Risk Management ACCISO Practice Questions (Page 10)

Questions 46–48

1. 46expert · hard

   A company has implemented a risk treatment to reduce the risk of phishing by deploying email filtering. The CISO wants to establish a monitoring process to ensure the treatment remains effective over time. Which combination of activities would provide the most comprehensive monitoring?

   • ATrack phishing email volume and conduct periodic simulated phishing campaigns
   • BConduct a one-time penetration test after deployment
   • CRely on user reports of phishing emails without further analysis
   • DReview the risk register annually and update likelihood scores
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A risk analyst is using a qualitative risk assessment to evaluate the risk of a new product launch. The analyst rates the likelihood as 'high' and the impact as 'moderate'. The organization's risk matrix defines 'high likelihood and moderate impact' as a 'medium' risk. The product manager argues that the risk should be 'high' because the product is critical to revenue. What is the most appropriate response?

   • AAccept the product manager's assessment and classify the risk as 'high'.
   • BReclassify the impact as 'high' because the product is critical to revenue.
   • CUse the organization's risk matrix to classify the risk as 'medium' and document the rationale.
   • DChange the likelihood rating to 'very high' to reflect the product's importance.
   Reveal Solution Discussion Select an answer first
3. 48foundation · easy

   What role does senior leadership play in fostering an effective risk management culture?

   • AThey set the tone at the top by demonstrating commitment to risk management
   • BThey ensure that risk management is a separate function with no interaction with other departments
   • CThey delegate all risk decisions to external auditors
   • DThey focus solely on financial risks and ignore operational risks
   Reveal Solution Discussion Select an answer first