low risk rating for the scenario, since board members are generally more comfortable interpreting qualitative labels than they are interpreting probabilistic loss-exceedance curves.