Risk Management ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which risk management framework is known for its structured, six-step process that integrates risk management into the system development life cycle and is widely used in U.S. federal agencies?

   • AISO 31000
   • BFAIR
   • CCOSO ERM
   • DNIST RMF
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A risk manager must communicate a newly identified high-risk issue to the executive team. The executives are concerned about the potential impact on the company's stock price and want to understand the financial exposure. Which communication approach is most effective?

   • AWait until the next quarterly risk report to present the issue.
   • BSend a detailed technical report with all vulnerability details and exploit paths.
   • CPresent a concise summary with the likelihood, potential financial impact, and recommended actions.
   • DDiscuss the risk informally with a few executives to gauge their reaction.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has implemented a risk treatment plan that includes new security controls. Six months later, the risk manager needs to determine whether the controls are effective and whether the risk has been reduced to the expected level. Which approach provides the most reliable evidence?

   • AReview the risk register to confirm that the risk owner has signed off on the treatment.
   • BAsk the security team for their opinion on whether the controls are working.
   • CCheck that the controls are listed in the organization's security policy.
   • DConduct a vulnerability scan and compare the results to the baseline before treatment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary objective of an enterprise risk management (ERM) program?

   • ATo create a risk register that documents every possible threat
   • BTo transfer all risks to third parties through insurance or contracts
   • CTo help the organization achieve its objectives by managing uncertainty in a structured way
   • DTo eliminate all risks that could negatively affect the organization
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is continuous risk monitoring important in an enterprise risk management program?

   • AIt guarantees that all risks are within the organization's risk appetite
   • BIt ensures that risks are eliminated permanently
   • CIt allows the organization to detect changes in the risk environment and assess the effectiveness of controls
   • DIt replaces the need for periodic risk assessments
   Reveal Solution Discussion Select an answer first